CHORE: add OneBranch build & package pipeline - #548
Merged
Conversation
Adds OneBranchPipelines/build-release-package-pipeline.yml -- the OneBranch Official build that produces the mssql-django sdist + universal wheel and publishes the 'drop' artifact consumed by the release pipelines. - Pure-Python: single `python -m build` (no platform matrix / native / symbols). - regex_clr.dll fetched with authenticated access (AzureCLI managed identity, --auth-mode login) from the private storage account -- replaces the old anonymous wget, which no longer works (public access disabled). - Runs on Django-1ES-pool (allow-listed on the storage account network). - Pipeline source = ADO mirror (checkout: self); SBOM + SDL via OneBranch. Prerequisites (ADO side): a build pipeline definition sourcing this YAML from the ADO mirror; a `RegexClrServiceConnection` ARM service connection whose identity has Storage Blob Data Reader on the mssqldjangostorage account. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new Azure DevOps OneBranch “Official” build pipeline to produce mssql-django distribution artifacts (sdist + universal wheel), fetch regex_clr.dll at build time using authenticated Azure access, and publish the OneBranch drop artifact for downstream release pipelines.
Changes:
- Introduces
OneBranchPipelines/build-release-package-pipeline.ymlwith main/pr/nightly triggers and OneBranch Official governed template usage. - Adds steps to authenticate to an internal pip feed, download
regex_clr.dllviaaz storage blob download --auth-mode login, and build/publish package artifacts + SBOM.
Comments suppressed due to low confidence (3)
OneBranchPipelines/build-release-package-pipeline.yml:80
pool.demandsis malformed YAML: the list item is not indented underdemands:. As written, the pipeline YAML won’t parse (and the job won’t start).
demands:
- imageOverride -equals Ubuntu22.04-AzurePipelines
OneBranchPipelines/build-release-package-pipeline.yml:60
globalSdl.credscan.suppressionsFilepoints at$(Build.SourcesDirectory)/.config/CredScanSuppressions.json, but there is no.config/directory in this branch. CredScan will fail when it tries to load the suppressions file. Add the file (e.g., via the scaffold in PR #546) or update the path to where the suppressions file actually lives.
credscan:
enabled: true
suppressionsFile: $(Build.SourcesDirectory)/.config/CredScanSuppressions.json
OneBranchPipelines/build-release-package-pipeline.yml:66
globalSdl.tsa.configFilepoints at$(Build.SourcesDirectory)/.config/tsaoptions.json, but there is no.config/directory in this branch. TSA configuration loading will fail. Add the TSA config file (e.g., from PR #546) or update this path to the correct location.
tsa:
enabled: true
configFile: $(Build.SourcesDirectory)/.config/tsaoptions.json
jahnvi480
approved these changes
Jul 27, 2026
bewithgaurav
added a commit
that referenced
this pull request
Jul 27, 2026
Completes the release loop on top of the build pipeline (PR #548): - official-release-pipeline.yml: OneBranch Official. Downloads the build's 'drop' artifact and releases to PyPI via ESRP. Gated by releaseToPyPI (default false = dry run) so a run never publishes by accident. - dummy-release-pipeline.yml: OneBranch NonOfficial. Exercises the full ESRP path against a Maven ContentType (never PyPI), to validate release wiring safely. Both consume the build via a `pipelines:` resource (download: buildPipeline), so no build definition id is hard-coded. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
OneBranchPipelines/build-release-package-pipeline.yml— the OneBranch Official build that produces the mssql-django sdist + universal wheel and publishes thedropartifact consumed by the Official-Release and Dummy-Release pipelines.Design
python -m buildproduces one universal wheel + sdist — no platform matrix, no native compilation, no symbols (unlike mssql-python's build).AzureCLI@2+ managed identity,az storage blob download --auth-mode login) from the private storage account. This replaces the legacy anonymouswget, which no longer works — the account hasallowBlobPublicAccess=false/publicNetworkAccess=Disabled.Django-1ES-pool, which is allow-listed on that storage account's network (so the authenticated fetch can reach it)..config/(PR CHORE: add OneBranch release pipeline scaffolding #546).checkout: self) — SDL-clean.Prerequisites (ADO side — done when wiring the definition)
mssql-djangomirror.RegexClrServiceConnectionARM service connection whose identity has Storage Blob Data Reader onmssqldjangostorage(sub Magnitude Test 1, RGdjango).Depends on
.config/scaffold).Draft until the ADO build definition + service connection are wired.