From a96cfea3ef8022de7e7279001e4853b0fd390d96 Mon Sep 17 00:00:00 2001
From: Joey Robichaud <jorobich@microsoft.com>
Date: Thu, 3 Sep 2026 09:25:08 -0700
Subject: [PATCH] Fix official build WIF package publishing

Authenticate to the DevDiv VS feed with NuGetAuthenticate and push packages with dotnet nuget so the WIF-backed service connection is not passed to an ExternalNuGetFeed-only task.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 azure-pipelines.yml | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 98431b959..8e72c3d42 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -111,19 +111,33 @@ extends:
             steps:
             - checkout: self
               clean: true
+            - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
+              - task: NuGetAuthenticate@1
+                displayName: Authenticate to CoreXT Feed
+                inputs:
+                  azureDevOpsServiceConnection: dnceng-devdiv-vs-feed-push
+                  feedUrl: https://pkgs.dev.azure.com/devdiv/_packaging/VS/nuget/v3/index.json
             - script: eng\common\cibuild.cmd -configuration $(_BuildConfig) -prepareMachine $(_BuildArgs)
               displayName: Build and Test
             - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-              - task: 1ES.PublishNuget@1
+              - task: PowerShell@2
                 displayName: Publish CoreXT Packages
-                inputs:
-                  command: push
-                  packagesToPush: '$(Build.SourcesDirectory)\artifacts\packages\$(_BuildConfig)\Shipping\*.nupkg'
-                  packageParentPath: $(Build.SourcesDirectory)\artifacts\packages\$(_BuildConfig)\Shipping\
-                  allowPackageConflicts: true
-                  nuGetFeedType: external
-                  publishFeedCredentials: 'dnceng-devdiv-vs-feed-push'
                 condition: succeeded()
+                inputs:
+                  targetType: inline
+                  script: |
+                    $feedUrl = "https://pkgs.dev.azure.com/devdiv/_packaging/VS/nuget/v3/index.json"
+                    $packages = Get-ChildItem -Path "$(Build.SourcesDirectory)\artifacts\packages\$(_BuildConfig)\Shipping" -Filter "*.nupkg"
+                    Write-Host "Found $($packages.Count) packages to push"
+                    foreach ($package in $packages) {
+                      Write-Host "Pushing $($package.Name)..."
+                      & dotnet nuget push $package.FullName --source $feedUrl --api-key AzureDevOps --skip-duplicate
+                      if ($LASTEXITCODE -ne 0) {
+                        Write-Error "Failed to push $($package.Name)"
+                        exit 1
+                      }
+                    }
+                    Write-Host "Successfully pushed $($packages.Count) packages"
           - ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
             - job: MacOS
               displayName: 'MacOS'