From 475d21865d5b81973473739b55d1318f769814e5 Mon Sep 17 00:00:00 2001
From: Paul Medynski <31868385+paulmedynski@users.noreply.github.com>
Date: Thu, 3 Sep 2026 08:37:23 -0300
Subject: [PATCH 1/2] Pipelines | Use per-package APIScan name/version pairs

Each of our NuGet packages is now registered with APIScan under its own
name/version pair, so stop attributing every scan to a single global
Microsoft.Data.SqlClient / 6.10 registration.

- Reinstate the per-job ob_sdl_apiscan_softwareName and
  ob_sdl_apiscan_versionNumber variables in build-buildproj-job, driven by
  packageFullName and a new apiScanSoftwareVersion parameter.
- Remove softwareName/versionNumber from the globalSdl.apiscan blocks so the
  build job template is the single place the pair is specified.
- Replace ApiScanSoftwareVersion with ApiScanVersionSqlClient (7.1, this
  branch targets the 7.1.0 release) and ApiScanVersionSqlServer (1.0).
- Disable APIScan on validate-signed-package-job, which produces no
  assemblies and previously relied on the global registration.
- Update the SDL section of the OneBranch pipeline design instructions.
---
 .../onebranch-pipeline-design.instructions.md |  7 ++++--
 .../onebranch/jobs/build-buildproj-job.yml    | 12 +++++++++-
 .../jobs/validate-signed-package-job.yml      |  5 ++++
 .../onebranch/sqlclient-non-official.yml      | 14 ++++-------
 .../onebranch/sqlclient-official.yml          | 14 ++++-------
 .../onebranch/stages/build-stages.yml         |  6 +++++
 .../variables/onebranch-variables.yml         | 23 +++++++++++++++----
 7 files changed, 54 insertions(+), 27 deletions(-)

diff --git a/.github/instructions/onebranch-pipeline-design.instructions.md b/.github/instructions/onebranch-pipeline-design.instructions.md
index 0b647b6be0..ef9b442935 100644
--- a/.github/instructions/onebranch-pipeline-design.instructions.md
+++ b/.github/instructions/onebranch-pipeline-design.instructions.md
@@ -128,8 +128,11 @@ Variable groups:
 ## SDL and Compliance
 
 - TSA: enabled only in official pipeline; disabled in non-official to avoid spurious alerts
-- ApiScan: enabled in both; currently `break: false` pending package registration
-- Each build job sets `ob_sdl_apiscan_softwareFolder` to `$(JOB_OUTPUT)/assemblies` and `ob_sdl_apiscan_symbolsFolder` to `$(JOB_OUTPUT)/symbols`
+- ApiScan: enabled in both; `break` follows the `breakOnSdlError` parameter
+- Each package is registered with APIScan under its own name/version pair, so the `globalSdl.apiscan` blocks deliberately omit `softwareName`/`versionNumber`. `build-buildproj-job.yml` is the single place they are set, via `ob_sdl_apiscan_softwareName` (the package's `packageFullName`) and `ob_sdl_apiscan_versionNumber` (the `apiScanSoftwareVersion` parameter)
+- Registration versions live in `variables/onebranch-variables.yml` as `ApiScanVersionSqlClient` and `ApiScanVersionSqlServer`. They track the major.minor of each package's NuGet version, so a new pair must be registered with APIScan before releasing a new major.minor. They must stay runtime `$(...)` references — a template expression coerces the quoted value to a number (`'1.0'` becomes `1`)
+- Jobs that produce no assemblies (symbol publishing, signed-package validation, version computation) set `ob_sdl_apiscan_enabled: false` rather than reporting a name/version
+- Each build job also sets `ob_sdl_apiscan_softwareFolder` and `ob_sdl_apiscan_symbolsFolder` to its per-package `apiScan/<package>/dlls` and `apiScan/<package>/pdbs` paths
 - CodeQL, SBOM, Policheck (`break: true`): enabled in both pipelines
 - asyncSdl `enabled: false` in both; individual sub-tools (CredScan, BinSkim, Armory, Roslyn) configured underneath
 - Policheck exclusions: `$(REPO_ROOT)\.config\PolicheckExclusions.xml`
diff --git a/eng/pipelines/onebranch/jobs/build-buildproj-job.yml b/eng/pipelines/onebranch/jobs/build-buildproj-job.yml
index f773ec5e7e..737cf08d8b 100644
--- a/eng/pipelines/onebranch/jobs/build-buildproj-job.yml
+++ b/eng/pipelines/onebranch/jobs/build-buildproj-job.yml
@@ -17,6 +17,12 @@ parameters:
   - name: apiScanPdbPath
     type: string
 
+  # The APIScan registration version for the package being built.  This tracks the major.minor of
+  # the package's NuGet version, but must be a pair already registered with APIScan, so pass one of
+  # the ApiScanVersion* variables from onebranch-variables.yml rather than a computed version.
+  - name: apiScanSoftwareVersion
+    type: string
+
   # True to enable ESRP malware scanning and code signing steps, which should not be run on
   # non-official pipelines as they access production resources. If true, Signing* parameters must
   # be provided.
@@ -112,9 +118,13 @@ jobs:
 
       ob_outputDirectory: '$(JOB_OUTPUT)'
 
-      # APIScan per-job configuration for the DLL and PDB folders.
+      # APIScan per-job configuration.  This job template is the single place where the APIScan
+      # software name and version are set; the pipelines' globalSdl blocks deliberately leave them
+      # unset so that every scan is attributed to the package it actually covers.
       ob_sdl_apiscan_softwareFolder: ${{ parameters.apiScanDllPath }}
       ob_sdl_apiscan_symbolsFolder: ${{ parameters.apiScanPdbPath }}
+      ob_sdl_apiscan_softwareName: ${{ parameters.packageFullName }}
+      ob_sdl_apiscan_versionNumber: ${{ parameters.apiScanSoftwareVersion }}
 
     steps:
       - template: /eng/pipelines/onebranch/steps/script-output-environment-variables-step.yml@self
diff --git a/eng/pipelines/onebranch/jobs/validate-signed-package-job.yml b/eng/pipelines/onebranch/jobs/validate-signed-package-job.yml
index afa5aa5918..476bb5de30 100644
--- a/eng/pipelines/onebranch/jobs/validate-signed-package-job.yml
+++ b/eng/pipelines/onebranch/jobs/validate-signed-package-job.yml
@@ -48,6 +48,11 @@ jobs:
 
     variables: # More settings at https://aka.ms/obpipelines/yaml/jobs
 
+      # This job installs and inspects an already-built package rather than producing assemblies,
+      # so it has no APIScan software name/version to report. The build jobs scan those assemblies.
+      - name: ob_sdl_apiscan_enabled
+        value: false
+
       # Path within the downloaded artifact where NuGet packages are located.
       - name: artifactPath
         value: '$(Pipeline.Workspace)\${{ parameters.artifactName }}'
diff --git a/eng/pipelines/onebranch/sqlclient-non-official.yml b/eng/pipelines/onebranch/sqlclient-non-official.yml
index 7eb7bfc6cc..f30446c3a0 100644
--- a/eng/pipelines/onebranch/sqlclient-non-official.yml
+++ b/eng/pipelines/onebranch/sqlclient-non-official.yml
@@ -144,16 +144,10 @@ extends:
         # Use pre-release mode for non-official pipelines.
         modeType: prerelease
 
-        # We have a single "name" registered with APIScan for all of our packages.
-        #
-        # https://eng.ms/docs/products/apiscan/onboard/requirements/registersoftware
-        #
-        softwareName: Microsoft.Data.SqlClient
-
-        # Similar to the software name, we have a single version registered as well.  This has
-        # nothing to do with the NuGet package version.  It is purely an APIScan registration
-        # value that points to our backend configuration.
-        versionNumber: $(ApiScanSoftwareVersion)
+        # The APIScan software name and version are NOT set here.  Each package is registered with
+        # APIScan under its own name/version pair, so every build job sets ob_sdl_apiscan_softwareName
+        # and ob_sdl_apiscan_versionNumber for the package it builds (see build-buildproj-job.yml).
+        # Jobs that produce no assemblies disable APIScan instead, via ob_sdl_apiscan_enabled.
 
         # We want the standard level of logging.
         verbosityLevel: standard
diff --git a/eng/pipelines/onebranch/sqlclient-official.yml b/eng/pipelines/onebranch/sqlclient-official.yml
index 38a8a75496..50a68873f5 100644
--- a/eng/pipelines/onebranch/sqlclient-official.yml
+++ b/eng/pipelines/onebranch/sqlclient-official.yml
@@ -158,16 +158,10 @@ extends:
         # Use release mode for official pipelines.
         modeType: release
 
-        # We have a single "name" registered with APIScan for all of our packages.
-        #
-        # https://eng.ms/docs/products/apiscan/onboard/requirements/registersoftware
-        #
-        softwareName: Microsoft.Data.SqlClient
-
-        # Similar to the software name, we have a single version registered as well.  This has
-        # nothing to do with the NuGet package version.  It is purely an APIScan registration
-        # value that points to our backend configuration.
-        versionNumber: $(ApiScanSoftwareVersion)
+        # The APIScan software name and version are NOT set here.  Each package is registered with
+        # APIScan under its own name/version pair, so every build job sets ob_sdl_apiscan_softwareName
+        # and ob_sdl_apiscan_versionNumber for the package it builds (see build-buildproj-job.yml).
+        # Jobs that produce no assemblies disable APIScan instead, via ob_sdl_apiscan_enabled.
 
         # We want the standard level of logging.
         verbosityLevel: standard
diff --git a/eng/pipelines/onebranch/stages/build-stages.yml b/eng/pipelines/onebranch/stages/build-stages.yml
index 49c6616b85..49f9d35cfb 100644
--- a/eng/pipelines/onebranch/stages/build-stages.yml
+++ b/eng/pipelines/onebranch/stages/build-stages.yml
@@ -93,6 +93,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Internal.Logging/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Internal.Logging/pdbs'
+          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -115,6 +116,7 @@ stages:
           parameters:
             apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.SqlServer.Server/dlls'
             apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.SqlServer.Server/pdbs'
+            apiScanSoftwareVersion: '$(ApiScanVersionSqlServer)'
             shouldSignPackage: ${{ parameters.isOfficial }}
             signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
             signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -153,6 +155,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Extensions.Abstractions/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Extensions.Abstractions/pdbs'
+          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -196,6 +199,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient/pdbs'
+          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -233,6 +237,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Extensions.Azure/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Extensions.Azure/pdbs'
+          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -277,6 +282,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider/pdbs'
+          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
diff --git a/eng/pipelines/onebranch/variables/onebranch-variables.yml b/eng/pipelines/onebranch/variables/onebranch-variables.yml
index fb671961cc..cd39d58a7f 100644
--- a/eng/pipelines/onebranch/variables/onebranch-variables.yml
+++ b/eng/pipelines/onebranch/variables/onebranch-variables.yml
@@ -54,10 +54,25 @@ variables:
   - name: Packaging.EnableSBOMSigning
     value: true
 
-  # Keep this as a runtime variable reference in globalSdl.apiscan.versionNumber. Passing the
-  # quoted value directly through an Azure template expression perturbs '6.10' to the number 6.1.
-  - name: ApiScanSoftwareVersion
-    value: '6.10'
+  # APIScan registration versions.  Each package is registered with APIScan under its own
+  # name/version pair, and the version tracks the major.minor of the package's NuGet version.  A
+  # pair must already be registered before a build can report it, so every time we release a new
+  # major.minor of a package we must first register the new pair.  See:
+  #
+  # https://eng.ms/docs/products/apiscan/onboard/requirements/registersoftware
+  #
+  # Keep these as runtime variable references rather than literals passed through template
+  # expressions: an Azure template expression perturbs a quoted version to a number, which turns
+  # '1.0' into 1 (and previously turned '6.10' into 6.1), neither of which matches a registration.
+
+  # Used by every package in the SqlClient family, which all version in lockstep.  This branch
+  # targets the 7.1.0 release.
+  - name: ApiScanVersionSqlClient
+    value: '7.1'
+
+  # Microsoft.SqlServer.Server versions independently of the SqlClient family.
+  - name: ApiScanVersionSqlServer
+    value: '1.0'
 
   # OneBranch supplies a variety of container images we must use for our jobs.
 

From c0e03dd4659dba9ada4da7a3c864d057a297b8f8 Mon Sep 17 00:00:00 2001
From: Paul Medynski <31868385+paulmedynski@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:45:25 -0300
Subject: [PATCH 2/2] Derive APIScan versions from package versions

---
 .../onebranch-pipeline-design.instructions.md |  5 ++--
 .../onebranch/jobs/build-buildproj-job.yml    |  6 ++---
 .../onebranch/scripts/compute-versions.ps1    | 26 +++++++++++++++++++
 .../scripts/tests/compute-versions.Tests.ps1  |  3 +++
 .../onebranch/stages/build-stages.yml         | 22 +++++++++++-----
 .../variables/onebranch-variables.yml         | 20 --------------
 6 files changed, 51 insertions(+), 31 deletions(-)

diff --git a/.github/instructions/onebranch-pipeline-design.instructions.md b/.github/instructions/onebranch-pipeline-design.instructions.md
index ef9b442935..272369dfb5 100644
--- a/.github/instructions/onebranch-pipeline-design.instructions.md
+++ b/.github/instructions/onebranch-pipeline-design.instructions.md
@@ -108,7 +108,8 @@ When `isPreview` is true, pipeline resolves `effective*Version` variables to pre
 
 - Variable chain: pipeline YAML → `variables/onebranch-variables.yml` → `variables/common-variables.yml`
 - All package versions (GA, preview, assembly file) centralized in `variables/common-variables.yml`
-- `effective*Version` pipeline variables map to selected version set based on `isPreview`
+- The `compute_versions` stage reads canonical versions from MSBuild and publishes effective package,
+  file-build, and APIScan registration versions for downstream stages
 - Artifact name variables defined in `variables/onebranch-variables.yml` following `drop_<stageName>_<jobName>` pattern
 - `assemblyBuildNumber` derived from first segment of `Build.BuildNumber` only (16-bit limit)
 - When adding a new package, add GA version, preview version, and assembly file version entries
@@ -130,7 +131,7 @@ Variable groups:
 - TSA: enabled only in official pipeline; disabled in non-official to avoid spurious alerts
 - ApiScan: enabled in both; `break` follows the `breakOnSdlError` parameter
 - Each package is registered with APIScan under its own name/version pair, so the `globalSdl.apiscan` blocks deliberately omit `softwareName`/`versionNumber`. `build-buildproj-job.yml` is the single place they are set, via `ob_sdl_apiscan_softwareName` (the package's `packageFullName`) and `ob_sdl_apiscan_versionNumber` (the `apiScanSoftwareVersion` parameter)
-- Registration versions live in `variables/onebranch-variables.yml` as `ApiScanVersionSqlClient` and `ApiScanVersionSqlServer`. They track the major.minor of each package's NuGet version, so a new pair must be registered with APIScan before releasing a new major.minor. They must stay runtime `$(...)` references — a template expression coerces the quoted value to a number (`'1.0'` becomes `1`)
+- `compute-versions.ps1` derives APIScan registration versions as major.minor from the effective canonical package versions and publishes them as stage outputs. A package name/version pair must still be registered with APIScan before releasing a new major.minor. Consume these as runtime `$(...)` references so values such as `1.0` remain strings rather than being coerced to numbers by template expressions
 - Jobs that produce no assemblies (symbol publishing, signed-package validation, version computation) set `ob_sdl_apiscan_enabled: false` rather than reporting a name/version
 - Each build job also sets `ob_sdl_apiscan_softwareFolder` and `ob_sdl_apiscan_symbolsFolder` to its per-package `apiScan/<package>/dlls` and `apiScan/<package>/pdbs` paths
 - CodeQL, SBOM, Policheck (`break: true`): enabled in both pipelines
diff --git a/eng/pipelines/onebranch/jobs/build-buildproj-job.yml b/eng/pipelines/onebranch/jobs/build-buildproj-job.yml
index 737cf08d8b..60b465f77a 100644
--- a/eng/pipelines/onebranch/jobs/build-buildproj-job.yml
+++ b/eng/pipelines/onebranch/jobs/build-buildproj-job.yml
@@ -17,9 +17,9 @@ parameters:
   - name: apiScanPdbPath
     type: string
 
-  # The APIScan registration version for the package being built.  This tracks the major.minor of
-  # the package's NuGet version, but must be a pair already registered with APIScan, so pass one of
-  # the ApiScanVersion* variables from onebranch-variables.yml rather than a computed version.
+  # The APIScan registration version for the package being built. This is the major.minor value
+  # derived from the canonical package version by the compute_versions stage. The package's
+  # name/version pair must already be registered with APIScan before the build runs.
   - name: apiScanSoftwareVersion
     type: string
 
diff --git a/eng/pipelines/onebranch/scripts/compute-versions.ps1 b/eng/pipelines/onebranch/scripts/compute-versions.ps1
index ca3eb2c9d9..c2e21f95f0 100644
--- a/eng/pipelines/onebranch/scripts/compute-versions.ps1
+++ b/eng/pipelines/onebranch/scripts/compute-versions.ps1
@@ -45,6 +45,8 @@
       - VersionRevision
       - SqlClientPackageVersion
       - SqlServerPackageVersion
+      - SqlClientApiScanVersion
+      - SqlServerApiScanVersion
 
 .PARAMETER ProjectPath
     Absolute or relative path to the repository build.proj file.
@@ -273,6 +275,28 @@ function Add-VersionBuildNumber {
     return $Version
 }
 
+<#
+.SYNOPSIS
+    Extracts the major.minor components from a package version.
+
+.PARAMETER Version
+    Package version beginning with a numeric major.minor pair.
+
+.OUTPUTS
+    The major.minor version pair.
+#>
+function Get-MajorMinorVersion {
+    param(
+        [string]$Version
+    )
+
+    if ($Version -notmatch "^(\d+)\.(\d+)(?:\.|-|$)") {
+        throw "Unable to derive a major.minor version from package version '$Version'."
+    }
+
+    return "$($Matches[1]).$($Matches[2])"
+}
+
 <#
 .SYNOPSIS
     Emits an Azure DevOps job output variable for consumption by downstream stages.
@@ -351,4 +375,6 @@ Write-Host "  SqlServer:          $sqlServerPackageVersion"
 
 Set-PipelineOutputVariable -Name "SqlClientPackageVersion" -Value $sqlClientPackageVersion
 Set-PipelineOutputVariable -Name "SqlServerPackageVersion" -Value $sqlServerPackageVersion
+Set-PipelineOutputVariable -Name "SqlClientApiScanVersion" -Value (Get-MajorMinorVersion -Version $sqlClientPackageVersion)
+Set-PipelineOutputVariable -Name "SqlServerApiScanVersion" -Value (Get-MajorMinorVersion -Version $sqlServerPackageVersion)
 Set-PipelineOutputVariable -Name "VersionRevision" -Value $fileVersionBuildNumber
diff --git a/eng/pipelines/onebranch/scripts/tests/compute-versions.Tests.ps1 b/eng/pipelines/onebranch/scripts/tests/compute-versions.Tests.ps1
index ba109c4b71..88fc412b4a 100644
--- a/eng/pipelines/onebranch/scripts/tests/compute-versions.Tests.ps1
+++ b/eng/pipelines/onebranch/scripts/tests/compute-versions.Tests.ps1
@@ -78,6 +78,8 @@ Describe 'compute-versions.ps1 Effective Versions' {
 
         $output | Should -Match "SqlClientPackageVersion;isOutput=true]7\.1\.0-preview3\.$script:testBuildNumberPattern"
         $output | Should -Match "SqlServerPackageVersion;isOutput=true]1\.1\.0-preview1\.$script:testBuildNumberPattern"
+        $output | Should -Match 'SqlClientApiScanVersion;isOutput=true]7\.1'
+        $output | Should -Match 'SqlServerApiScanVersion;isOutput=true]1\.1'
         $output | Should -Match "VersionRevision;isOutput=true]$script:testFileVersionBuildNumber"
     }
 
@@ -93,6 +95,7 @@ Describe 'compute-versions.ps1 Effective Versions' {
 
         $output | Should -Match 'SqlClientPackageVersion;isOutput=true]7\.1\.0\.42-preview3'
         $output | Should -Match 'SqlServerPackageVersion;isOutput=true]1\.0\.0'
+        $output | Should -Match 'SqlServerApiScanVersion;isOutput=true]1\.0'
         $output | Should -Not -Match 'SqlServerPackageVersion;isOutput=true]1\.0\.0\.42'
     }
 
diff --git a/eng/pipelines/onebranch/stages/build-stages.yml b/eng/pipelines/onebranch/stages/build-stages.yml
index 49f9d35cfb..98e656004b 100644
--- a/eng/pipelines/onebranch/stages/build-stages.yml
+++ b/eng/pipelines/onebranch/stages/build-stages.yml
@@ -86,6 +86,10 @@ stages:
         value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlClientPackageVersion'] ]
       - name: sqlServerPackageVersion
         value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlServerPackageVersion'] ]
+      - name: sqlClientApiScanVersion
+        value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlClientApiScanVersion'] ]
+      - name: sqlServerApiScanVersion
+        value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlServerApiScanVersion'] ]
 
     jobs:
       # Build Microsoft.Data.SqlClient.Internal.Logging
@@ -93,7 +97,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Internal.Logging/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Internal.Logging/pdbs'
-          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
+          apiScanSoftwareVersion: '$(sqlClientApiScanVersion)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -116,7 +120,7 @@ stages:
           parameters:
             apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.SqlServer.Server/dlls'
             apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.SqlServer.Server/pdbs'
-            apiScanSoftwareVersion: '$(ApiScanVersionSqlServer)'
+            apiScanSoftwareVersion: '$(sqlServerApiScanVersion)'
             shouldSignPackage: ${{ parameters.isOfficial }}
             signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
             signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -148,6 +152,8 @@ stages:
         value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.VersionRevision'] ]
       - name: sqlClientPackageVersion
         value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlClientPackageVersion'] ]
+      - name: sqlClientApiScanVersion
+        value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlClientApiScanVersion'] ]
 
     jobs:
       # Build Microsoft.Data.SqlClient.Extensions.Abstractions
@@ -155,7 +161,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Extensions.Abstractions/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Extensions.Abstractions/pdbs'
-          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
+          apiScanSoftwareVersion: '$(sqlClientApiScanVersion)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -192,6 +198,8 @@ stages:
         value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlClientPackageVersion'] ]
       - name: sqlServerPackageVersion
         value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlServerPackageVersion'] ]
+      - name: sqlClientApiScanVersion
+        value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlClientApiScanVersion'] ]
 
     jobs:
       # Build Microsoft.Data.SqlClient
@@ -199,7 +207,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient/pdbs'
-          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
+          apiScanSoftwareVersion: '$(sqlClientApiScanVersion)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -237,7 +245,7 @@ stages:
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Extensions.Azure/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.Extensions.Azure/pdbs'
-          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
+          apiScanSoftwareVersion: '$(sqlClientApiScanVersion)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
@@ -276,13 +284,15 @@ stages:
         value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlClientPackageVersion'] ]
       - name: sqlServerPackageVersion
         value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlServerPackageVersion'] ]
+      - name: sqlClientApiScanVersion
+        value: $[ stageDependencies.compute_versions.compute_versions_job.outputs['versions.SqlClientApiScanVersion'] ]
 
     jobs:
       - template: /eng/pipelines/onebranch/jobs/build-buildproj-job.yml@self
         parameters:
           apiScanDllPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider/dlls'
           apiScanPdbPath: '$(REPO_ROOT)/apiScan/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider/pdbs'
-          apiScanSoftwareVersion: '$(ApiScanVersionSqlClient)'
+          apiScanSoftwareVersion: '$(sqlClientApiScanVersion)'
           shouldSignPackage: ${{ parameters.isOfficial }}
           signingAppRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
           signingAppRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
diff --git a/eng/pipelines/onebranch/variables/onebranch-variables.yml b/eng/pipelines/onebranch/variables/onebranch-variables.yml
index cd39d58a7f..d56d95044e 100644
--- a/eng/pipelines/onebranch/variables/onebranch-variables.yml
+++ b/eng/pipelines/onebranch/variables/onebranch-variables.yml
@@ -54,26 +54,6 @@ variables:
   - name: Packaging.EnableSBOMSigning
     value: true
 
-  # APIScan registration versions.  Each package is registered with APIScan under its own
-  # name/version pair, and the version tracks the major.minor of the package's NuGet version.  A
-  # pair must already be registered before a build can report it, so every time we release a new
-  # major.minor of a package we must first register the new pair.  See:
-  #
-  # https://eng.ms/docs/products/apiscan/onboard/requirements/registersoftware
-  #
-  # Keep these as runtime variable references rather than literals passed through template
-  # expressions: an Azure template expression perturbs a quoted version to a number, which turns
-  # '1.0' into 1 (and previously turned '6.10' into 6.1), neither of which matches a registration.
-
-  # Used by every package in the SqlClient family, which all version in lockstep.  This branch
-  # targets the 7.1.0 release.
-  - name: ApiScanVersionSqlClient
-    value: '7.1'
-
-  # Microsoft.SqlServer.Server versions independently of the SqlClient family.
-  - name: ApiScanVersionSqlServer
-    value: '1.0'
-
   # OneBranch supplies a variety of container images we must use for our jobs.
 
   # Windows jobs use this image.