Handle AzDO upstream-conflict publish failures by enabling allowExternalVersions and retrying

[Copilot]

Publishing to dotnet-workloads can fail when a package is only available via an upstream (for example dotnet-public): publish returns a 409 upstream-source conflict unless the target feed allows external versions. This update adds targeted recovery for that failure mode in the official publish pipeline.

• Publish flow: detect upstream-source conflict from initial AzDO publish

  • In eng/pipelines/official.yml, the AzDO publish task is now named (InitialPublishToAzDO) and runs with continueOnError: true to allow post-failure inspection.
  • A follow-up PowerShell step reads the timeline/log for that task and checks for the specific upstream-conflict signature:
    • exists in at least one of the feed's upstream sources

• Feed configuration update via Artifacts REST API

  • On that conflict only, the pipeline resolves the feed from azDOPublishFeed (project/feed or feed-only) and updates feed settings using the Artifacts API:
    • allowExternalVersions = true
  • Includes explicit guardrails for empty feed input and feed lookup failure.

• Conditional retry

  • The pipeline sets RetryAzdoPublish=true only when the upstream-conflict path is taken.
  • A second AzDO publish task runs only when that variable is set.

- task: 1ES.PublishNuget@1
  name: InitialPublishToAzDO
  continueOnError: true
  inputs:
    publishVstsFeed: ${{ parameters.azDOPublishFeed }}

- powershell: |
    # Read InitialPublishToAzDO log; if upstream-conflict:
    # PATCH feed allowExternalVersions=true
    Write-Host "##vso[task.setvariable variable=RetryAzdoPublish]true"

- task: 1ES.PublishNuget@1
  condition: and(succeededOrFailed(), eq(variables['RetryAzdoPublish'], 'true'))
  inputs:
    publishVstsFeed: ${{ parameters.azDOPublishFeed }}