[paulmedynski]

Description

Validate Abstractions' localized authentication resources in the build pipeline. Authenticate NuGet feeds before building PackageValidator so its restore can use the build identity's Azure Artifacts credentials. No public API or runtime behavior changes.

Why?

Authentication resources need the same localization checks as driver resources, with independent exception lists so an allowance for one assembly cannot hide a problem in another.

How

• Parameterize the shared validation step with an explicit resource directory and allowlist section.
• Add an independent AbstractionsAllowedEnglishValueMatches section and run the Abstractions gate before analysis and compilation.
• Preserve the driver's default allowlist section for direct script callers and retain existing validation gating and strict defaults.
• Cover independent section selection, missing-section rejection, and isolation of allowlisted exceptions.
• Document resource ownership and per-assembly allowlists.
• Run NuGetAuthenticate@1 immediately before BuildPackageValidator in the shared package-validation step.

Issues

Part of #4193.

Testing

• sqlclient-non-official-github 26302.1
  • We can see the new validation flagging the new, un-localized strings here.

[Copilot]

🟡 Changes recommended

The new validation gate rejects eight missing neutral-resource keys in all 13 Abstractions satellite files, blocking official and default non-official builds before compilation.

1 open issue

• Validator rejects missing Abstractions satellite resource keys · New

What changed in this PR

Extends OneBranch localization validation to Abstractions-owned authentication resources, following their move from the driver in #4852. This supports the broader authentication AOT work without changing runtime behavior.

Changes:

• Parameterizes resource directories and allowlist sections while preserving the driver’s script default.
• Adds the Abstractions pre-build gate with an independent allowlist and existing validation controls.
• Adds section-isolation tests and documents per-assembly validation.

File	Description
eng/​pipelines/​onebranch/​steps/​validate-localization-step.yml	Accepts explicit resource-directory and allowlist-section parameters.
eng/​pipelines/​onebranch/​scripts/​validate-localization.ps1	Selects the requested allowlist section, defaulting to the driver’s.
eng/​pipelines/​onebranch/​scripts/​tests/​validate-localization.Tests.ps1	Tests section selection, missing sections, and exception isolation.
eng/​pipelines/​onebranch/​jobs/​build-buildproj-job.yml	Adds Abstractions validation and explicit driver settings.
BUILDGUIDE.md	Documents localization gates and validation behavior.
.github/​instructions/​onebranch-pipeline-design.instructions.md	Updates guidance for both resource-owning assemblies.
.config/​LocalizationValidationAllowlist.json	Adds an independent, empty Abstractions allowlist.

_{Review effort: Balanced}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.39%. Comparing base (ce6aef6) to head (b306348).

Additional details and impacted files

@@                                Coverage Diff                                 @@
##           dev/automation/aot-authentication-localization    #4942      +/-   ##
==================================================================================
- Coverage                                           67.23%   66.39%   -0.84%     
==================================================================================
  Files                                                 317      304      -13     
  Lines                                               70236    67961    -2275     
==================================================================================
- Hits                                                47222    45126    -2096     
+ Misses                                              23014    22835     -179     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	66.39% <ø> (+0.16%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🔵 Needs a closer look

The Azure Artifacts authentication change still needs a successful OneBranch restore using the job identity, and the localization gate blocks official builds until translations arrive.

No open issues 🎉

1 resolved since last review

• Validator rejects missing Abstractions satellite resource keys

_{Review effort: Balanced}

[cheenamalhotra]

Looks good overall!

Note: I would not call this AOT or use this term in this PR to avoid confusions btw, since its unrelated to AOT support. Therefore, this is not a blocker for 8.0.0-preview1 release.

Two additional optional review suggestions:

• Allowlist naming: AllowedEnglishValueMatches and AbstractionsAllowedEnglishValueMatches are asymmetric and may scale poorly as more assemblies are added. A nested shape such as { "SqlClient": {...}, "Abstractions": {...} } could be cleaner.
• Test coverage: The first test verifies that the Abstractions section does not borrow the driver allowlist, but not the reverse. Consider asserting that the same resources fail when run with the driver section containing UnrelatedDriverKey.