Make pipeline artifacts retry-safe

Build/README.md

@@ -0,0 +1,60 @@
+# Pipeline artifact identities
+
+Product artifacts use `<logical-name>_attempt$(System.JobAttempt)` as their
+published Azure Pipelines names. The suffix belongs to the **producing job**;
+retrying a consumer does not change which producer output it needs.
+
+| Logical name | Producer | In-tree reader |
+| --- | --- | --- |
+| `cpptools.vsix` | `cg/cg.yml` | None (diagnostic output) |
+| `vsix` | `package/jobs_package_vsix.yml` | `publish/jobs_publish_vsix.yml` |
+| `vsce` | `package/jobs_package_vsix.yml` | `publish/jobs_publish_vsix.yml` |
+| `unsigned_lldb-mi_<arch>` | `lldb-mi/lldb-mi.template.yml` | `lldb-mi/lldb-mi-sign.template.yml` |
+| `lldb-mi_<arch>_zip` | `lldb-mi/lldb-mi-sign.template.yml` | None |
+
+Architecture suffixes are part of the logical name. Append the attempt suffix
+once, after the complete logical name. Only the remote artifact name changes;
+VSIX/ZIP filenames, local directories, signing inputs, and package contents do
+not include the attempt suffix.
+
+## Resolve before downloading
+
+[`templates/resolve_artifact.yml`](templates/resolve_artifact.yml) is a step
+template with inline PowerShell, so it also works in jobs with `checkout: none`.
+It reads Azure Pipelines artifact and timeline metadata using the job access
+token; it does not download artifact contents.
+
+- Supply `artifactName`, an `artifactNames` list, or `artifactNamesJson` for a
+  list computed at runtime, using logical names without attempt suffixes.
+- Supply an exact `buildId` and `project`, or a `definition` with an exact
+  `branch` and optional `tags`. The defaults select the current build/project.
+  A pipeline resource reader should pass that resource's `runID` and `projectID`.
+- `allowPartiallySucceededBuilds` and `allowFailedBuilds` opt into those results
+  when selecting the latest build. `allowFailedBuilds` also permits artifacts
+  from failed producing jobs. `allowMissing` omits unavailable artifacts instead
+  of failing; it never permits fallback to an earlier attempt.
+- The default variables are `$(ResolvedArtifactName)`,
+  `$(ResolvedArtifactBuildId)`, and `$(ResolvedArtifactPatterns)`. Use
+  `variablePrefix` to give another prefix. `Name` is populated for a single
+  selected artifact; `Patterns` contains one `<resolved-name>/**` line per
+  artifact. Keep downloads pinned to the resolved build ID.
+- Set `stepName` to expose `Name`, `BuildId`, and `Patterns` as job outputs.
+  Release jobs resolve metadata in a preceding normal job, then map the output
+  through `dependencies` to a variable in their existing typed artifact input.
+  This preserves the release template's artifact and SBOM validation.
+
+The resolver matches an artifact's `source` to the current producing timeline
+job ID. `previousAttempts` connects older outputs to that job, so a retry that
+publishes nothing cannot silently reuse a stale output. Historical fixed-name
+artifacts are accepted only when they belong to the current producing job.
+
+Names owned by external services or toolchains require their owning contract to
+be verified before renaming; an absence of in-tree readers does not establish
+that an artifact has no external consumers.
+
+The localization pipeline's `drop` is deliberately retained pending confirmation
+of its external service contract. Its local translation inputs and output
+directories do not establish whether external handoff readers accept a renamed
+pipeline artifact.
+
+See [`tests`](tests/README.md) for offline resolver and artifact-contract checks.

Build/cg/cg.yml

@@ -76,7 +76,7 @@ extends:
             displayName: 'cpptools.vsix'
             condition: succeeded()
             targetPath: $(Build.ArtifactStagingDirectory)\Extension
-            artifactName: cpptools.vsix
+            artifactName: cpptools.vsix_attempt$(System.JobAttempt)
 
         steps:
         - checkout: self

Build/lldb-mi/lldb-mi-sign.template.yml

@@ -10,11 +10,15 @@ jobs:
   - checkout: none
 
   - ${{ each arch in parameters.archs }}:
+    - template: ../templates/resolve_artifact.yml
+      parameters:
+        artifactName: 'unsigned_lldb-mi_${{ arch }}'
+
     - task: DownloadPipelineArtifact@1
       displayName: 'Downloading unsigned_lldb-mi_${{ arch }}'
       inputs:
         targetPath: '$(Pipeline.Workspace)/Artifacts' 
-        artifactName: 'unsigned_lldb-mi_${{ arch }}'
+        artifactName: $(ResolvedArtifactName)
 
     - task: MicroBuildSignMacFiles@1
       displayName: 'ESRP Sign'
@@ -26,5 +30,5 @@ jobs:
       displayName: 'Publish signed LLDB-MI'
       inputs:
         targetPath: '$(Pipeline.Workspace)\Artifacts\lldb-mi_${{ arch }}.zip'
-        artifactName: 'lldb-mi_${{ arch }}_zip'
+        artifactName: 'lldb-mi_${{ arch }}_zip_attempt$(System.JobAttempt)'
 ...

Build/lldb-mi/lldb-mi.template.yml

@@ -151,7 +151,7 @@ jobs:
     displayName: 'Publish LLDB-MI'
     inputs:
       targetPath: '$(Build.StagingDirectory)/lldb-mi_${{ parameters.llvm_arch }}.zip'
-      artifactName: 'unsigned_lldb-mi_${{ parameters.llvm_arch }}'
+      artifactName: 'unsigned_lldb-mi_${{ parameters.llvm_arch }}_attempt$(System.JobAttempt)'
 
   - task: CmdLine@2
     displayName: 'Clean up'

Build/package/jobs_package_vsix.yml

@@ -28,11 +28,11 @@ jobs:
     - output: pipelineArtifact
       displayName: '${{ parameters.vsixName }}.vsix'
       targetPath: $(Build.ArtifactStagingDirectory)\vsix
-      artifactName: vsix
+      artifactName: vsix_attempt$(System.JobAttempt)
     - output: pipelineArtifact
       displayName: Locked VSCE dependencies
       targetPath: $(Build.ArtifactStagingDirectory)\vsce
-      artifactName: vsce
+      artifactName: vsce_attempt$(System.JobAttempt)
 
   steps:
   - checkout: self

Build/publish/jobs_publish_vsix.yml

@@ -4,19 +4,41 @@ parameters:
   default: ''
 
 jobs:
+- job: resolve_vsix_artifact
+  displayName: Resolve VSIX and VSCE artifacts
+  steps:
+  - checkout: none
+  - template: ../templates/resolve_artifact.yml
+    parameters:
+      artifactName: vsix
+      buildId: $(resources.pipeline.vsixBuild.runID)
+      project: $(resources.pipeline.vsixBuild.projectID)
+      stepName: resolve
+  - template: ../templates/resolve_artifact.yml
+    parameters:
+      artifactName: vsce
+      buildId: $(resources.pipeline.vsixBuild.runID)
+      project: $(resources.pipeline.vsixBuild.projectID)
+      variablePrefix: ResolvedVsceArtifact
+      stepName: resolveVsce
+
 - job: Publish
   displayName: Publish to Marketplace
+  dependsOn: resolve_vsix_artifact
+  variables:
+    ResolvedVsixArtifactName: $[ dependencies.resolve_vsix_artifact.outputs['resolve.Name'] ]
+    ResolvedVsceArtifactName: $[ dependencies.resolve_vsix_artifact.outputs['resolveVsce.Name'] ]
   templateContext:
     type: releaseJob
     isProduction: true
     inputs:
     - input: pipelineArtifact
       pipeline: vsixBuild
-      artifactName: vsix
+      artifactName: $(ResolvedVsixArtifactName)
       targetPath: $(Build.StagingDirectory)\vsix
     - input: pipelineArtifact
       pipeline: vsixBuild
-      artifactName: vsce
+      artifactName: $(ResolvedVsceArtifactName)
       targetPath: $(Build.StagingDirectory)\vsce
 
   steps: