ci: verify MCR images in compile jobs

Run the shared Notation verification steps on both architecture compile agents, preserving verification before compilation while removing the dedicated Azure Pipelines agent and stage transition.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0abe4d46-be3e-478e-bb36-a58a255110a0

Author: jmclong

.pipelines/templates/Dacs.Pipeline.Stages.yml

@@ -31,48 +31,9 @@ parameters:
     default: false
 
 stages:
-  - stage: VerifyBaseImages
-    displayName: Verify MCR base image signatures
-    dependsOn: []
-    jobs:
-      - job: VerifyBaseImages
-        displayName: Verify MCR base image signatures
-        timeoutInMinutes: 10
-        steps:
-          - checkout: self
-            path: s/dacs
-            fetchDepth: 1
-            persistCredentials: false
-          - task: Notation@0
-            displayName: Install Notation
-            inputs:
-              command: install
-              version: 1.3.2
-          - bash: |
-              set -euo pipefail
-
-              readonly trust_store="$(Agent.TempDirectory)/notation-truststore"
-              references="$(./.github/scripts/list-pinned-mcr-images.sh | paste -sd, -)"
-              if [[ -z "$references" ]]; then
-                echo "No pinned MCR base images were found." >&2
-                exit 1
-              fi
-
-              ./.github/scripts/setup-notation-trust-store.sh "$trust_store"
-              echo "##vso[task.setvariable variable=mcrBaseImages]$references"
-            displayName: Prepare Microsoft trust policy
-            workingDirectory: $(Pipeline.Workspace)/s/dacs
-          - task: Notation@0
-            displayName: Verify Microsoft supply-chain signatures
-            inputs:
-              command: verify
-              artifactRefs: $(mcrBaseImages)
-              trustPolicy: $(Pipeline.Workspace)/s/dacs/.github/notation/trustpolicy.json
-              trustStore: $(Agent.TempDirectory)/notation-truststore
-
   - stage: Build_amd64
     displayName: Compile linux/amd64
-    dependsOn: VerifyBaseImages
+    dependsOn: []
     jobs:
       - job: Build_amd64
         displayName: Compile linux/amd64
@@ -94,6 +55,7 @@ stages:
             fetchDepth: 0
             fetchTags: true
             persistCredentials: true
+          - template: /.pipelines/templates/Dacs.VerifyBaseImages.Steps.yml@self
           - template: /.pipelines/templates/Dacs.Build.Steps.yml@self
             parameters:
               architecture: amd64
@@ -103,7 +65,7 @@ stages:
 
   - stage: Build_arm64
     displayName: Compile linux/arm64
-    dependsOn: VerifyBaseImages
+    dependsOn: []
     pool:
       name: 1es-dacs-pool-arm64
       image: 1es-pt-linux-arm64
@@ -130,6 +92,7 @@ stages:
             fetchDepth: 0
             fetchTags: true
             persistCredentials: true
+          - template: /.pipelines/templates/Dacs.VerifyBaseImages.Steps.yml@self
           - template: /.pipelines/templates/Dacs.Build.Steps.yml@self
             parameters:
               architecture: arm64

.pipelines/templates/Dacs.VerifyBaseImages.Steps.yml

@@ -0,0 +1,43 @@
+# Copyright (c) Microsoft Corporation.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+steps:
+  - task: Notation@0
+    displayName: Install Notation
+    inputs:
+      command: install
+      version: 1.3.2
+
+  - bash: |
+      set -euo pipefail
+
+      readonly trust_store="$(Agent.TempDirectory)/notation-truststore"
+      references="$(./.github/scripts/list-pinned-mcr-images.sh | paste -sd, -)"
+      if [[ -z "$references" ]]; then
+        echo "No pinned MCR base images were found." >&2
+        exit 1
+      fi
+
+      ./.github/scripts/setup-notation-trust-store.sh "$trust_store"
+      echo "##vso[task.setvariable variable=mcrBaseImages]$references"
+    displayName: Prepare Microsoft trust policy
+    workingDirectory: $(Pipeline.Workspace)/s/dacs
+
+  - task: Notation@0
+    displayName: Verify Microsoft supply-chain signatures
+    inputs:
+      command: verify
+      artifactRefs: $(mcrBaseImages)
+      trustPolicy: $(Pipeline.Workspace)/s/dacs/.github/notation/trustpolicy.json
+      trustStore: $(Agent.TempDirectory)/notation-truststore

docs/azure-pipeline-build-and-caching.md

@@ -33,6 +33,7 @@ validation leaves it disabled.
                     |                                   |
              Build_amd64                         Build_arm64
                     |                                   |
+        Verify MCR base images              Verify MCR base images
         Build/load native-build image        Build/load native-build image
         Compile C++ and Go                    Compile C++ and Go
         Build Python wheel                    Build Python wheel
@@ -193,13 +194,17 @@ digest guarantees that a build uses the reviewed image contents even if the
 upstream tag is moved. Dependabot proposes reviewed updates when a newer digest
 is available for the configured tag.
 
-Before either architecture build starts, the `VerifyBaseImages` stage discovers
-every MCR base image referenced by a Dockerfile and validates its ESRP signature
-with the built-in Azure Pipelines `Notation@0` task. The stage downloads the
-public Microsoft supply-chain and timestamp roots over HTTPS, verifies their
-pinned SHA-256 fingerprints, and applies the same strict trust policy used by
-GitHub Actions. An unpinned image, invalid signature, untrusted signer, or
-repository missing from the trust policy fails the pipeline.
+At the start of each architecture build, the shared
+`Dacs.VerifyBaseImages.Steps.yml` template discovers every MCR base image
+referenced by a Dockerfile and validates its ESRP signature with the built-in
+Azure Pipelines `Notation@0` task. Running verification on the already
+allocated compile agents removes the dedicated verification agent and stage
+transition while preserving verification before compilation on both
+architectures. The template downloads the public Microsoft supply-chain and
+timestamp roots over HTTPS, verifies their pinned SHA-256 fingerprints, and
+applies the same strict trust policy used by GitHub Actions. An unpinned image,
+invalid signature, untrusted signer, or repository missing from the trust
+policy fails the corresponding architecture build.
 
 The Go scheduler and controller images compile Go in their own Dockerfiles.