[Ramses Sanchez-Hernandez (ramsessanchez)]

A similar PR may already be submitted! Please search among the Pull request before creating one.

Thanks for submitting a pull request! Please provide enough information so that others can review your pull request.

NOTE: PR's will be accepted only in case of appropriate information is provided below

Summary

Migrate .azure-pipelines/ci-build-production.yml to the official 1ES template and model npm publication on the TypeScript SDK release pipeline, adapted to this SDK's single npm package.

• Build: retain Windows tests on Node.js 22/24/26 and a Linux production build on Node.js 22. Publish JUnit results even on test failure; remove the redundant standalone Karma run because npm test already includes browser tests.
• Pack once: replace the source-directory copy with npm pack --ignore-scripts. The sdk-build Pipeline Artifact contains the built npm tarball. Skipping lifecycle scripts deliberately prevents this SDK's prepack hook from reinstalling dependencies, rebuilding, and rerunning tests during packing.
• Publish: only successful tag-push CI runs (IndividualCI/BatchedCI) enter the production deployment job. It uses msgraph-npm-org, the shared federated DevX ESRP configuration and release owners/approvers, and EsrpRelease@9 to distribute the downloaded tarball to npm. The same tarball is published as release-drop; no rebuild, repack, or dependency installation occurs during deployment. All manual runs, including manual tag runs, and main-branch pushes remain build-only.
• Version/tag safety: set package.json, the root lockfile version entries, and generated src/Version.ts to 3.1.0. Tag validation requires the exact package version (3.1.0, no v prefix) before staging production artifacts.
• Delegate SDL/security checks and artifact publication to the official template. No SDL checks are explicitly disabled.
• Update CONTRIBUTING.md with validation, deployment authorization, release-tag semantics, and legacy publisher cutover instructions.

Explicit differences from the TypeScript SDK: retain this repo's tests, ordinary dependency restore, single-package layout, and unprefixed tag convention. Do not copy its monorepo packing loop, TypeScript-specific package feed, or Release Please automation. Its manual-deployment bypass is intentionally not adopted. Reuse of the shared deployment configuration and omission of Release Please were confirmed with the user.

Cutover: disable the old external npm publication trigger before enabling this ESRP route to avoid duplicate publication. release-drop is now a Pipeline Artifact containing a .tgz, not the previous source-directory Build Artifact. Remaining consumers must support both changes. Confirm this pipeline's environment/service-connection access and ESRP authorization for @microsoft/microsoft-graph-client; the environment name does not prove access to the @microsoft scope.

Motivation

Explain the motivation for making this change. What existing problem does the pull request solve?

Production build 252816 failed organization enforcement because it did not extend an approved 1ES/OneBranch template. The user requested separate build/publication stages, tag-push-only release artifacts, version 3.1.0, and a release flow modeled on the TypeScript SDK. Immutable packed artifacts and the shared production ESRP deployment model replace the previously implicit external publication path.

Test plan

Demonstrate the code is solid. Example: The exact commands you ran and their output.

Prior hosted validation: Azure DevOps build 253684 passed on commit 13b246d3c, including the Linux production build, Windows Node.js 22/24/26 tests, and SDL source analysis. This predates tag gating, the 3.1.0 bump, and the ESRP deployment changes; it is not evidence that the final publication path has run.

Local validation used available Node.js v20.20.2/npm 10.8.2, not the required Node.js 22+ runtime:

• git diff --check — passed.
• npm run build — passed for version 3.1.0 in the preceding commit; no SDK implementation changes were made afterward.
• npm run test:cjs -- --reporter dot — passed: 359 tests, in the preceding commit.
• npm pack --ignore-scripts --json --pack-destination $destination ($destination set to the session validation directory) — passed: microsoft-microsoft-graph-client-3.1.0.tgz, 451 entries. Verified actual tarball identity/version, generated CJS/ESM version constants, declared package entry points, declarations, browser bundles and auth-provider exports, and exclusions for test/build-only files. An initial assertion incorrectly expected compiled JavaScript under the source-only authProviderOptions folder; corrected the check to its existing .ts barrel and verified compiled barrels under authProviders.
• Clean consumer npm install <generated tarball> --ignore-scripts --no-save --package-lock=false --no-audit --no-fund — tarball installation passed. Auth-provider smoke testing first identified the expected missing optional @azure/msal-browser dependency. Reinstalled the tarball together with the same MSAL 2.38.0 version used by this checkout; CJS Client initialization, package/generated version consistency, Azure credential provider import, and MSAL provider import all passed. No npm publication occurred.
• python - with inline YAML/JSON/tarball assertions and Node subprocess execution — passed: exact release-tag validation cases, package/version consistency, pipeline trigger/condition structure, immutable artifact input/output paths, and no deployment rebuild/pack. The deployment environment, pool, production release-job context, and all ESRP task inputs were compared with the current TypeScript SDK pipeline and matched exactly. These checks do not execute Azure's expression engine or private template expansion.
• Browser tests were not rerun locally for these pipeline-only changes. Prior local attempts were blocked by missing Chrome/Edge launcher failures; the prior hosted migration run completed browser tests successfully.

Next hosted validation: manually queue this PR branch to validate packaging and the updated 1ES deployment schema without publishing. Manual runs skip Publish. Before pushing release tag 3.1.0 on the intended release commit after merge to main, confirm environment approval/check policies, service-connection/certificate access, ESRP package-scope permission, npm dist-tag policy, unpublished version, and legacy-publisher cutover. No release tag was created or pushed and neither ESRP nor npm publication was invoked from this session.

Closing issues

N/A — no linked issue.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Pipeline behavior intentionally changes: branch/manual runs are build-only; release-tag CI deploys directly through ESRP. Artifact format and contents change to packed Pipeline Artifacts. This PR bumps the package version to 3.1.0 without adding SDK API changes.

Checklist

• I have read the CONTRIBUTING document.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.