Create YAML Kerberos Test Pipeline by paulmedynski · Pull Request #4252 · dotnet/SqlClient

paulmedynski · 2026-04-30T18:11:15Z

Summary

Redesigns the Kerberos authentication test pipeline with the following improvements:

Changes

Schedule: Changed from nightly to daily (07:00 UTC) on main, release/6.1, and release/7.0
Task Migration: Replaced all MSBuild@1 tasks with DotNetCoreCLI@2 for better .NET tooling integration
Template Extraction: Extracted common build and test steps into a reusable build-and-test-steps.yml template shared by both Windows and Linux stages
Matrix Variable Naming: Renamed matrix variable from targetFramework to testFramework to prevent MSBuild property collision (fixes NETSDK1005 build failures)
Code Quality: Added retry logic (retryCountOnTaskFailure) to test steps for improved resilience
Documentation: Updated header comments to reflect current pipeline structure and job breakdown

Job Breakdown (10 total)

Windows: 7 jobs (net462 + net8/9/10 with NativeSNI/ManagedSNI combinations)
Linux: 3 jobs (net8, net9, net10 with ManagedSNI)
Code Coverage: 1 consolidation job

Files Modified

eng/pipelines/kerberos/sqlclient-kerberos.yml - Main pipeline definition
eng/pipelines/kerberos/build-and-test-steps.yml - NEW shared steps template
eng/pipelines/kerberos/linux-init-step.yml - Formatting updates
eng/pipelines/kerberos/linux-cleanup-step.yml - Formatting updates

Validation

Built and tested with various testFramework values (net8.0, net9.0) — no build failures
All YAML syntax validated
Kerberos pipeline run: https://dev.azure.com/SqlClientDrivers/ADO.Net/_build/results?buildId=150526&view=results

- BuildAll BuildAllConfigurations (Windows) - BuildAll BuildSqlClient (Linux) - Remove nonexistent BuildTestsNetFx/BuildTestsNetCore steps (tests build via RunTests) - Add -p:ReferenceType=Project for all build and test steps - Add -p:GenerateNuget=false to skip package generation - Use multi-line msbuildArguments for readability

BuildAllConfigurations builds GenAPI tools and cross-OS packages which are not needed for testing and fail due to .NET 10 SDK incompatibility with VS 2022. BuildSqlClient is leaner — builds only the driver, which is all the test pipeline needs.

VS MSBuild (MSBuild@1) does not fully support .NET 10 SDK, causing NETSDK1005 errors when resolving P2P references across TFMs (net8.0 target for Microsoft.SqlServer.Server which only targets net46/netstandard2.0). - Windows netfx: use -t:BuildNetFx (only builds net462, avoids net8.0) - Windows netcore: switch to DotNetCoreCLI@2 (dotnet msbuild) which uses the .NET 10 SDK properly, matching the Linux build pattern - Remove separate Restore step for netcore (restore runs inside BuildSqlClient dependency chain) - Linux: unchanged (already uses DotNetCoreCLI@2)

The BuildSqlClient target restores SqlServer.Server standalone for net46/netstandard2.0, but when the NetCore driver P2P references it, the .NET 10 SDK looks for net8.0 in the assets file and fails with NETSDK1005. Running a full -t:restore first (which restores all projects including P2P dependency chains) creates proper assets files before the build begins. This matches the CI pipeline pattern.

BuildSqlClient succeeds locally but fails on ADO agents with NETSDK1005 because stale project.assets.json files from previous runs are cached in the agent workspace. Adding an explicit clean of obj/ and artifacts/ folders before restore ensures a fresh build environment.

…uildTools=false Match the CI pipeline pattern exactly: - Use MSBuild@1 (VS MSBuild) which is what the CI pipeline uses on Windows - Use BuildAllConfigurations target (what CI uses, builds all OS variants) - Add -p:BuildTools=false to skip GenAPI tools (avoids net10/VS2022 compat issue) - Remove clean step (not needed with correct build target) - BuildSqlClient with DotNetCoreCLI@2 fails on agents due to SqlServer.Server being resolved for net8.0 through P2P dependency chain, even though it only works locally

BuildAllConfigurations uses BuildNetCoreAllOS which builds the driver for all OS variants (Unix, Windows_NT, AnyOS). This is unnecessary for a test pipeline and may contribute to the NETSDK1005 error where SqlServer.Server is incorrectly built for net8.0. BuildNetCore builds only for the host OS and is the appropriate target for test pipelines that just need the driver built locally.

Build the netcore driver csproj directly with 'dotnet build' via DotNetCoreCLI@2 instead of using build.proj targets (BuildNetCore, BuildAllConfigurations). build.proj's dependency chain includes BuildSqlServer which causes Microsoft.SqlServer.Server.csproj to be built with TargetFramework=net8.0 as a global property, triggering NETSDK1005 because its assets file only has targets for net46 and netstandard2.0. Building the driver csproj directly avoids this entirely: the driver uses a PackageReference to SqlServer.Server (version 1.0.0 from NuGet), not a ProjectReference. The driver's P2P dependencies (Abstractions, Logging) are automatically built via their ProjectReferences. The RunTests step continues to use build.proj since it just invokes 'dotnet test' via Exec, which uses the dotnet SDK for TFM resolution.

Root cause: self-hosted ADO agents preserve workspace between runs. Stale project.assets.json files from prior runs (which may have been restored via build.proj with different global properties) cause NETSDK1005 when the build tries to use them. Changes: - Add workspace.clean=all at the job level for full workspace purge - Explicitly delete obj/ dirs for all P2P dependencies before build - Separate restore step with 'dotnet restore' (proper TFM negotiation) - Build with --no-restore to prevent implicit restore from skipping the fresh restore output

The .NET 10 SDK on self-hosted ADO agents fails to negotiate TFMs for ProjectReferences from net8.0/net9.0 projects to netstandard2.0 projects. Instead of negotiating net8.0 -> netstandard2.0, MSBuild passes TargetFramework=net8.0 directly, causing NETSDK1005 because the assets file only has targets for netstandard2.0. The workaround creates a temporary Directory.Build.targets that sets SetTargetFramework metadata on Extensions P2P references. When SetTargetFramework is set, MSBuild skips the GetTargetFrameworks negotiation protocol and uses the specified TFM directly. The file is removed before the test step to avoid affecting test builds.

…t:BuildNetCore The .NET 10 SDK fails to negotiate TFMs for P2P references to netstandard2.0 projects (Abstractions, Logging) when building the .csproj directly, causing NETSDK1005. Using build.proj -t:BuildNetCore routes through the standard build targets which handle dependencies correctly, matching the approach used in the Windows-netfx stage.

- Added missing Kerberos password variable.

- Restricting the build steps to use OS-specific targets.

…y used as the MSBuild TargetFramework.

- Extracted the comon build/test steps to avoid duplication.

- Reduced job timeout to 90 minutes from 360 (6 hours!).

Copilot

Pull request overview

Redesigns the Kerberos authentication test pipeline under eng/pipelines/kerberos/ to use shared templates and DotNetCoreCLI@2, while expanding schedule/branch coverage and improving resiliency.

Changes:

Replaces per-OS inline build/test logic with a shared build-and-test-steps.yml template (build + unit/functional/manual + publish artifacts).
Updates the main Kerberos pipeline to a daily schedule across main, release/6.1, and release/7.0, and renames matrix targetFramework → testFramework to avoid MSBuild property collisions.
Refreshes Linux Kerberos domain join/cleanup templates and adds task retry logic to build/test steps.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
eng/pipelines/kerberos/sqlclient-kerberos.yml	New end-to-end Kerberos pipeline definition (Windows + Linux matrices + code coverage merge).
eng/pipelines/kerberos/build-and-test-steps.yml	New shared build/test/publish steps template using `DotNetCoreCLI@2` and retry settings.
eng/pipelines/kerberos/linux-init-step.yml	New Linux Kerberos domain join + `kinit` template used by Linux stage.
eng/pipelines/kerberos/linux-cleanup-step.yml	New Linux cleanup template for leaving domain and destroying credentials.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

paulmedynski · 2026-05-01T13:09:40Z

+          clean: all    # Purge obj/artifacts from prior runs on self-hosted agents
+        strategy:
+          matrix:
+            # Azure Pipelines exposes matrix variables as environment variables for each step.


This was fun to diagnose. The surprising interactions between pipeline variables, environment variables, and MSBuild was causing the transitive SqlServer build to use net9.0, which it doesn't target. Ooof!

paulmedynski · 2026-05-01T13:10:17Z

+  # Run tests in separate steps to permit focused retries.
+  # ---------------------------------------------------------------------------
+
+  # Run the Unit Test suite.


I confirmed that the old Classic Kerberos pipeline was running all available tests as well - no extra filters, no test sets. The new build.proj Test* targets achieve the same thing.

I suspect we could narrow this down substantially, but that is an optimization for another day.

paulmedynski · 2026-05-01T13:11:31Z

+
+  # Give our coverage files a unique name to make it clear where they originated when we download
+  # the artifacts from all jobs in the merge stage.
+  - pwsh: |


I confirmed that the test results and code coverage are published to the pipeline run, and show up in the Test and Code Coverage tabs.

paulmedynski · 2026-05-01T13:12:55Z

The Linux Kerberos init/cleanup was brought over directly from the Classic pipeline tasks.

paulmedynski · 2026-05-01T13:14:01Z

+    branches:
+      include:
+        - main
+        - release/6.1


We will have to backport this new pipeline to 7.0 and 6.1, with appropriate tweaks for the build/test targets on those branches.

paulmedynski · 2026-05-01T13:15:27Z

+        pool:
+          name: ADO-Trusted-Domain-Win-WestUS2
+          demands:
+            - ImageOverride -equals ADO-MMS22-SQL19


We can probably use a slimmer image here - we don't use a local SQL Server at all. Same for Linux. A future optimization.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

codecov · 2026-05-01T14:50:18Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.52%. Comparing base (061c45b) to head (159d457).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4252      +/-   ##
==========================================
- Coverage   66.05%   64.52%   -1.54%     
==========================================
  Files         277      272       -5     
  Lines       42988    65783   +22795     
==========================================
+ Hits        28396    42445   +14049     
- Misses      14592    23338    +8746

Flag	Coverage Δ
CI-SqlClient	`?`
PR-SqlClient-Project	`64.52% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

priyankatiwari08 and others added 19 commits April 30, 2026 11:03

Convert Kerberos pipeline from Classic to YAML (11 jobs)

fd6a759

Updated to use the new build.proj targets and the .NET SDK exclusively.

fa16c85

- Combined Windows stages together.

9da3ba3

- Added missing Kerberos password variable.

- Moved environmental variables into the YAML from the Pipeline UI.

89e7cf3

- Restricting the build steps to use OS-specific targets.

Fixed problem of YAML targetFramework matrix variable being implicitl…

93dd96f

…y used as the MSBuild TargetFramework.

- Moved the pipeline files into a kerberos/ directory.

bca920a

- Extracted the comon build/test steps to avoid duplication.

- Fixed test results and coverage file processing.

f5fdd5f

- Reduced job timeout to 90 minutes from 360 (6 hours!).

Copilot AI review requested due to automatic review settings April 30, 2026 18:11

github-project-automation Bot added this to SqlClient Board Apr 30, 2026

github-project-automation Bot moved this to To triage in SqlClient Board Apr 30, 2026

paulmedynski added the Hotfix Candidate 🚑 Issues/PRs that are candidate for backporting to earlier supported versions. label Apr 30, 2026

Copilot started reviewing on behalf of paulmedynski April 30, 2026 18:11 View session

paulmedynski moved this from To triage to In progress in SqlClient Board Apr 30, 2026

paulmedynski added this to the 7.1.0-preview2 milestone Apr 30, 2026

Copilot AI reviewed Apr 30, 2026

View reviewed changes

paulmedynski added 2 commits April 30, 2026 16:18

Fix Kerberos pipeline review feedback

86457d7

- Excluding kerberos pipeline files from PR checks.

abc52e3

Copilot AI review requested due to automatic review settings April 30, 2026 19:21

Copilot started reviewing on behalf of paulmedynski April 30, 2026 19:22 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

paulmedynski added 2 commits May 1, 2026 08:28

Address additional Copilot pipeline review feedback

52773cd

Use YAML exists condition for coverage rename step

6424e37

Copilot AI review requested due to automatic review settings May 1, 2026 11:37

Copilot started reviewing on behalf of paulmedynski May 1, 2026 11:37 View session

Use runtime variable for test_results directory checks

00556fa

Copilot AI reviewed May 1, 2026

View reviewed changes

Comment thread eng/pipelines/kerberos/linux-init-step.yml Outdated

Comment thread eng/pipelines/kerberos/build-and-test-steps.yml

Address latest Copilot pipeline suggestions

159d457

paulmedynski commented May 1, 2026

View reviewed changes

paulmedynski marked this pull request as ready for review May 1, 2026 13:17

paulmedynski requested a review from a team as a code owner May 1, 2026 13:17

Copilot AI review requested due to automatic review settings May 1, 2026 13:17

paulmedynski moved this from In progress to In review in SqlClient Board May 1, 2026

Copilot started reviewing on behalf of paulmedynski May 1, 2026 13:18 View session

paulmedynski changed the title ~~Redesign Kerberos test pipeline with shared templates~~ Create YAML Kerberos Test Pipeline May 1, 2026

paulmedynski mentioned this pull request May 1, 2026

Fix SPN using instance name instead of resolved port for Protocol.None and Protocol.Admin #4180

Draft

Copilot AI reviewed May 1, 2026

View reviewed changes

Comment thread eng/pipelines/kerberos/sqlclient-kerberos.yml

Comment thread eng/pipelines/kerberos/build-and-test-steps.yml

paulmedynski added the Area\Engineering Use this for issues that are targeted for changes in the 'eng' folder or build systems. label May 1, 2026

Conversation

paulmedynski commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Job Breakdown (10 total)

Files Modified

Validation

Related

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

paulmedynski May 1, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski May 1, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski May 1, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski May 1, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski May 1, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

paulmedynski commented Apr 30, 2026 •

edited

Loading

codecov Bot commented May 1, 2026 •

edited

Loading