Fix APIScan pipeline token and registered version

[paulmedynski]

Description

Fix APIScan configuration in the official and non-official OneBranch pipelines:

• Expose $(System.AccessToken) as SYSTEM_ACCESSTOKEN in the shared package-build job, following the Guardian APIScan YAML guidance. This covers all six package build jobs that receive the auto-injected APIScan task.
• Rename the global APIScan softwareVersion setting to OneBranch's documented versionNumber setting so the registered version 6.10 is passed instead of falling back to the Azure Pipelines build ID.

In sqlclient-official run 26212.1, all six APIScan tasks reported the missing SYSTEM_ACCESSTOKEN. APIScan then received version 163917 and failed release registration validation because that version was not registered.

This is an engineering pipeline-only change. It introduces no product or public API changes.

Issues

No linked issue.

Related pipeline run: sqlclient-official run 26212.1

Testing

• break-on-SDL-error Enabled: sqlclient-non-official: 26216.1
• break-on-SDL-error Disabled: sqlclient-non-official: 26216.2

[Copilot]

Pull request overview

Updates the OneBranch official and non-official pipelines to align APIScan configuration with Guardian/OneBranch expectations so APIScan can authenticate and uses the intended registered version value during release registration.

Changes:

• Replaces the APIScan config key softwareVersion with versionNumber (set to '6.10') in both OneBranch entry pipelines.
• Exposes $(System.AccessToken) as SYSTEM_ACCESSTOKEN at the shared package build job level so the auto-injected APIScan task can access it.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
eng/pipelines/onebranch/sqlclient-official.yml	Switches APIScan registered version setting to versionNumber: '6.10' for official runs.
eng/pipelines/onebranch/sqlclient-non-official.yml	Switches APIScan registered version setting to versionNumber: '6.10' for non-official runs.
eng/pipelines/onebranch/jobs/build-buildproj-job.yml	Exposes the OAuth token as SYSTEM_ACCESSTOKEN for the auto-injected APIScan task across all package build jobs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

eng/pipelines/onebranch/sqlclient-official.yml:203

• PR description says it fixes APIScan by exposing $(System.AccessToken) as SYSTEM_ACCESSTOKEN in the shared OneBranch package build job, but this PR’s diff only updates the registered versionNumber. A repo search under eng/pipelines/onebranch shows no occurrences of SYSTEM_ACCESSTOKEN, so the missing-token failure described in run 26212.1 would likely still reproduce.

Please include the token plumbing change as well (e.g., set a job variable like SYSTEM_ACCESSTOKEN: $(System.AccessToken) in the shared package build job template so the auto-injected APIScan task can authenticate).

        softwareName: Microsoft.Data.SqlClient

        # Similar to the software name, we have a single version registered as well.  This has
        # nothing to do with the NuGet package version.  It is purely an APIScan registration
        # value that points to our backend configuration.
        versionNumber: $(ApiScanSoftwareVersion)

[mdaigle]

This change looks fine. Did we not end up needing the token changes?

[paulmedynski]

@mdaigle - Correct, OneBranch injects the APIScan task, and it uses a certificate-based auth model. The message about a missing token in the logs is benign.