[azure-sdk-automation]

Sync eng/common directory with azure-sdk-tools for PR Azure/azure-sdk-tools#17441 See eng/common workflow

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🔵 Needs a closer look

Expanding credential-bearing publishing and pipeline-wide storage egress to eligible Azure repositories requires security review of service-connection authorization, branch protections, and RBAC that cannot be verified from this snapshot.

No open issues 🎉

What changed in this PR

Syncs shared evaluation publishing infrastructure from azure-sdk-tools PR #17441, allowing opted-in Azure-owned repositories to publish results without a per-repository allowlist.

Changes:

• Broadens publishing and storage-egress gates while retaining private -pr repository exclusions and trusted-run checks.
• Adds tests for repository eligibility, pipeline identity, and completed evaluations with failing grades.
• Documents repository opt-in, service-connection authorization, and storage requirements.

File	Description
eng/​common/​scripts/​eval/​README.md	Documents expanded eligibility and pipeline-owner setup requirements.
eng/​common/​scripts/​eval/​publisher/​test/​publisher.test.ts	Tests expanded trust gates and preservation of bundle identity and failing results.
eng/​common/​scripts/​eval/​publisher/​CHANGELOG.md	Records expanded shared-publisher support.
eng/​common/​pipelines/​templates/​steps/​eval-publish-results.yml	Updates compile-time and runtime publishing eligibility.
eng/​common/​pipelines/​templates/​stages/​archetype-eval.yml	Applies the expanded eligibility policy to storage egress.

_{Review effort: Balanced}

[Helen Gao (helen229)]

Approve the eng/common sync from Azure/azure-sdk-tools#17441 at source f4ce21a52e4c2cba019791ac8e3443dc2b2006e6. All five synced files match that source revision. The change retains repository-local opt-in, internal-project/main-branch trust checks, owner authorization and complete-summary requirements; no release approval is granted by this review.