Download native archives and gate URL validation on publishing branches

The Prepare Installers stage now downloads CLI native archives from the
pipeline artifacts so WinGet/Homebrew manifest generation can compute
hashes locally (archiveRoot). URL validation and install tests are gated
on whether the build is on a branch where Arcade's darc publish will
upload CLI archives to ci.dot.net (main, release/*, internal/release/*).
Feature branches and PR builds skip URL validation since no blobs will
be published.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: radical

eng/pipelines/azure-pipelines.yml

@@ -415,13 +415,26 @@ extends:
             steps:
             - checkout: self
               fetchDepth: 1
+            - task: DownloadPipelineArtifact@2
+              displayName: 🟣Download CLI archives
+              inputs:
+                itemPattern: |
+                  **/aspire-cli-*.zip
+                targetPath: '$(Pipeline.Workspace)/native-archives'
             - template: /eng/pipelines/templates/prepare-winget-manifest.yml@self
               parameters:
                 version: $(aspireVersion)
                 artifactVersion: $(aspireArtifactVersion)
                 channel: $(installerChannel)
-                skipUrlValidation: ${{ or(eq(variables['_RunAsPublic'], 'true'), eq(variables['Build.Reason'], 'PullRequest')) }}
-                runInstallTest: ${{ and(ne(variables['_RunAsPublic'], 'true'), ne(variables['Build.Reason'], 'PullRequest')) }}
+                archiveRoot: $(Pipeline.Workspace)/native-archives
+                # Skip URL validation and install tests unless this is a build on a
+                # publishing branch (main, release/*, internal/release/*) where darc
+                # publishes CLI archives to ci.dot.net. Feature branches and PR builds
+                # don't have Maestro default channels so URLs won't be valid.
+                # NOTE: ${{ not() }} is NOT supported in AzDO template expressions,
+                # so we use De Morgan's law to negate the runInstallTest condition.
+                skipUrlValidation: ${{ or(eq(variables['_RunAsPublic'], 'true'), eq(variables['Build.Reason'], 'PullRequest'), and(ne(variables['Build.SourceBranch'], 'refs/heads/main'), eq(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), false), eq(startsWith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'), false))) }}
+                runInstallTest: ${{ and(ne(variables['_RunAsPublic'], 'true'), ne(variables['Build.Reason'], 'PullRequest'), or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'))) }}
 
           - job: Homebrew
             displayName: Homebrew Cask
@@ -434,9 +447,16 @@ extends:
             steps:
             - checkout: self
               fetchDepth: 1
+            - task: DownloadPipelineArtifact@2
+              displayName: 🟣Download CLI archives
+              inputs:
+                itemPattern: |
+                  **/aspire-cli-*.tar.gz
+                targetPath: '$(Pipeline.Workspace)/native-archives'
             - template: /eng/pipelines/templates/prepare-homebrew-cask.yml@self
               parameters:
                 version: $(aspireVersion)
                 artifactVersion: $(aspireArtifactVersion)
-                skipUrlValidation: ${{ or(eq(variables['_RunAsPublic'], 'true'), eq(variables['Build.Reason'], 'PullRequest')) }}
-                runInstallTest: ${{ and(ne(variables['_RunAsPublic'], 'true'), ne(variables['Build.Reason'], 'PullRequest')) }}
+                archiveRoot: $(Pipeline.Workspace)/native-archives
+                skipUrlValidation: ${{ or(eq(variables['_RunAsPublic'], 'true'), eq(variables['Build.Reason'], 'PullRequest'), and(ne(variables['Build.SourceBranch'], 'refs/heads/main'), eq(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), false), eq(startsWith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'), false))) }}
+                runInstallTest: ${{ and(ne(variables['_RunAsPublic'], 'true'), ne(variables['Build.Reason'], 'PullRequest'), or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'))) }}