From db2111971cc1cf643d66c44c2d05b64aafcae21f Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Tue, 21 Jul 2026 11:56:08 -0700
Subject: [PATCH] Use a Windows pool for the 1ES SDL stage in
 docker-image-refresh

The 1ES Official template injects an SDL source-analysis stage that must run on a Windows pool; the template-level pool was Linux, causing 'Please specify a windows pool for SDLSources stage'. Set template-level pool to the Windows pool (1es-windows-ps-compute-m) and keep the Linux pool override on the container build job, mirroring sdk-release.yml.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
---
 .azure-pipelines/docker-image-refresh.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.azure-pipelines/docker-image-refresh.yml b/.azure-pipelines/docker-image-refresh.yml
index ce5ff5b745..b9f987d2bb 100644
--- a/.azure-pipelines/docker-image-refresh.yml
+++ b/.azure-pipelines/docker-image-refresh.yml
@@ -15,6 +15,9 @@
 name: $(Date:yyyyMMdd)$(Rev:.r)_docker-image-refresh
 
 parameters:
+- name: WindowsPool
+  type: string
+  default: 1es-windows-ps-compute-m
 - name: LinuxPool
   type: string
   default: Azure-Pipelines-1ESPT-ExDShared
@@ -47,10 +50,10 @@ resources:
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
-    pool:
-      name: ${{ parameters.LinuxPool }}
-      image: ubuntu-latest
-      os: linux
+    # The 1ES template injects an SDL/compliance stage that MUST run on a Windows pool, so the
+    # template-level pool is Windows. The actual container build overrides to a Linux pool at the
+    # job level below. (Same pattern as sdk-release.yml.)
+    pool: ${{ parameters.WindowsPool }}
     settings:
       networkIsolationPolicy: Permissive
     customBuildTags: