From 931ba71b45faf19bde41ac016067290ce32ef206 Mon Sep 17 00:00:00 2001
From: Microsoft Graph DevX Tooling <GraphTooling@service.microsoft.com>
Date: Fri, 21 Aug 2026 01:03:09 -0700
Subject: [PATCH 1/2] Add ACR network diagnostics

Log DNS resolution, TCP reachability, and the registry HTTP response before publishing PowerShell packages.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../publish-psresources-acr.yml               | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/.azure-pipelines/common-templates/publish-psresources-acr.yml b/.azure-pipelines/common-templates/publish-psresources-acr.yml
index 4e1e25eebe7..831d2d6b698 100644
--- a/.azure-pipelines/common-templates/publish-psresources-acr.yml
+++ b/.azure-pipelines/common-templates/publish-psresources-acr.yml
@@ -10,6 +10,40 @@ parameters:
     type: string
 
 steps:
+  - task: PowerShell@2
+    displayName: 'Diagnose ACR network access'
+    continueOnError: true
+    inputs:
+      targetType: Inline
+      pwsh: true
+      script: |
+        $ErrorActionPreference = 'Stop'
+        $registryHost = '${{ parameters.Registry }}'
+        $registryUri = "https://$registryHost/v2/"
+
+        Write-Host "Resolving $registryHost."
+        $dnsRecords = Resolve-DnsName -Name $registryHost
+        $dnsOutput = $dnsRecords |
+          Select-Object Name, Type, IPAddress, NameHost |
+          Format-Table -AutoSize |
+          Out-String
+        Write-Host $dnsOutput
+
+        Write-Host "Testing TCP connectivity to ${registryHost}:443."
+        $connection = Test-NetConnection -ComputerName $registryHost -Port 443 -InformationLevel Detailed
+        $connectionOutput = $connection |
+          Select-Object ComputerName, RemoteAddress, RemotePort, InterfaceAlias, SourceAddress, TcpTestSucceeded |
+          Format-List |
+          Out-String
+        Write-Host $connectionOutput
+        if (-not $connection.TcpTestSucceeded) {
+          throw "The build agent can't establish a TCP connection to ${registryHost}:443."
+        }
+
+        Write-Host "Requesting $registryUri. An HTTP 401 response confirms that the ACR endpoint is reachable."
+        $response = Invoke-WebRequest -Uri $registryUri -Method Get -SkipHttpErrorCheck -TimeoutSec 30
+        Write-Host "ACR endpoint returned HTTP $([int]$response.StatusCode) $($response.StatusDescription)."
+
   - task: AzurePowerShell@5
     displayName: 'Publish PowerShell packages to ACR'
     inputs:

From 314810b84317fc503d6991356f9f80c189f7805a Mon Sep 17 00:00:00 2001
From: Microsoft Graph DevX Tooling <GraphTooling@service.microsoft.com>
Date: Fri, 21 Aug 2026 01:09:04 -0700
Subject: [PATCH 2/2] Allow manual ACR publication

Add a default-off pipeline switch for testing ACR publication from manually queued feature-branch builds.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .azure-pipelines/ci-build.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml
index 95d09b92252..4a655053eac 100644
--- a/.azure-pipelines/ci-build.yml
+++ b/.azure-pipelines/ci-build.yml
@@ -14,6 +14,10 @@ parameters:
 - name: Sign
   type: boolean
   default: true
+- name: ForceAcrPublish
+  displayName: Force ACR publication (manual runs only)
+  type: boolean
+  default: false
 - name: InternalFeed
   type: string
   default: '0985d294-5762-4bc2-a565-161ef349ca3e/PowerShell_V2_Build'
@@ -144,7 +148,7 @@ extends:
       - stage: Deploy_to_ACR
         displayName: Deploy PowerShell packages to ACR
         dependsOn: stage
-        condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'), ne(variables['Build.Reason'], 'PullRequest'), eq(dependencies.stage.outputs['MsGraphPsSdkCiBuild.DetectAcrChanges.ShouldPublishToAcr'], 'true'))
+        condition: and(succeeded(), or(and(eq(variables['Build.SourceBranch'], 'refs/heads/main'), ne(variables['Build.Reason'], 'PullRequest'), eq(dependencies.stage.outputs['MsGraphPsSdkCiBuild.DetectAcrChanges.ShouldPublishToAcr'], 'true')), and(eq(variables['Build.Reason'], 'Manual'), ${{ eq(parameters.ForceAcrPublish, true) }})))
         jobs:
         - job: DeployPowerShellPackagesToAcr
           displayName: Deploy PowerShell packages to ACR