Restrict extension release publishing to main

[Copilot]

Fixes #9408

Summary

This PR prevents extension release publishing from feature branches. Manual extension pipeline runs can still build, test, sign, and package artifacts, but only runs sourced from refs/heads/main may enter the shared publishing stage.

Issue

A manual run from any branch could create a real Git tag and GitHub release, upload artifacts to the durable <extension>/<version> storage path, and open a registry update PR. A feature branch could therefore consume a release tag before the official main release and block that release until someone manually deleted the conflicting tag and GitHub release.

Change

The PublishExtension stage now requires:

eq(variables['Build.SourceBranch'], 'refs/heads/main')

Applying the guard at the stage boundary covers GitHub release creation, durable storage uploads, and registry updates. Build and signing stages remain available on any branch. PR bundle publishing from #9553 is separate and remains available where that pipeline integration is enabled.

Testing

Azure Pipelines run 20260819.1 exercised commit b36521529008d921ae98387c88b23f35441a7c9f from refs/heads/copilot/restrict-extension-release-publishing.

The run completed successfully and produced the expected build and signed release artifacts. Azure Pipelines skipped the complete PublishExtension stage for the feature branch. Skip.Publish=true and Skip.RegistryUpdate=true were also set as safeguards.

[azure-pipelines]

Azure Pipelines:
19 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
21 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Restricts official extension publishing to builds sourced from main, preventing feature branches from creating conflicting releases.

Changes:

• Adds a Build.SourceBranch guard to the publishing stage.
• Keeps build, test, signing, packaging, and PR bundle flows unchanged.

Show a summary per file

File	Description
eng/pipelines/templates/stages/publish-extension.yml	Limits the shared release publishing stage to refs/heads/main.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

📋 Prioritization Note

Thanks for the contribution! The linked issue isn't in the current milestone yet.
Thank you for logging this issue; our team is reviewing it. If you need urgent prioritization, tag Rick Winter (@RickWinter) and Kristen Womack (@kristenwomack) to let us know.