{"record":{"id":"2df5c00e1f056869","repo":"microsoft/typescript-go","slug":"this-task-should-not-be-run-in-non-release-builds","errorCode":null,"errorMessage":"This task should not be run in non-release builds.","messagePattern":"This task should not be run in non-release builds\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"Herebyfile.mjs","lineNumber":2022,"sourceCode":"}\r\n\r\nexport const signNativePreviewPackages = task({\r\n    name: \"native-preview:sign-packages\",\r\n    hiddenFromTaskList: true,\r\n    run: runSignNativePreviewPackages,\r\n});\r\n\r\n/**\r\n * @param {string} nodeOs\r\n */\r\nfunction nativePreviewExeName(nodeOs) {\r\n    const baseName = publishAsTypescript ? \"tsc\" : \"tsgo\";\r\n    return nodeOs === \"win32\" ? `${baseName}.exe` : baseName;\r\n}\r\n\r\nasync function runSignNativePreviewPackages() {\r\n    if (!options.forRelease) {\r\n        throw new Error(\"This task should not be run in non-release builds.\");\r\n    }\r\n    if (usePublishedPlatformPackagesForVsix) {\r\n        checkPublishedPlatformPackagesForVsix();\r\n        console.log(\"Skipping npm package signing; VSIX packaging will use published platform packages.\");\r\n        return;\r\n    }\r\n\r\n    const platforms = getPlatforms();\r\n\r\n    /** @type {Map<Cert, { tmpName: string; path: string }[]>} */\r\n    const filelistByCert = new Map();\r\n    for (const { npmDir, nodeOs, cert, npmDirName } of platforms) {\r\n        let certFilelist = filelistByCert.get(cert);\r\n        if (!certFilelist) {\r\n            filelistByCert.set(cert, certFilelist = []);\r\n        }\r\n        certFilelist.push({\r\n            tmpName: npmDirName,\r","sourceCodeStart":2004,"sourceCodeEnd":2040,"githubUrl":"https://github.com/microsoft/typescript-go/blob/1bcfa18d79a3be41772223d5c05dfe4480e614ff/Herebyfile.mjs#L2004-L2040","documentation":"runSignNativePreviewPackages in Herebyfile.mjs (task `native-preview:sign-packages`, hidden from the task list) guards at entry: ESRP signing of the platform binaries is a release-only operation, so it throws immediately unless hereby was started with --forRelease. Signing involves Microsoft internal ESRP certs (Microsoft400, LinuxSign, MacDeveloperHarden) and must never run against local, non-release artifacts.","triggerScenarios":"Invoking the hidden signing task (or a custom task chain that calls runSignNativePreviewPackages) without the release flag, e.g. `npx hereby native-preview:sign-packages`.","commonSituations":"A developer or CI script experiments with release pipeline tasks by name instead of using the aggregate task; automation assembles task names dynamically and drops the flags.","solutions":["Run the full release pipeline instead: `npx hereby native-preview:release --forRelease --setPrerelease=dev.N.M`","If signing must run standalone, add the same flags: `npx hereby native-preview:sign-packages --forRelease --setPrerelease=dev.1.0`","Stop invoking hidden (`hiddenFromTaskList: true`) tasks outside the release pipeline; they are internal steps"],"exampleFix":"# before\nnpx hereby native-preview:sign-packages\n\n# after\nnpx hereby native-preview:release --forRelease --setPrerelease=dev.1.0","handlingStrategy":"validation","validationCode":"// Verify release flags before spawning hereby\nconst args = process.argv.slice(2);\nif (!args.includes(\"--forRelease\")) {\n  console.error(\"Signing tasks require --forRelease; aborting before invoke\");\n  process.exit(1);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat hidden hereby tasks as internal; call the public native-preview:release pipeline","Centralize required flags in one CI script instead of assembling task invocations ad hoc"],"tags":["build","release","signing","hereby","esrp"],"backgroundTag":null,"analyzedSha":"1bcfa18d79a3be41772223d5c05dfe4480e614ff","analyzedAt":"2026-08-16T02:12:00.115Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}