Azure
diff --git a/‎eng/common/TestResources/README.md
+1 b/‎eng/common/TestResources/README.md
+1
diff --git a/‎eng/common/TestResources/SubConfig-Helpers.ps1
+6 b/‎eng/common/TestResources/SubConfig-Helpers.ps1
+6
diff --git a/‎eng/common/TestResources/build-test-resource-config.yml
+8 b/‎eng/common/TestResources/build-test-resource-config.yml
+8
diff --git a/‎eng/common/pipelines/templates/steps/create-pull-request.yml
+6-6 b/‎eng/common/pipelines/templates/steps/create-pull-request.yml
+6-6
diff --git a/‎eng/common/pipelines/templates/steps/docs-metadata-release.yml
-119 b/‎eng/common/pipelines/templates/steps/docs-metadata-release.yml
-119
diff --git a/‎eng/common/pipelines/templates/steps/docsms-ensure-validation.yml
+12 b/‎eng/common/pipelines/templates/steps/docsms-ensure-validation.yml
+12
diff --git a/‎eng/common/pipelines/templates/steps/eng-common-workflow-enforcer.yml
+11-1 b/‎eng/common/pipelines/templates/steps/eng-common-workflow-enforcer.yml
+11-1
diff --git a/‎eng/common/pipelines/templates/steps/sparse-checkout.yml
+12-3 b/‎eng/common/pipelines/templates/steps/sparse-checkout.yml
+12-3
diff --git a/‎eng/common/pipelines/templates/steps/update-docsms-metadata.yml
+1-4 b/‎eng/common/pipelines/templates/steps/update-docsms-metadata.yml
+1-4
@@ -89,6 +89,7 @@ Below is an example of how `$templateFileParameters` can be used to pass data fr
 
 **Snippet from `test-resources-pre.ps1`**
 ```powershell
+Import-Module -Name ./eng/common/scripts/X509Certificate2
 $cert = New-X509Certificate2 -SubjectName '[email protected], CN=Azure SDK, OU=Azure SDK, O=Microsoft, L=Frisco, S=TX, C=US' -ValidDays 3652
 # Create new entries in $templateFileParameters
 $templateFileParameters['ConfidentialLedgerPrincipalPEM'] = Format-X509Certificate2 -Certificate $cert
 
@@ -109,11 +109,17 @@ function SetSubscriptionConfiguration([object]$subscriptionConfiguration)
                 # Mark values as secret so we don't print json blobs containing secrets in the logs.
                 # Prepend underscore to the variable name, so we can still access the variable names via environment
                 # variables if they get set subsequently.
+                if ([Environment]::GetEnvironmentVariable($nestedPair.Name)) {
+                    throw "Environment variable '$($nestedPair.Name)' is already set. Check the tests.yml/ci.yml EnvVars parameter does not conflict with the subscription config json"
+                }
                 if (ShouldMarkValueAsSecret "AZURE_" $nestedPair.Name $nestedPair.Value) {
                     Write-Host "##vso[task.setvariable variable=_$($nestedPair.Name);issecret=true;]$($nestedPair.Value)"
                 }
             }
         } else {
+            if ([Environment]::GetEnvironmentVariable($pair.Name)) {
+                throw "Environment variable '$($pair.Name)' is already set. Check the tests.yml/ci.yml EnvVars parameter does not conflict with the subscription config json"
+            }
             if (ShouldMarkValueAsSecret "AZURE_" $pair.Name $pair.Value) {
                 Write-Host "##vso[task.setvariable variable=_$($pair.Name);issecret=true;]$($pair.Value)"
             }
 
@@ -5,6 +5,10 @@ parameters:
   - name: SubscriptionConfigurations
     type: object
     default: null
+  # EnvVars is used to help diagnose variable conflict issues early
+  - name: EnvVars
+    type: object
+    default: null
 
 steps:
   - ${{ if parameters.SubscriptionConfiguration }}:
@@ -16,6 +20,8 @@ steps:
         . ./eng/common/TestResources/SubConfig-Helpers.ps1
         SetSubscriptionConfiguration $config
       displayName: Initialize SubscriptionConfiguration variable
+      ${{ if parameters.EnvVars }}:
+        env: ${{ parameters.EnvVars }}
 
   - ${{ if parameters.SubscriptionConfigurations }}:
     - pwsh: |
@@ -36,3 +42,5 @@ steps:
           UpdateSubscriptionConfiguration $configBase $config
 
         displayName: Merge Test Resource Configurations
+        ${{ if parameters.EnvVars }}:
+          env: ${{ parameters.EnvVars }}
@@ -13,9 +13,9 @@ parameters:
   PRTitle: not-specified
   PRBody: ''
   ScriptDirectory: eng/common/scripts
-  GHReviewersVariable: ''
-  GHTeamReviewersVariable: ''
-  GHAssignessVariable: ''
+  GHReviewers: ''
+  GHTeamReviewers: ''
+  GHAssignees: ''
   # Multiple labels seperated by comma, e.g. "bug, APIView"
   PRLabels: ''
   SkipCheckingForChanges: false
@@ -52,8 +52,8 @@ steps:
       -PRTitle "${{ parameters.PRTitle }}"
       -PRBody "${{ coalesce(parameters.PRBody, parameters.CommitMsg, parameters.PRTitle) }}"
       -PRLabels "${{ parameters.PRLabels }}"
-      -UserReviewers "$(${{ parameters.GHReviewersVariable }})"
-      -TeamReviewers "$(${{ parameters.GHTeamReviewersVariable }})"
-      -Assignees "$(${{ parameters.GHAssignessVariable }})"
+      -UserReviewers "${{ parameters.GHReviewers }}"
+      -TeamReviewers "${{ parameters.GHTeamReviewers }}"
+      -Assignees "${{ parameters.GHAssignees }}"
       -CloseAfterOpenForTesting $${{ coalesce(parameters.CloseAfterOpenForTesting, 'false') }}
       -OpenAsDraft $${{ parameters.OpenAsDraft }}
@@ -0,0 +1,12 @@
+steps:
+# Fail the build if any of the packages failed validation. Valid values are
+# "true" or "false". This step will skip if $(DocsMsPackagesAllValid) is not set
+- pwsh: |
+    if ('$(DocsMsPackagesAllValid)' -eq 'true') {
+      Write-Host "All packages passed validation."
+    } else {
+      Write-Error "Some packages failed validation."
+      exit 1
+    }
+  displayName: Check package validation results
+  condition: and(succeeded(), ne(variables['DocsMsPackagesAllValid'], ''))
@@ -19,5 +19,15 @@ steps:
             exit 1
           }
         }
-      displayName: Prevent changes to eng/common outside of azure-sdk-tools repo
+        if ((!"$(System.PullRequest.SourceBranch)".StartsWith("sync-.github/workflows")) -and "$(System.PullRequest.TargetBranch)" -match "^(refs/heads/)?$(DefaultBranch)$")
+        {
+          $filesInCommonDir  = & "eng/common/scripts/get-changedfiles.ps1" -DiffPath '.github/workflows/*'
+          if (($LASTEXITCODE -eq 0) -and ($filesInCommonDir.Count -gt 0))
+          {
+            Write-Host "##vso[task.LogIssue type=error;]Changes to files under '.github/workflows' directory should not be made in this Repo`n${filesInCommonDir}"
+            Write-Host "##vso[task.LogIssue type=error;]Please follow workflow at https://github.com/Azure/azure-sdk-tools/blob/main/doc/workflows/engsys_workflows.md"
+            exit 1
+          }
+        }
+      displayName: Prevent changes to eng/common and .github/workflows outside of azure-sdk-tools repo
       condition: and(succeeded(), ne(variables['Skip.EngCommonWorkflowEnforcer'], 'true'), not(endsWith(variables['Build.Repository.Name'], '-pr')))
@@ -29,7 +29,7 @@ steps:
             if (!$dir) {
               $dir = "./$($repository.Name)"
             }
-            New-Item $dir -ItemType Directory -Force
+            New-Item $dir -ItemType Directory -Force | Out-Null
             Push-Location $dir
 
             if (Test-Path .git/info/sparse-checkout) {
@@ -46,6 +46,10 @@ steps:
                 git clone --no-checkout --filter=tree:0 https://github.com/$($repository.Name) .
               }
 
+              # Turn off git GC for sparse checkout. Note: The devops checkout task does this by default
+              Write-Host "git config gc.auto 0"
+              git config gc.auto 0
+
               Write-Host "git sparse-checkout init"
               git sparse-checkout init
 
@@ -66,9 +70,14 @@ steps:
 
             # sparse-checkout commands after initial checkout will auto-checkout again
             if (!$hasInitialized) {
-              Write-Host "git -c advice.detachedHead=false checkout $($repository.Commitish)"
+              # Remove refs/heads/ prefix from branch names
+              $commitish = $repository.Commitish -replace '^refs/heads/', ''
+
+              # use -- to prevent git from interpreting the commitish as a path
+              Write-Host "git -c advice.detachedHead=false checkout $commitish --"
+
               # This will use the default branch if repo.Commitish is empty
-              git -c advice.detachedHead=false checkout $($repository.Commitish)
+              git -c advice.detachedHead=false checkout $commitish --
             } else {
               Write-Host "Skipping checkout as repo has already been initialized"
             }
 
@@ -100,10 +100,7 @@ steps:
           -Language '${{parameters.Language}}' `
           -RepoId '${{ parameters.RepoId }}' `
           -DocValidationImageId '${{ parameters.DocValidationImageId }}' `
-          -PackageSourceOverride '${{ parameters.PackageSourceOverride }}' `
-          -TenantId '$(opensource-aad-tenant-id)' `
-          -ClientId '$(opensource-aad-app-id)' `
-          -ClientSecret '$(opensource-aad-secret)'
+          -PackageSourceOverride '${{ parameters.PackageSourceOverride }}'
       displayName: Apply Documentation Updates
 
     - template: /eng/common/pipelines/templates/steps/git-push-changes.yml
Original file line number	Diff line number	Diff line change
`@@ -109,11 +109,17 @@ function SetSubscriptionConfiguration([object]$subscriptionConfiguration)`
`109`	`109`	`# Mark values as secret so we don't print json blobs containing secrets in the logs.`
`110`	`110`	`# Prepend underscore to the variable name, so we can still access the variable names via environment`
`111`	`111`	`# variables if they get set subsequently.`
	`112`	`+ if ([Environment]::GetEnvironmentVariable($nestedPair.Name)) {`
	`113`	`+ throw "Environment variable '$($nestedPair.Name)' is already set. Check the tests.yml/ci.yml EnvVars parameter does not conflict with the subscription config json"`
	`114`	`+ }`
`112`	`115`	`if (ShouldMarkValueAsSecret "AZURE_" $nestedPair.Name $nestedPair.Value) {`
`113`	`116`	`Write-Host "##vso[task.setvariable variable=_$($nestedPair.Name);issecret=true;]$($nestedPair.Value)"`
`114`	`117`	`}`
`115`	`118`	`}`
`116`	`119`	`} else {`
	`120`	`+ if ([Environment]::GetEnvironmentVariable($pair.Name)) {`
	`121`	`+ throw "Environment variable '$($pair.Name)' is already set. Check the tests.yml/ci.yml EnvVars parameter does not conflict with the subscription config json"`
	`122`	`+ }`
`117`	`123`	`if (ShouldMarkValueAsSecret "AZURE_" $pair.Name $pair.Value) {`
`118`	`124`	`Write-Host "##vso[task.setvariable variable=_$($pair.Name);issecret=true;]$($pair.Value)"`
`119`	`125`	`}`