Skip to content

Commit 3bfad4f

Browse files
RyAuldRyAuld
committed
20260330.2 Move Build/Publish stages to pipeline-publish.yml to avoid SC validation in PR build
1 parent 5254163 commit 3bfad4f

2 files changed

Lines changed: 151 additions & 153 deletions

File tree

‎.Pipelines/pipeline-publish.yml‎

Lines changed: 144 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
# Publish targets:
77
# test.pypi.org (Preview / RC) — preview releases via MSAL-Test-Python-Upload SC
88
# (SC creation pending test.pypi.org API token)
9-
# pypi.org (ESRP Production) — production releases via ESRP
9+
# pypi.org (ESRP Production) — production releases via MSAL-Prod-Python-Upload SC
1010
#
1111
# For one-time ADO setup, see ADO-PUBLISH-SETUP.md.
1212

@@ -25,9 +25,151 @@ parameters:
2525
trigger: none # manual runs only — no automatic branch or tag triggers
2626
pr: none
2727

28+
# Stage flow:
29+
#
30+
# PreBuildCheck ─► Validate ─► CI ─► Build ─► PublishMSALPython (publishTarget == Preview)
31+
# └─► PublishPyPI (publishTarget == ESRP Production)
32+
2833
stages:
34+
35+
# PreBuildCheck, Validate, and CI stages are defined in the shared template.
2936
- template: template-pipeline-stages.yml
3037
parameters:
3138
packageVersion: ${{ parameters.packageVersion }}
32-
publishTarget: ${{ parameters.publishTarget }}
3339
runPublish: true
40+
41+
# ══════════════════════════════════════════════════════════════════════════════
42+
# Stage 3 · Build — build sdist + wheel
43+
# ══════════════════════════════════════════════════════════════════════════════
44+
- stage: Build
45+
displayName: 'Build package'
46+
dependsOn: CI
47+
condition: eq(dependencies.CI.result, 'Succeeded')
48+
jobs:
49+
- job: BuildDist
50+
displayName: 'Build sdist + wheel (Python 3.12)'
51+
pool:
52+
vmImage: ubuntu-latest
53+
steps:
54+
- task: UsePythonVersion@0
55+
inputs:
56+
versionSpec: '3.12'
57+
displayName: 'Use Python 3.12'
58+
59+
- script: |
60+
python -m pip install --upgrade pip build twine
61+
displayName: 'Install build toolchain'
62+
63+
- script: |
64+
python -m build
65+
displayName: 'Build sdist and wheel'
66+
67+
- script: |
68+
python -m twine check dist/*
69+
displayName: 'Verify distribution (twine check)'
70+
71+
- task: PublishPipelineArtifact@1
72+
displayName: 'Publish dist/ as pipeline artifact'
73+
inputs:
74+
targetPath: dist/
75+
artifact: python-dist
76+
77+
# ══════════════════════════════════════════════════════════════════════════════
78+
# Stage 4a · Publish to test.pypi.org (Preview / RC)
79+
# Note: requires MSAL-Test-Python-Upload SC in ADO (pending test.pypi.org API token)
80+
# ══════════════════════════════════════════════════════════════════════════════
81+
- stage: PublishMSALPython
82+
displayName: 'Publish to test.pypi.org (Preview)'
83+
dependsOn: Build
84+
condition: >
85+
and(
86+
eq(dependencies.Build.result, 'Succeeded'),
87+
eq('${{ parameters.publishTarget }}', 'test.pypi.org (Preview / RC)')
88+
)
89+
jobs:
90+
- deployment: DeployMSALPython
91+
displayName: 'Upload to test.pypi.org'
92+
pool:
93+
vmImage: ubuntu-latest
94+
environment: MSAL-Python
95+
strategy:
96+
runOnce:
97+
deploy:
98+
steps:
99+
- task: DownloadPipelineArtifact@2
100+
displayName: 'Download python-dist artifact'
101+
inputs:
102+
artifactName: python-dist
103+
targetPath: $(Pipeline.Workspace)/python-dist
104+
105+
- task: UsePythonVersion@0
106+
inputs:
107+
versionSpec: '3.12'
108+
displayName: 'Use Python 3.12'
109+
110+
- script: |
111+
python -m pip install --upgrade pip twine
112+
displayName: 'Install twine'
113+
114+
- task: TwineAuthenticate@1
115+
displayName: 'Authenticate with MSAL-Test-Python-Upload'
116+
inputs:
117+
pythonUploadServiceConnection: MSAL-Test-Python-Upload
118+
119+
- script: |
120+
python -m twine upload \
121+
-r "MSAL-Test-Python-Upload" \
122+
--config-file $(PYPIRC_PATH) \
123+
--skip-existing \
124+
$(Pipeline.Workspace)/python-dist/*
125+
displayName: 'Upload to test.pypi.org'
126+
127+
# ══════════════════════════════════════════════════════════════════════════════
128+
# Stage 4b · Publish to PyPI (ESRP Production)
129+
# IMPORTANT: configure a required manual approval on this environment in
130+
# ADO → Pipelines → Environments → MSAL-Python-Release → Approvals and checks.
131+
# ══════════════════════════════════════════════════════════════════════════════
132+
- stage: PublishPyPI
133+
displayName: 'Publish to PyPI (ESRP Production)'
134+
dependsOn: Build
135+
condition: >
136+
and(
137+
eq(dependencies.Build.result, 'Succeeded'),
138+
eq('${{ parameters.publishTarget }}', 'pypi.org (ESRP Production)')
139+
)
140+
jobs:
141+
- deployment: DeployPyPI
142+
displayName: 'Upload to pypi.org'
143+
pool:
144+
vmImage: ubuntu-latest
145+
environment: MSAL-Python-Release
146+
strategy:
147+
runOnce:
148+
deploy:
149+
steps:
150+
- task: DownloadPipelineArtifact@2
151+
displayName: 'Download python-dist artifact'
152+
inputs:
153+
artifactName: python-dist
154+
targetPath: $(Pipeline.Workspace)/python-dist
155+
156+
- task: UsePythonVersion@0
157+
inputs:
158+
versionSpec: '3.12'
159+
displayName: 'Use Python 3.12'
160+
161+
- script: |
162+
python -m pip install --upgrade pip twine
163+
displayName: 'Install twine'
164+
165+
- task: TwineAuthenticate@1
166+
displayName: 'Authenticate with MSAL-Prod-Python-Upload'
167+
inputs:
168+
pythonUploadServiceConnection: MSAL-Prod-Python-Upload
169+
170+
- script: |
171+
python -m twine upload \
172+
-r "MSAL-Prod-Python-Upload" \
173+
--config-file $(PYPIRC_PATH) \
174+
$(Pipeline.Workspace)/python-dist/*
175+
displayName: 'Upload to PyPI (ESRP Production)'

‎.Pipelines/template-pipeline-stages.yml‎

Lines changed: 7 additions & 151 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# template-pipeline-stages.yml
22
#
3-
# Unified pipeline stages template for the msal Python package.
3+
# Shared stages template for the msal Python package.
44
#
55
# Called from:
66
# pipeline-publish.yml — release build (runPublish: true)
@@ -9,24 +9,21 @@
99
# Parameters:
1010
# packageVersion - Version to validate against msal/sku.py
1111
# Required when runPublish is true; unused otherwise.
12-
# publishTarget - 'test.pypi.org (Preview / RC)' or 'pypi.org (Pre-ESRP)'
13-
# Required when runPublish is true; unused otherwise.
14-
# runPublish - When true: also run Validate, Build, and Publish stages.
12+
# runPublish - When true: also runs the Validate stage before CI.
1513
# When false (PR / merge builds): only PreBuildCheck + CI run.
1614
#
1715
# Stage flow:
1816
#
19-
# runPublish: true → PreBuildCheck ─► Validate ─► CI ─► Build ─► PublishMSALPython
20-
# └─► PublishPyPI
21-
# runPublish: false → PreBuildCheck ─► CI (Validate / Build / Publish are skipped)
17+
# runPublish: true → PreBuildCheck ─► Validate ─► CI
18+
# runPublish: false → PreBuildCheck ─► CI (Validate is skipped)
19+
#
20+
# Build and Publish stages are defined in pipeline-publish.yml (not here),
21+
# so that the PR build never references PyPI service connections.
2222

2323
parameters:
2424
- name: packageVersion
2525
type: string
2626
default: ''
27-
- name: publishTarget
28-
type: string
29-
default: ''
3027
- name: runPublish
3128
type: boolean
3229
default: false
@@ -193,144 +190,3 @@ stages:
193190
- bash: rm -f "$(Agent.TempDirectory)/lab-auth.pfx"
194191
displayName: 'Clean up lab certificate'
195192
condition: always()
196-
197-
# ══════════════════════════════════════════════════════════════════════════════
198-
# Stage 3 · Build — build sdist + wheel (release only)
199-
# ══════════════════════════════════════════════════════════════════════════════
200-
- stage: Build
201-
displayName: 'Build package'
202-
dependsOn: CI
203-
condition: and(eq(dependencies.CI.result, 'Succeeded'), eq(${{ parameters.runPublish }}, true))
204-
jobs:
205-
- job: BuildDist
206-
displayName: 'Build sdist + wheel (Python 3.12)'
207-
pool:
208-
vmImage: ubuntu-latest
209-
steps:
210-
- task: UsePythonVersion@0
211-
inputs:
212-
versionSpec: '3.12'
213-
displayName: 'Use Python 3.12'
214-
215-
- script: |
216-
python -m pip install --upgrade pip build twine
217-
displayName: 'Install build toolchain'
218-
219-
- script: |
220-
python -m build
221-
displayName: 'Build sdist and wheel'
222-
223-
- script: |
224-
python -m twine check dist/*
225-
displayName: 'Verify distribution (twine check)'
226-
227-
- task: PublishPipelineArtifact@1
228-
displayName: 'Publish dist/ as pipeline artifact'
229-
inputs:
230-
targetPath: dist/
231-
artifact: python-dist
232-
233-
# ══════════════════════════════════════════════════════════════════════════════
234-
# Stage 4a · Publish to test.pypi.org (Preview / RC)
235-
# Runs when: runPublish is true AND publishTarget == 'test.pypi.org (Preview / RC)'
236-
# Note: requires MSAL-Test-Python-Upload SC in ADO (pending test.pypi.org token)
237-
# ══════════════════════════════════════════════════════════════════════════════
238-
- stage: PublishMSALPython
239-
displayName: 'Publish to test.pypi.org (Preview)'
240-
dependsOn: Build
241-
condition: >
242-
and(
243-
eq(dependencies.Build.result, 'Succeeded'),
244-
eq('${{ parameters.publishTarget }}', 'test.pypi.org (Preview / RC)')
245-
)
246-
jobs:
247-
- deployment: DeployMSALPython
248-
displayName: 'Upload to test.pypi.org'
249-
pool:
250-
vmImage: ubuntu-latest
251-
# Optional: add approval checks in ADO → Pipelines → Environments → MSAL-Python
252-
environment: MSAL-Python
253-
strategy:
254-
runOnce:
255-
deploy:
256-
steps:
257-
- task: DownloadPipelineArtifact@2
258-
displayName: 'Download python-dist artifact'
259-
inputs:
260-
artifactName: python-dist
261-
targetPath: $(Pipeline.Workspace)/python-dist
262-
263-
- task: UsePythonVersion@0
264-
inputs:
265-
versionSpec: '3.12'
266-
displayName: 'Use Python 3.12'
267-
268-
- script: |
269-
python -m pip install --upgrade pip
270-
python -m pip install twine
271-
displayName: 'Install twine'
272-
273-
- task: TwineAuthenticate@1
274-
displayName: 'Authenticate with MSAL-Test-Python-Upload'
275-
inputs:
276-
pythonUploadServiceConnection: MSAL-Test-Python-Upload
277-
278-
- script: |
279-
python -m twine upload \
280-
-r "MSAL-Test-Python-Upload" \
281-
--config-file $(PYPIRC_PATH) \
282-
--skip-existing \
283-
$(Pipeline.Workspace)/python-dist/*
284-
displayName: 'Upload to MSAL-Test-Python-Upload (skip existing)'
285-
286-
# ══════════════════════════════════════════════════════════════════════════════
287-
# Stage 4b · Publish to PyPI (ESRP Production)
288-
# Runs when: runPublish is true AND publishTarget == 'pypi.org (ESRP Production)'
289-
# ══════════════════════════════════════════════════════════════════════════════
290-
- stage: PublishPyPI
291-
displayName: 'Publish to PyPI (ESRP Production)'
292-
dependsOn: Build
293-
condition: >
294-
and(
295-
eq(dependencies.Build.result, 'Succeeded'),
296-
eq('${{ parameters.publishTarget }}', 'pypi.org (ESRP Production)')
297-
)
298-
jobs:
299-
- deployment: DeployPyPI
300-
displayName: 'Upload to pypi.org'
301-
pool:
302-
vmImage: ubuntu-latest
303-
# IMPORTANT: configure a required manual approval on this environment in
304-
# ADO → Pipelines → Environments → MSAL-Python-Release → Approvals and checks.
305-
environment: MSAL-Python-Release
306-
strategy:
307-
runOnce:
308-
deploy:
309-
steps:
310-
- task: DownloadPipelineArtifact@2
311-
displayName: 'Download python-dist artifact'
312-
inputs:
313-
artifactName: python-dist
314-
targetPath: $(Pipeline.Workspace)/python-dist
315-
316-
- task: UsePythonVersion@0
317-
inputs:
318-
versionSpec: '3.12'
319-
displayName: 'Use Python 3.12'
320-
321-
- script: |
322-
python -m pip install --upgrade pip
323-
python -m pip install twine
324-
displayName: 'Install twine'
325-
326-
- task: TwineAuthenticate@1
327-
displayName: 'Authenticate with MSAL-Prod-Python-Upload'
328-
inputs:
329-
pythonUploadServiceConnection: MSAL-Prod-Python-Upload
330-
331-
- script: |
332-
python -m twine upload \
333-
-r "MSAL-Prod-Python-Upload" \
334-
--config-file $(PYPIRC_PATH) \
335-
$(Pipeline.Workspace)/python-dist/*
336-
displayName: 'Upload to PyPI (ESRP Production)'

0 commit comments

Comments
 (0)