Add assembly signing for Microsoft.Data.SqlClient and the AKV Provider

[paulmedynski]

Description

Provide a summary of the changes being introduced. Important topics to cover
include:

• Description of the functionality.
• API changes, backwards compatibility, deprecations, etc.
• Documentation, localization.
• Bug fixes.
• Code hygiene, refactoring, improvements.
• Engineering processes (CI, pipelines, test coverage)

High quality descriptions will lead to a smoother review experience.

Issues

Link to any relevant issues, bugs, or discussions (e.g., Closes #123, Fixes issue #456).

Testing

Describe the automated tests (unit, integration) you created or modified.
Provide justification for any gap in automated testing. List any manual testing
steps that were performed to ensure the changes work. 

Guidelines

Please review the contribution guidelines before submitting a pull request:

• Contributing
• Code of Conduct
• Best Practices
• Coding Style
• Review Process

[Copilot]

Pull request overview

This PR wires up internal CI support for strong-name signing of Microsoft.Data.SqlClient and the AKV provider by threading an isInternalBuild flag through pipeline templates, downloading signing keys from ADO secure files, and passing signing-related MSBuild properties into build.proj-driven build/test steps.

Changes:

• Plumbs a new isInternalBuild parameter through core/stage templates so internal builds can enable extra steps (assembly signing).
• Adds secure-file download + parameter plumbing to pass signing key paths into build/test template invocations (including separate test signing key support).
• Updates build.proj test target dotnet test invocations to include signing-related MSBuild arguments (with review feedback about unintended signing of test assemblies).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
eng/pipelines/stages/build-sqlclient-package-ci-stage.yml	Adds isInternalBuild parameter and forwards it to the SqlClient package build job.
eng/pipelines/dotnet-sqlclient-ci-core.yml	Threads isInternalBuild into the SqlClient package stage and test stage template calls.
eng/pipelines/common/templates/steps/run-all-tests-step.yml	Adds signingKeyPath / testSigningKeyPath parameters and passes them through to build.proj test targets.
eng/pipelines/common/templates/steps/ci-project-build-step.yml	Adds signingKeyPath parameter and forwards it to build.proj for MDS/AKV builds.
eng/pipelines/common/templates/stages/ci-run-tests-stage.yml	Adds isInternalBuild parameter and forwards it into the test job template.
eng/pipelines/common/templates/jobs/ci-run-tests-job.yml	Downloads driver/test signing keys (internal + Package mode) and forwards their paths to the test step template.
eng/pipelines/common/templates/jobs/ci-build-nugets-job.yml	Downloads the driver signing key (internal + Package mode) and forwards it to the build step template for package builds.
build.proj	Threads signing-related properties into dotnet test commands; also uses SigningKeyPath to include/exclude category=signed tests.

Suppressed comments (2)

build.proj:694

• Forwarding SigningKeyPath into the functional/manual test project build will strong-name sign those test assemblies with the driver key via src/Directory.Build.props. This is likely unnecessary (and potentially undesirable) if only UnitTests needs signing (with TestSigningKeyPath) to satisfy InternalsVisibleTo for signed packages.

        <!-- Build arguments -->
        -p:Configuration=$(Configuration)
        $(SigningKeyPathArgument)

        <!-- Test arguments -->

build.proj:728

• For UnitTests, TestSigningKeyPath is the mechanism intended to sign the test assembly for IVT when the driver is signed in Package mode. Forwarding SigningKeyPath here additionally signs the test assembly with the driver key (unless overridden) and enables STRONG_NAME_SIGNING for the test build, which seems outside the stated goal of signing tests only with the test key.

        <!-- Build arguments -->
        -p:Configuration=$(Configuration)
        $(SigningKeyPathArgument)
        $(TestSigningKeyPathArgument)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.