The install-dotnet.yml template call is missing the ob_restore_phase parameter. Since this step installs dotnet which is needed before signing operations, it should explicitly set ob_restore_phase: true.

Add the parameter:

- template: /.pipelines/templates/install-dotnet.yml@self
  parameters:
    ob_restore_phase: true

This ensures the dotnet installation happens in the restore phase, before signing operations begin.

The SetVersionVariables.yml template call is missing the ob_restore_phase parameter. Since this template now accepts and uses this parameter (as shown in the diff), it should be explicitly passed as true in signing jobs.

Add the parameter:

- template: /.pipelines/templates/SetVersionVariables.yml@self
  parameters:
    ReleaseTagVar: $(ReleaseTagVar)
    CreateJson: no
    ob_restore_phase: true

This ensures version variables are set in the restore phase before signing operations.

The cloneToOfficialPath.yml template call is missing the ob_restore_phase parameter. This template now accepts this parameter (as shown in the diff), and cloning should happen in the restore phase before signing.

Add the parameter:

- template: /.pipelines/templates/cloneToOfficialPath.yml@self
  parameters:
    nativePathRoot: '$(Agent.TempDirectory)'
    ob_restore_phase: true

This ensures the repository is cloned in the restore phase.

This diagnostic step runs after signing operations complete, so it should NOT have ob_restore_phase: true. According to the OneBranch restore phase pattern, only steps before the first signing operation should use the restore phase.

Remove the env block:

- pwsh: |
    Get-ChildItem -Path $(ob_outputDirectory) -Recurse
  displayName: 'List signed artifacts'

Steps after signing should run in the normal build phase, not the restore phase.

[nitpick] The applyTo section is missing the .pipelines/**/*.yaml pattern. For consistency with other instruction files and to ensure the guide applies to all pipeline files (both .yml and .yaml extensions), add:

---
applyTo:
  - "build.psm1"
  - "tools/ci.psm1"
  - ".github/**/*.yml"
  - ".github/**/*.yaml"
  - ".pipelines/**/*.yml"
  - ".pipelines/**/*.yaml"
---

This ensures the build configuration guide is available when editing any pipeline file.

The artifact name in the signing stage doesn't match the artifact name from the build stage. The build stage outputs artifacts with the name drop_windows_package_${{ parameters.runtime }} (line 19 in package.yml), but the signing stage is configured to output artifacts with the name drop_windows_package_package_win_${{ parameters.runtime }} (includes extra "package_win").

This inconsistency will cause issues when the upload stage tries to download the signed artifacts. The artifact name should be:

ob_artifactBaseName: drop_windows_package_package_win_${{ parameters.runtime }}

This matches the pattern used in the upload stage and other parts of the pipeline.

The MSIX bundle stage depends on windows_package_build and downloads unsigned MSIX packages, but it should likely depend on windows_package_sign to use signed MSIX packages instead.

Currently, the pipeline creates unsigned MSIX files in the build stage, then creates a bundle from those unsigned files and only signs the bundle. Typically, both individual MSIX packages and the bundle should be signed.

Consider changing:

dependsOn: [windows_package_build]  # Only depends on unsigned packages

to:

dependsOn: [windows_package_sign]  # Depends on signed packages

And update the artifact downloads in package-create-msix.yml to download from drop_windows_package_package_win_x64 (etc.) instead of drop_windows_package_x64.

[nitpick] The shouldSign.yml template call is missing the ob_restore_phase parameter. While it defaults to true, it's better to be explicit for consistency with other template calls in this file.

Add the parameter:

- template: /.pipelines/templates/shouldSign.yml@self
  parameters:
    ob_restore_phase: true

This matches the pattern used for SetVersionVariables.yml and cloneToOfficialPath.yml calls in the same file.