Symbols Publishing Follow-up

[paulmedynski]

Summary

Switches the OneBranch publish symbols jobs from Windows to Linux agents, fixes a cross-org authentication issue discovered during validation, and routes official symbols to PPE when releaseToProduction is false.

Follow-up to #4175.

Changes

Linux Pool for Symbols Jobs

• Change pool.type from windows to linux in publish-symbols-job.yml.
• Add LinuxContainerImage variable to onebranch-variables.yml.
• Add .artifactignore step to suppress empty artifact auto-publishing on Linux.

Fix cross-org symbol upload authentication (VS30063)

• Move ArtifactServices.Symbol.AccountName from a runtime ##vso[task.setvariable] step (which ran inside the build container) to a job-level variable.
• Root cause: On OneBranch Linux agents, PublishSymbols@2 runs on the host agent (outside the build container) due to 1ES Pipeline Template credential isolation. The host defaults to the microsoft org, so $(System.AccessToken) (scoped to SqlClientDrivers) could not authenticate against https://microsoft.artifacts.visualstudio.com. Setting the variable at job scope makes it visible to both container and host steps, routing the upload to https://SqlClientDrivers.artifacts.visualstudio.com.
• On Windows this was not an issue because the host agent was already in the SqlClientDrivers org context.

Route official symbols to PPE when releaseToProduction is false

• The official pipeline's publishSymbols stage was hardcoded to the Production symbol server regardless of the releaseToProduction flag. This meant there was no way to do a full dry-run release targeting both NuGet Test and symbol server PPE.
• Now releaseToProduction drives both destinations:
  • true → NuGet Production + Production symbol server
  • false → NuGet Test + PPE symbol server
• The publishSymbols flag still independently controls whether symbols are published at all.
• The non-official pipeline is unchanged (always PPE).

Testing

• Non-official pipeline build 148586 failed with VssUnauthorizedException (VS30063) on Linux → root cause identified → fix applied → re-run expected to succeed.
• TBD: Validate ESRP minimatch changes with an Official pipeline run (since ESRP tasks only execute in Official runs).

[Copilot]

Pull request overview

This PR updates the OneBranch symbols publishing stage to run on Linux agents and adjusts symbol-upload configuration to work correctly under 1ES Pipeline Template host/container credential isolation.

Changes:

• Switch publish-symbols-job.yml to a Linux pool and add a workaround to avoid publishing meaningful job artifacts.
• Move ArtifactServices.Symbol.AccountName configuration to job scope (instead of setting it at runtime inside the container).
• Add a Linux container image variable and update symbol-publish step comments accordingly.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
eng/pipelines/onebranch/variables/onebranch-variables.yml	Adds LinuxContainerImage and clarifies container image variables.
eng/pipelines/onebranch/steps/publish-symbols-step.yml	Removes runtime variable-setting step; documents why job-level scope is required.
eng/pipelines/onebranch/jobs/publish-symbols-job.yml	Switches symbols publishing job to Linux; sets org-routing variable at job scope; adds .artifactignore generation to produce empty auto-published artifacts.