Sync dev into v2 excluding #638 (OIDC ToolsInstaller auth)

Bring Node 22, CLI 2.111.0, and e2e refinements from dev so the
release pipeline `git merge origin/dev` succeeds. Leave #638 out so
it can be released separately.

Conflict resolution: keep dev versions of e2e-plugin-tests.yml and
trigger-ado-pipeline.sh (per-PR concurrency, no CI publish, base-ref
checkout, task-missing trigger retries).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: naveenku-jfrog

.github/workflows/e2e-plugin-tests.yml

@@ -78,12 +78,12 @@ on:
         required: false
         default: 'false'
 
-# Only one E2E run at a time — prevents two PRs racing to trigger the same
-# ADO pipeline simultaneously (which the dev org's parallel-job quota
-# would queue anyway).
+# One E2E run at a time per PR. A new label-trigger on the same PR cancels
+# the previous queued/in-progress run so the latest commit is always tested.
+# Across different PRs, runs are independent and execute in parallel.
 concurrency:
-  group: e2e-plugin-tests
-  cancel-in-progress: false
+  group: e2e-plugin-tests-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
 
 # ======================================================================
 # JOB 1 — Build the .vsix from the PR branch and upload as artifact.
@@ -212,23 +212,6 @@ jobs:
           retention-days: 14
           if-no-files-found: error
 
-      - name: Publish .vsix to Marketplace
-        if: ${{ env.MARKETPLACE_PAT != '' }}
-        env:
-          MARKETPLACE_PAT: ${{ secrets.ADO_E2E_MARKETPLACE_PAT }}
-        run: |
-          set -euo pipefail
-          vsix_path="$(ls -1 ./*.vsix | head -1)"
-          echo "Publishing $vsix_path to Marketplace..."
-          npx tfx extension publish \
-            --vsix "$vsix_path" \
-            --token "$MARKETPLACE_PAT" \
-            --no-wait-validation
-          echo "Published successfully."
-          echo "Waiting 90s for Marketplace async validation and ADO extension cache to propagate..."
-          sleep 90
-          echo "Done waiting — ADO pipelines will now run against the freshly published extension."
-
       - name: Write install instructions to job summary
         env:
           VSIX_VERSION: ${{ steps.build_vsix.outputs.vsix_version }}
@@ -334,7 +317,7 @@ jobs:
       - name: Checkout (for trigger script)
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ github.event.pull_request.base.sha || github.sha }}
 
       - name: Trigger ADO sanity pipeline and wait for result
         # The sanity pipeline (.pipelines/ado-sanity-pipeline.yml) tests:
@@ -406,7 +389,7 @@ jobs:
       - name: Checkout (for trigger script)
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ github.event.pull_request.base.sha || github.sha }}
 
       - name: Trigger ADO OIDC test pipeline and wait for result
         # The OIDC pipeline covers:

.github/workflows/tests.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ ubuntu, windows ]
-        node-version: [ '16', '20', '24' ]
+        node-version: [ '16', '20', '22', '24' ]
         include:
           - os: windows
             extraSkipTests: ",conan"

buildScripts/trigger-ado-pipeline.sh

@@ -7,7 +7,7 @@ set -eu
 #   ADO_ORG         - Azure DevOps organization name (e.g. vigneshc0742)
 #   ADO_PROJECT     - Azure DevOps project name     (e.g. ecomatrix-test)
 #   ADO_PIPELINE_ID - Pipeline definition ID         (e.g. 63)
-#   ADO_PAT         - PAT with Build Read+Execute and Project Read scopes
+#   ADO_PAT         - PAT with Build Read+Execute and Project Read scopes only
 #
 # Optional environment variables:
 #   GH_PR_NUMBER    - GitHub PR number passed into pipeline as a variable (default: 0)
@@ -43,20 +43,53 @@ echo "=============================================="
 RESPONSE_FILE=$(mktemp)
 trap 'rm -f "$RESPONSE_FILE"' EXIT
 
-HTTP_STATUS=$(curl -sS -o "$RESPONSE_FILE" -w "%{http_code}" -X POST \
-    "${API_BASE}/pipelines/${ADO_PIPELINE_ID}/runs?api-version=7.1" \
-    -H "${AUTH_HEADER}" \
-    -H "Content-Type: application/json" \
-    -d "{
-          \"variables\": {
-            \"GH_PR_NUMBER\":   { \"value\": \"${GH_PR_NUMBER}\",  \"isSecret\": false },
-            \"GH_COMMIT_SHA\":  { \"value\": \"${GH_COMMIT_SHA}\", \"isSecret\": false }
-          }
-        }" || echo "000")
+# A freshly (re)installed private extension is not immediately resolvable by
+# ADO's pipeline queue-time validator: it returns HTTP 400 with
+# "A task is missing. The pipeline references a task called '...E2E'" until the
+# org's task catalog catches up. This is an eventual-consistency lag, not a
+# real error, so retry the trigger for up to TRIGGER_RETRY_MINUTES, once per
+# minute, ONLY for that specific 400. All other statuses fail immediately.
+TRIGGER_RETRY_MINUTES="${TRIGGER_RETRY_MINUTES:-15}"
+TRIGGER_RETRY_INTERVAL_SECONDS="${TRIGGER_RETRY_INTERVAL_SECONDS:-60}"
+TRIGGER_DEADLINE=$(( $(date +%s) + TRIGGER_RETRY_MINUTES * 60 ))
+TRIGGER_ATTEMPT=0
+
+while : ; do
+    TRIGGER_ATTEMPT=$(( TRIGGER_ATTEMPT + 1 ))
+
+    HTTP_STATUS=$(curl -sS -o "$RESPONSE_FILE" -w "%{http_code}" -X POST \
+        "${API_BASE}/pipelines/${ADO_PIPELINE_ID}/runs?api-version=7.1" \
+        -H "${AUTH_HEADER}" \
+        -H "Content-Type: application/json" \
+        -d "{
+              \"variables\": {
+                \"GH_PR_NUMBER\":   { \"value\": \"${GH_PR_NUMBER}\",  \"isSecret\": false },
+                \"GH_COMMIT_SHA\":  { \"value\": \"${GH_COMMIT_SHA}\", \"isSecret\": false }
+              }
+            }" || echo "000")
+
+    RUN_RESPONSE="$(cat "$RESPONSE_FILE")"
+
+    if [ "$HTTP_STATUS" = "200" ]; then
+        break
+    fi
 
-RUN_RESPONSE="$(cat "$RESPONSE_FILE")"
+    # Retry only the transient "task is missing" 400 (extension still
+    # propagating in the org); every other failure is terminal.
+    if [ "$HTTP_STATUS" = "400" ] && printf '%s' "$RUN_RESPONSE" | grep -q "A task is missing"; then
+        if [ "$(date +%s)" -lt "$TRIGGER_DEADLINE" ]; then
+            echo "[$(date -u '+%H:%M:%S')] Trigger attempt ${TRIGGER_ATTEMPT}: HTTP 400 'A task is missing' — the E2E extension is still propagating in org '${ADO_ORG}'. Retrying in ${TRIGGER_RETRY_INTERVAL_SECONDS}s (up to ${TRIGGER_RETRY_MINUTES} min)..."
+            sleep "$TRIGGER_RETRY_INTERVAL_SECONDS"
+            continue
+        fi
+        echo "ERROR: Pipeline trigger still failing with 'A task is missing' after ${TRIGGER_RETRY_MINUTES} minutes."
+        echo "  The private E2E extension did not become resolvable in org '${ADO_ORG}' within the retry window."
+        echo "  Response    :"
+        echo "${RUN_RESPONSE}" | head -c 2000
+        echo ""
+        exit 1
+    fi
 
-if [ "$HTTP_STATUS" != "200" ]; then
     echo "ERROR: Pipeline trigger failed."
     echo "  HTTP status : ${HTTP_STATUS}"
     echo "  Endpoint    : ${API_BASE}/pipelines/${ADO_PIPELINE_ID}/runs?api-version=7.1"
@@ -71,7 +104,7 @@ if [ "$HTTP_STATUS" != "200" ]; then
         *)   echo "  Hint: see the response body above for the ADO error message." ;;
     esac
     exit 1
-fi
+done
 
 RUN_ID=$(echo "$RUN_RESPONSE"   | jq -r '.id   // empty')
 RUN_URL=$(echo "$RUN_RESPONSE"  | jq -r '._links.web.href // empty')

jfrog-tasks-utils/utils.js

@@ -12,7 +12,7 @@ const fileName = getCliExecutableName();
 const jfrogCliToolName = 'jf';
 const cliPackage = 'jfrog-cli-' + getArchitecture();
 const fallbackCliVersion = '2.99.0';
-let defaultJfrogCliVersion = '2.103.0';
+let defaultJfrogCliVersion = '2.111.0';
 
 /**
  * Executes an HTTP request with retry logic for 5xx errors.
@@ -144,7 +144,7 @@ const minCustomCliVersion = '2.10.0';
 const minSupportedStdinSecretCliVersion = '2.36.0';
 const minSupportedServerIdEnvCliVersion = '2.37.0';
 const minSupportedOidcCliVersion = '2.75.0';
-const pluginVersion = '2.14.1';
+const pluginVersion = '2.14.2';
 const buildAgent = 'jfrog-azure-devops-extension';
 
 /**