Publish MXC crates through ESRP

.azure-pipelines/1ES.Build.Official.yml

@@ -28,6 +28,10 @@ parameters:
     displayName: Enable debug output for SDK tests
     type: boolean
     default: false
+  - name: packageCrates
+    displayName: Package crates.io release artifacts (blocked by Cargo #17196)
+    type: boolean
+    default: false
 
 variables:
   # Variable group managed in Dart — see the pipeline's variable group list.
@@ -50,6 +54,7 @@ extends:
     - template: templates/1ES.Build.Stages.yml@self
       parameters:
         isOfficialBuild: true
+        packageCrates: ${{ parameters.packageCrates }}
         debug: ${{ parameters.debug }}
         ESRPInfo:
           serviceName: $(serviceName)

.azure-pipelines/1ES.Release.yml

@@ -1,5 +1,21 @@
 # Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License.
+#
+# Single entry point for MXC package releases: one run can publish the npm SDK,
+# the Rust crate closure to crates.io, or both, via the `publishNpm` /
+# `publishCrates` parameters. Both publish through ESRP Release (no registry
+# tokens in this repo), consuming artifacts from `MXC-Official-Build`:
+#   * npm SDK   -> `mxc-npm-sdk-package`  (Package.NpmSdk.Job.yml)
+#   * crates.io -> `mxc-crates-package`   (Package.Crates.Job.yml)
+# Leaf-first crate ordering/verification lives in templates/Publish.CratesIo.Job.yml.
+#
+# One-time enablement (out of band): OSPO OSS-release registration, crate-name
+# reservation under `microsoft-oss-releases`, and ESRP `Rust` content-type
+# onboarding for the ESRP client id (see the ESRP crates.io docs). The release
+# pool's network-isolation policy must also allow read-only HTTPS access to
+# `index.crates.io`; build-time dependency consumption remains on the private
+# Mxc-Azure-Feed. No CARGO_REGISTRY_TOKEN or variable group is needed -- ESRP
+# owns the credentials.
 
 trigger: none
 name: $(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
@@ -10,14 +26,51 @@ resources:
     name: 1ESPipelineTemplates/1ESPipelineTemplates
     ref: refs/tags/release
   pipelines:
-  # Reference pipeline that created the signed npm artifacts so we can consume them later
+  # Reference pipeline that created the signed release artifacts so we can consume them later
   - pipeline: MXC 
     source: 'MXC-Official-Build'
     trigger: none
 
 
 # Parameters for ESRP release info will be passed from the ADO UI.
 parameters:
+  - name: publishNpm
+    displayName: "Publish the npm SDK to npmjs.com"
+    type: boolean
+    default: false
+  - name: publishCrates
+    displayName: "Publish the Rust crate closure to crates.io"
+    type: boolean
+    default: false
+  - name: cratesDryRun
+    displayName: "Crates dry run: stage + verify only, skip the ESRP publish"
+    type: boolean
+    default: false
+  # Leaf-first crate order for crates.io. MUST match the CRATES list in
+  # .azure-pipelines/scripts/crates_release.py; verified at run time by
+  # `verify-order`, which fails the release if the two disagree.
+  #
+  - name: crateOrder
+    type: object
+    default:
+      - nanvix_common
+      - mxc_telemetry
+      - wxc_common
+      - nanvix_runner
+      - hyperlight_common
+      - mxc_pty
+      - lxc_common
+      - bwrap_common
+      - seatbelt_common
+      - sandbox_spec
+      - appcontainer_common
+      - isolation_session_bindings
+      - isolation_session_common
+      - windows_sandbox_common
+      - windows_sandbox_lifecycle
+      - wslc_common
+      - mxc_engine
+      - mxc-sdk
   - name: ESRPInfo
     type: object
     default:
@@ -47,42 +100,54 @@ extends:
         os: windows
 
     stages:
-    - stage: Publish_to_NPM
-      displayName: 'Publish NPM Package'
-      variables:
-      - name: release_environment
-        value: Production
-      jobs:
-      - job: ReleaseJob
-        templateContext:
-          type: releaseJob
-          isProduction: true
-          inputs:
-          - input: pipelineArtifact
-            pipeline: MXC
-            targetPath: '$(Pipeline.Workspace)/packages'
-            artifactName: mxc-npm-sdk-package
+    - ${{ if parameters.publishNpm }}:
+      - stage: Publish_to_NPM
+        displayName: 'Publish NPM Package'
+        variables:
+        - name: release_environment
+          value: Production
+        jobs:
+        - job: ReleaseJob
+          templateContext:
+            type: releaseJob
+            isProduction: true
+            inputs:
+            - input: pipelineArtifact
+              pipeline: MXC
+              targetPath: '$(Pipeline.Workspace)/packages'
+              artifactName: mxc-npm-sdk-package
+
+          displayName: Publish to NPM
+          steps:
+          - task: EsrpRelease@10
+            displayName: 'Publish to NPM'
+            inputs:
+              connectedservicename: ${{ parameters.ESRPInfo.serviceName }}
+              usemanagedidentity: false
+              keyvaultname: ${{ parameters.ESRPInfo.azureKeyVaultName }}
+              authcertname: ${{ parameters.ESRPInfo.authCertName }}
+              signcertname: ${{ parameters.ESRPInfo.signCertName }}
+              clientid: ${{ parameters.ESRPInfo.clientId }}
+              intent: 'PackageDistribution'
+              contenttype: npm
+              contentsource: 'Folder'
+              folderlocation: '$(Pipeline.Workspace)/packages'
+              owners: ${{ parameters.ESRPInfo.OwnersEmail }}
+              approvers: ${{ parameters.ESRPInfo.ApproversEmail }}
+              waitforreleasecompletion: true
+              serviceendpointurl: 'https://api.esrp.microsoft.com'
+              mainpublisher: ESRPRELPACMAN
+              domaintenantid: ${{ parameters.ESRPInfo.tenantId }} 
 
-        displayName: Publish to NPM
-        steps:
-        - task: EsrpRelease@10
-          displayName: 'Publish to NPM'
-          inputs:
-            connectedservicename: ${{ parameters.ESRPInfo.serviceName }}
-            usemanagedidentity: false
-            keyvaultname: ${{ parameters.ESRPInfo.azureKeyVaultName }}
-            authcertname: ${{ parameters.ESRPInfo.authCertName }}
-            signcertname: ${{ parameters.ESRPInfo.signCertName }}
-            clientid: ${{ parameters.ESRPInfo.clientId }}
-            intent: 'PackageDistribution'
-            contenttype: npm
-            contentsource: 'Folder'
-            folderlocation: '$(Pipeline.Workspace)/packages'
-            owners: ${{ parameters.ESRPInfo.OwnersEmail }}
-            approvers: ${{ parameters.ESRPInfo.ApproversEmail }}
-            waitforreleasecompletion: true
-            serviceendpointurl: 'https://api.esrp.microsoft.com'
-            mainpublisher: ESRPRELPACMAN
-            domaintenantid: ${{ parameters.ESRPInfo.tenantId }} 
+    - ${{ if parameters.publishCrates }}:
+      - stage: Publish_to_CratesIo
+        displayName: 'Publish Crates.io Packages'
+        dependsOn: []
+        jobs:
+        - template: templates/Publish.CratesIo.Job.yml@self
+          parameters:
+            ESRPInfo: ${{ parameters.ESRPInfo }}
+            crateOrder: ${{ parameters.crateOrder }}
+            cratesDryRun: ${{ parameters.cratesDryRun }}