[mdaigle]

Description

Route PowerShell module installs through the existing public SqlClient Azure Artifacts feed and its PowerShell Gallery upstream, using anonymous access and a reusable installation step.

• Add PowerShell.config beside NuGet.config as the single PowerShell feed-address configuration. It contains the explicit NuGet v2 sourceLocation; the registration helper reads it directly. NuGet.config remains unchanged.
• Register-SqlClientPSRepository.ps1 registers the configured source anonymously, preserves matching registrations/trust policy, rejects source/provider conflicts and invalid configuration, and never falls back to PSGallery.
• Installation lives directly in install-powershell-module-step.yml, not a separate installer script. The step calls the registration helper and immediately uses its returned name for Install-Module. It preserves exact version selection, optional installed-module reuse, current-user scope, and explicit clobbering options. Literal module inputs are escaped centrally and runtime macro inputs are rejected.
• Install modules during job initialization alongside .NET tool restore, before building or configuring SQL/accounts. Windows net-only jobs install pinned SqlServer 22.4.5.1 with installed-version reuse and AllowClobber, preserving the existing local/default-instance/set-3 gates. Linux local-server manual jobs including set 1 install OpenSSL; Linux Kerberos jobs install unpinned SqlServer.
• Net-only account setup/cleanup only import their prerequisite. The certificate script has no local installation fallback. Local developers register the configured repository and run Install-Module before invoking these scripts; commands are documented in BUILDGUIDE and the related test/account guides.
• Keep repository names out of job environment variables, test configuration, and certificate subprocess arguments. The test-config and certificate-caller C# files have no changes relative to main.
• When Kerberos aligns source with an older package-producing commit, restore the queued pipeline definitions, registration helper, and PowerShell.config so the compiled installation step can find its runtime dependencies. Driver source remains aligned with the packages.
• Developer/Pester instructions use the governed source and saved Pester 6.2.0. OneBranch test commands import Pester once in one persistent PowerShell session.

No public API, package-version, feed-service configuration, or NuGet.config content changes. Private-feed authentication remains deferred to the separate retirement migration. Registration, installation, and consumption run as the same user. Previously conditional installations still reuse existing modules; previously unpinned installations remain unpinned.

Issues

Requested maintainer follow-up after adding PowerShell Gallery as an upstream, including a separate root PowerShell configuration and a reusable step owning registration and installation. Independent of merged SecureString fix #4923; no issue closure.

Testing

Latest validation at 78586d5c8:

Import-Module Pester -RequiredVersion 6.2.0
Invoke-Pester -Path .\eng\pipelines\scripts\tests\Register-SqlClientPSRepository.Tests.ps1,.\eng\pipelines\scripts\tests\Install-PowerShellModuleStep.Tests.ps1,.\eng\pipelines\scripts\tests\Configure-NetOnlyAccount.Tests.ps1,.\eng\pipelines\scripts\tests\Pipeline-Arguments.Tests.ps1,.\eng\pipelines\scripts\tests\Pipeline-Platforms.Tests.ps1 -CI -Output Normal
# Passed: 79 tests, 0 failures, 0 skipped.

git diff --check
# Passed.

Coverage includes configuration validation, registration reuse/conflicts, actual inline installation code with mocked module commands, pinned/unpinned availability checks, install options and failure propagation, job-initialization ordering and gates, no installation inside consumer scripts, and account lifecycle/credential disposal/cleanup. A temporary Git repository reproduces checkout of an older commit lacking the registration helper/config and verifies that restoration brings them back without replacing driver source. An initial run exposed a quoting error in the test helper's Azure-expression expansion; correcting that helper produced the passing run above.

Actual full Azure pipeline preview, using existing pipeline 2197 (PR-SqlClient-Project) with this branch and 78586d5c8d86b1a95d4cc55adbbe9ff65879b412 as self, without a YAML override:

az rest --method post --resource 499b84ac-1321-427f-aa17-267ca6975798 --url 'https://dev.azure.com/SqlClientDrivers/904996cc-6198-4d39-8540-eca72bdf0b7b/_apis/pipelines/2197/preview?api-version=7.1-preview.1' --headers 'Content-Type=application/json' --body "@$requestPath" -o json
# Passed: 1,270,782 expanded characters; 1 OpenSSL and 10 SqlServer steps.
# Exactly 11 inline Install-Module calls; no references to the deleted installer script.
# Preview only: no pipeline run was started.

Earlier direct template previews also accepted pinned/unpinned inputs and rejected runtime $(Injected) module values. Regression tests exercise quote/semicolon/backtick/dollar/newline values as literal data before validation.

Actual anonymous feed verification, after introducing the separate config:

& .\eng\scripts\Register-SqlClientPSRepository.ps1 -RepositoryName $name
Find-Module SqlServer -RequiredVersion 22.4.5.1 -Repository $name -ErrorAction Stop
# Passed: registration from PowerShell.config and pinned discovery.
# The unique temporary registration was removed in finally.

During the migration, the same anonymous Find-Module SqlServer -RequiredVersion 22.4.5.1 -Repository $name -ErrorAction Stop comparison using PowerShellGet 2.2.5 registered both endpoints successfully, but lookup failed against nuget/v3/index.json and succeeded against nuget/v2. This is measured behavior for that toolchain, not universal incompatibility of every PowerShell client with NuGet v3. Temporary registrations were removed. Earlier Find-Module/Save-Module checks against v2 also passed for SqlServer 22.4.5.1, OpenSSL 1.0.0, and saved Pester 6.2.0; downloaded manifests were validated/imported and the earlier regression suite ran successfully with the freshly downloaded Pester. Temporary downloads were cleaned up.

Earlier dual-framework build:

dotnet build .\src\Microsoft.Data.SqlClient\tests\ManualTests\Microsoft.Data.SqlClient.ManualTests.csproj --no-restore -nologo -v:quiet
# Passed: net462 and net10.0; 0 warnings, 0 errors.
# Not repeated for the latest PowerShell/YAML/documentation-only changes.

Additional earlier compatibility check:

Import-Module Pester -RequiredVersion 6.2.0
Invoke-Pester -Path .\src\Microsoft.Data.SqlClient\tests\VersionChecks\VersionChecks.Tests.ps1 -CI -Output Normal
# 632 passed, 18 failed tests, plus one failed parent setup.
# The packaging fixture could not start csc.exe: MSB3883, "The parameter is incorrect".
# Its 18 consumer tests consequently could not run; assertions were not weakened.

That packaging-fixture run was not repeated. The previous HEAD's required CI checks passed after targeted retries of unchanged Azure EventSource/transaction-pooling tests; current-HEAD CI results are tracked by the checks panel. SQL/Kerberos integration runs, native Unix certificate generation, and official release pipelines were not run locally. Installer network failures are covered through mocks; actual governed-source discovery/download and Azure expansion are covered separately above. No modules were installed into the developer module directory, and no accounts, SQL logins, or certificates were provisioned locally.

• Tests added or updated
• Public API changes documented (not applicable; none)
• Verified against customer repro (not applicable; engineering source migration)
• Ensure no breaking changes introduced (driver/runtime behavior unchanged; standalone script prerequisites documented)

Guidelines

Please review the contribution guidelines before submitting a pull request:

• Contributing
• Code of Conduct
• Best Practices
• Coding Style
• Review Process

[Copilot]

🟡 Changes recommended

The sole documented Pester setup command fails against the new feed, blocking VersionChecks on clean machines, while the passing regression run used an existing installation and did not verify this bootstrap path.

1 open issue

• Fix failing Pester prerequisite installation from new feed · New

What changed in this PR

Routes PowerShell module installation through the public SqlClient Azure Artifacts feed, centralizing repository registration without a PSGallery fallback.

Changes:

• Adds a shared registration helper that preserves matching registrations and rejects conflicts.
• Migrates SqlServer and OpenSSL installation sites while preserving existing version pins and reuse behavior.
• Adds registration and deployment tests, and updates developer setup documentation.

File	Description
src/​Microsoft.Data.SqlClient/​tests/​ManualTests/​Microsoft.Data.SqlClient.ManualTests.csproj	Copies the registration helper into test output.
src/​Microsoft.Data.SqlClient/​tests/​ManualTests/​makepfxcert.ps1	Uses the governed feed and propagates module provisioning failures.
eng/​scripts/​Register-SqlClientPSRepository.ps1	Adds shared feed registration and conflict validation.
eng/​scripts/​Configure-NetOnlyAccount.ps1	Routes pinned SqlServer installation through the helper.
eng/​pipelines/​scripts/​tests/​Register-SqlClientPSRepository.Tests.ps1	Tests registration, failure propagation, wiring, and deployment layouts.
eng/​pipelines/​scripts/​tests/​README.md	Updates Pester setup and test inventory.
eng/​pipelines/​scripts/​tests/​Configure-NetOnlyAccount.Tests.ps1	Verifies governed sourcing and stops provisioning on lookup failure.
eng/​pipelines/​onebranch/​scripts/​tests/​README.md	Updates Pester installation to use the governed feed.
eng/​pipelines/​ci/​kerberos/​linux-setup-step.yml	Uses the helper for SqlServer installation.
doc/​connection-pooling-impersonation.md	Documents the new net-only provisioning module source.
BUILDGUIDE.md	Updates Pester setup and explains feed registration behavior.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The required feed reportedly returns HTTP 500 for Pester 5.7.1, while Azure pipeline and Unix certificate provisioning remain unvalidated and require maintainer confirmation and affected-agent execution.

1 open issue

• Fix failing Pester prerequisite installation from new feed

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Supplemental review guidance could not be verified under the review’s trust requirements because only worktree paths were available, without a trusted base SHA or protected copy.

No open issues 🎉

1 resolved since last review

• Fix failing Pester prerequisite installation from new feed

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Manually queued Linux Kerberos runs against pre-PR package builds fail because source alignment restores the new pipeline template but not its required helper under eng/scripts.

1 open issue

• Restore queued commit helper under eng/scripts for Kerberos runs · New

_{Review effort: Balanced}

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

5 open issues

• The Install-Module call is now fail-fast (-ErrorAction Stop), but Import-Module SqlServer is… · New
• This adds a new template parameter without a default, which forces every consumer of… · New
• This XPath match is case-sensitive on @key. If NuGet.config ever uses a different casing (e.g.,… · New
• The repository SourceLocation comparison is case-sensitive (-cne) and string-based, which can… · New
• This script now uses [System.Environment]::OSVersion.Platform -eq \"Unix\" for the OpenSSL… · New

1 resolved since last review

• Restore queued commit helper under eng/scripts for Kerberos runs

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

Managed Instance setup fails when an upstream package commit has an older config without PowerShellRepository, because assigning the missing property throws; the property must be added safely and the older-config case covered by a regression test.

1 open issue

• Add PowerShellRepository before assigning it · New

5 resolved since last review

• This script now uses [System.Environment]::OSVersion.Platform -eq \"Unix\" for the OpenSSL…
• The repository SourceLocation comparison is case-sensitive (-cne) and string-based, which can…
• This XPath match is case-sensitive on @key. If NuGet.config ever uses a different casing (e.g.,…
• This adds a new template parameter without a default, which forces every consumer of…
• The Install-Module call is now fail-fast (-ErrorAction Stop), but Import-Module SqlServer is…

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Windows Pester bootstrap and current installer template still require real-agent validation, as the reported Azure preview exercised a different template and publisher requirements remain unverified.

No open issues 🎉

1 resolved since last review

• Add PowerShellRepository before assigning it

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate a Windows-specific publisher-check compatibility risk in Pester installation that was omitted from the published review.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because an omitted publisher-check compatibility concern can block the documented Pester installation on Windows systems with inbox Pester.

No open issues 🎉

_{Review effort: Balanced}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.37%. Comparing base (c76d081) to head (78586d5).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4932      +/-   ##
==========================================
+ Coverage   67.68%   70.37%   +2.68%     
==========================================
  Files         311      305       -6     
  Lines       45249    69577   +24328     
==========================================
+ Hits        30629    48964   +18335     
- Misses      14620    20613    +5993     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	70.37% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

The shared installer is missing, and the removed Unix fallback leaves local invocations without the promised OpenSSL provisioning.

1 open issue

• Add shared SQL client installer and restore certificate fallback · New

_{Review effort: Balanced}