CHORE: add OneBranch build & package pipeline

[bewithgaurav]

What

Adds OneBranchPipelines/build-release-package-pipeline.yml — the OneBranch Official build that produces the mssql-django sdist + universal wheel and publishes the drop artifact consumed by the Official-Release and Dummy-Release pipelines.

Design

• Pure-Python: a single python -m build produces one universal wheel + sdist — no platform matrix, no native compilation, no symbols (unlike mssql-python's build).
• regex_clr.dll: fetched at build time with authenticated access (AzureCLI@2 + managed identity, az storage blob download --auth-mode login) from the private storage account. This replaces the legacy anonymous wget, which no longer works — the account has allowBlobPublicAccess=false / publicNetworkAccess=Disabled.
• Pool: Django-1ES-pool, which is allow-listed on that storage account's network (so the authenticated fetch can reach it).
• SDL: SBOM + CredScan/PoliCheck/TSA via the OneBranch Official template; TSA/CredScan configs from .config/ (PR CHORE: add OneBranch release pipeline scaffolding #546).
• Source: the pipeline's source repo is the ADO mirror (checkout: self) — SDL-clean.

Prerequisites (ADO side — done when wiring the definition)

1. A build pipeline definition sourcing this YAML from the ADO mssql-django mirror.
2. A RegexClrServiceConnection ARM service connection whose identity has Storage Blob Data Reader on mssqldjangostorage (sub Magnitude Test 1, RG django).

Depends on

• CHORE: add OneBranch release pipeline scaffolding #546 (variables + .config/ scaffold).

Draft until the ADO build definition + service connection are wired.

[Copilot]

Pull request overview

Adds a new Azure DevOps OneBranch “Official” build pipeline to produce mssql-django distribution artifacts (sdist + universal wheel), fetch regex_clr.dll at build time using authenticated Azure access, and publish the OneBranch drop artifact for downstream release pipelines.

Changes:

• Introduces OneBranchPipelines/build-release-package-pipeline.yml with main/pr/nightly triggers and OneBranch Official governed template usage.
• Adds steps to authenticate to an internal pip feed, download regex_clr.dll via az storage blob download --auth-mode login, and build/publish package artifacts + SBOM.

Comments suppressed due to low confidence (3)

OneBranchPipelines/build-release-package-pipeline.yml:80

• pool.demands is malformed YAML: the list item is not indented under demands:. As written, the pipeline YAML won’t parse (and the job won’t start).

              demands:
              - imageOverride -equals Ubuntu22.04-AzurePipelines

OneBranchPipelines/build-release-package-pipeline.yml:60

• globalSdl.credscan.suppressionsFile points at $(Build.SourcesDirectory)/.config/CredScanSuppressions.json, but there is no .config/ directory in this branch. CredScan will fail when it tries to load the suppressions file. Add the file (e.g., via the scaffold in PR #546) or update the path to where the suppressions file actually lives.

      credscan:
        enabled: true
        suppressionsFile: $(Build.SourcesDirectory)/.config/CredScanSuppressions.json

OneBranchPipelines/build-release-package-pipeline.yml:66

• globalSdl.tsa.configFile points at $(Build.SourcesDirectory)/.config/tsaoptions.json, but there is no .config/ directory in this branch. TSA configuration loading will fail. Add the TSA config file (e.g., from PR #546) or update this path to the correct location.

      tsa:
        enabled: true
        configFile: $(Build.SourcesDirectory)/.config/tsaoptions.json