Migrate AzDO CI/release pipelines to azdo-pipelines v2 (.config model)

[Copilot]

This PR migrates the repo from legacy .azure-pipelines definitions to the vscode-azuretools azdo-pipelines v2 model, aligned with the referenced container/resource-groups migrations. It preserves existing CI/release intent while incorporating reviewer-required adjustments from vscode-azureresourcegroups#1447 (notably npmFeed and federated-credential conventions).

• Pipeline migration (.azure-pipelines → .config)

  • Added .config/build.yml using azdo-pipelines/1es-mb-main.yml@azExtTemplates
  • Added .config/release.yml using azdo-pipelines/1es-mb-release-extension.yml@azExtTemplates
  • Updated template source to microsoft/vscode-azuretools at azext-pt/v1
  • Kept build triggers/schedule and manual release flow equivalent to current behavior

• Template parameter and variable alignment

  • Added shared variables template: azdo-pipelines/azcode.variables.yml@azExtTemplates
  • Added npmFeed: ${{ variables.npmFeed }} to both build and release pipelines
  • Wired release approval via ${{ variables.extensionReleaseApprovalEnvironment }}
  • Preserved long-running test toggle via conditional testARMServiceConnection

• Compliance + legacy cleanup

  • Moved TSA config to .config/tsaoptions.json
  • Removed deprecated legacy files:
    • .azure-pipelines/SignExtension.signproj
    • .azure-pipelines/compliance/CredScanSuppressions.json
    • .azure-pipelines/compliance/PoliCheckExclusions.xml
    • legacy .azure-pipelines/release.yml and build YAML

• Packaging + repo-specific follow-up

  • Updated .vscodeignore to exclude .config/** (replacing .azure-pipelines/**)
  • Updated long-running test gating to honor new pipeline federated-credential signal (FC_SERVICE_CONNECTION_NAME) while retaining legacy fallback

extends:
  template: azdo-pipelines/1es-mb-main.yml@azExtTemplates
  parameters:
    npmFeed: ${{ variables.npmFeed }}
    ${{ if eq(parameters.enableLongRunningTests, true) }}:
      testARMServiceConnection: ${{ variables.testARMServiceConnection }}

• Validation summary
  • Repo lint/build scripts run successfully in this environment
  • Test execution is currently blocked by external VS Code download DNS restrictions in the agent environment

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• update.code.visualstudio.com
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/vscode-azurecontainerapps/vscode-azurecontainerapps/node_modules/.bin/vscode-test (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Migrate this repository to the new Azure DevOps pipelines model in the same pattern used by the following reference PRs:

• Try out the new pipelines vscode-containers#365
• Use internal NPM feeds vscode-containers#471
• Migrate Azure DevOps CI/release pipelines to azdo-pipelines v2 (.config model) vscode-azureresourcegroups#1447
• Migration guide: https://github.com/microsoft/vscode-azuretools/blob/main/azdo-pipelines/MIGRATION.md
• Background/README: https://github.com/microsoft/vscode-azuretools/blob/main/azdo-pipelines/README.md

IMPORTANT — before writing any code:

1. Read through ALL review comments and discussion on Migrate Azure DevOps CI/release pipelines to azdo-pipelines v2 (.config model) vscode-azureresourcegroups#1447. That PR may contain reviewer feedback identifying mistakes or required corrections. Do not repeat those mistakes in this PR.
2. The vscode-azureresourcegroups PR (#1447) may also include additional changes beyond the vscode-containers reference PRs. Evaluate whether those additional changes are applicable to this repository and apply them if so.

IMPORTANT — before making any changes:
3. Check whether this repository contains the existing pipeline files that are meant to be migrated (e.g. the AzDO pipeline YAML files referenced in the migration guide). If one or both pipeline files are missing from this repository, do NOT create them. Instead, close this PR without merging and leave a comment explaining which files were absent.

Scope and expectations (only if pipeline files exist):

1. Identify and migrate existing pipeline definitions/templates in this repo to the new azdo-pipelines approach.
2. Apply equivalent structural changes seen in the reference PRs, adapted for this repository.
3. Update any supporting config/docs in-repo that must change due to the pipeline migration.
4. Preserve existing behavior and release/CI intent.
5. Validate by running the repo's relevant checks/tests where feasible in the agent environment.
6. In the PR description, summarize what changed, note any intentional deviations from the reference PRs, and include a brief validation summary.

Constraints:

• Keep changes focused on pipeline migration and directly related follow-up edits.
• Avoid unrelated refactors.
• Ensure YAML and template references are consistent and non-breaking.