ci: publish beta NuGet packages through ESRP

CONTRIBUTING.md

@@ -13,6 +13,14 @@ All pull requests should be submitted against the **main** branch or a specific
 
 When a new package is about to be released, the release PR will be merged into main. The package will be generated from main.
 
+The `pipelines/ci-build.yml` pipeline builds and signs `Microsoft.Graph.Beta`, then publishes
+the package and its `.snupkg` symbols through ESRP after the `nuget-org` environment approval.
+Only the package and symbol files are staged in the dedicated ESRP submission folder; release
+scripts remain outside it. `NuGetOrganizationName` is set to `microsoftgraph`, a listed owner
+on the [NuGet package page](https://www.nuget.org/packages/Microsoft.Graph.Beta) and
+[NuGet owner profile](https://www.nuget.org/profiles/microsoftgraph). ESRP waits for release
+completion, while the separate Release Please workflow continues to manage GitHub releases.
+
 ## Commit message format
 
 To support our automated release process, pull requests are required to follow the [Conventional Commit](https://www.conventionalcommits.org/en/v1.0.0/)

pipelines/ci-build.yml

@@ -8,6 +8,7 @@ trigger:
 pr: none
 variables:
   BuildConfiguration: 'release'
+  NuGetOrganizationName: 'microsoftgraph'
   ProductBinPath: '$(Build.SourcesDirectory)\src\Microsoft.Graph\bin\$(BuildConfiguration)'
 resources:
   repositories:
@@ -297,11 +298,6 @@ extends:
             runOnce:
               deploy:
                 steps:
-                - task: NuGetToolInstaller@1
-                  displayName: 'Use NuGet >=5.2.0'
-                  inputs:
-                    versionSpec: '>=5.2.0'
-                    checkLatest: true
                 - task: PowerShell@2
                   displayName: 'Get Latest Commit SHA from repo'
                   inputs:
@@ -316,11 +312,31 @@ extends:
                     filePath: $(Pipeline.Workspace)\scripts\GetNugetPackageVersion.ps1
                     pwsh: true
                     arguments: '-packageDirPath "$(Pipeline.Workspace)/"'
-                - task: 1ES.PublishNuget@1
-                  displayName: 'Push release to NuGet.org'
+                - task: CopyFiles@2
+                  displayName: 'Stage NuGet packages for ESRP release'
+                  inputs:
+                    SourceFolder: '$(Pipeline.Workspace)'
+                    Contents: |
+                      Microsoft.Graph.Beta.*.nupkg
+                      Microsoft.Graph.Beta.*.snupkg
+                    TargetFolder: '$(Pipeline.Workspace)\nuget-packages\$(NuGetOrganizationName)'
+                - task: EsrpRelease@14
+                  displayName: 'ESRP Release - NuGet'
                   inputs:
-                    command: push
-                    packageParentPath: '$(Pipeline.Workspace)'
-                    packagesToPush: '$(Pipeline.Workspace)\Microsoft.Graph.Beta.*.nupkg'
-                    nuGetFeedType: external
-                    publishFeedCredentials: 'microsoftgraph NuGet connection'
+                    connectedservicename: 'Federated DevX ESRP Managed Identity Connection'
+                    usemanagedidentity: false
+                    keyvaultname: 'akv-prod-eastus'
+                    authcertname: 'ReferenceLibraryPrivateCert'
+                    signcertname: 'ReferencePackagePublisherCertificate'
+                    clientid: '65035b7f-7357-4f29-bf25-c5ee5c3949f8'
+                    intent: 'packagedistribution'
+                    contenttype: 'NuGet'
+                    organizationname: '$(NuGetOrganizationName)'
+                    contentsource: 'Folder'
+                    folderlocation: '$(Pipeline.Workspace)\nuget-packages\$(NuGetOrganizationName)'
+                    waitforreleasecompletion: true
+                    owners: 'christiano@microsoft.com,ramsess@microsoft.com,gavinbarron@microsoft.com,jingjingjia@microsoft.com,peombwa@microsoft.com,treicys@microsoft.com'
+                    approvers: 'christiano@microsoft.com,ramsess@microsoft.com,gavinbarron@microsoft.com,jingjingjia@microsoft.com,peombwa@microsoft.com,treicys@microsoft.com'
+                    serviceendpointurl: 'https://api.esrp.microsoft.com/'
+                    mainpublisher: 'ESRPRELPACMAN'
+                    domaintenantid: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'