Skip to content

Commit 5254163

Browse files
RyAuldRyAuld
committed
Restore two publish targets: Preview (test.pypi.org) and ESRP Production (pypi.org)
1 parent 60d4080 commit 5254163

2 files changed

Lines changed: 102 additions & 15 deletions

File tree

‎.Pipelines/pipeline-publish.yml‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,31 @@
33
# Release pipeline for the msal Python package — manually triggered only.
44
# Source: https://github.com/AzureAD/microsoft-authentication-library-for-python
55
#
6-
# Runs SDL security scans (PreBuildCheck) and the full test matrix (CI).
7-
# Package publishing is handled via the ESRP release path.
6+
# Publish targets:
7+
# test.pypi.org (Preview / RC) — preview releases via MSAL-Test-Python-Upload SC
8+
# (SC creation pending test.pypi.org API token)
9+
# pypi.org (ESRP Production) — production releases via ESRP
10+
#
811
# For one-time ADO setup, see ADO-PUBLISH-SETUP.md.
912

13+
parameters:
14+
- name: packageVersion
15+
displayName: 'Package version to publish (must match msal/sku.py, e.g. 1.36.0 or 1.36.0rc1)'
16+
type: string
17+
18+
- name: publishTarget
19+
displayName: 'Publish target'
20+
type: string
21+
values:
22+
- 'test.pypi.org (Preview / RC)'
23+
- 'pypi.org (ESRP Production)'
24+
1025
trigger: none # manual runs only — no automatic branch or tag triggers
1126
pr: none
1227

1328
stages:
1429
- template: template-pipeline-stages.yml
30+
parameters:
31+
packageVersion: ${{ parameters.packageVersion }}
32+
publishTarget: ${{ parameters.publishTarget }}
33+
runPublish: true

‎.Pipelines/template-pipeline-stages.yml‎

Lines changed: 81 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,33 @@
33
# Unified pipeline stages template for the msal Python package.
44
#
55
# Called from:
6-
# pipeline-publish.yml — release build (SDL scans + test matrix)
7-
# azure-pipelines.yml — PR gate and post-merge CI
6+
# pipeline-publish.yml — release build (runPublish: true)
7+
# azure-pipelines.yml — PR gate and post-merge CI (runPublish: false)
88
#
9-
# Package publishing is handled via the ESRP release path (not in this template).
9+
# Parameters:
10+
# packageVersion - Version to validate against msal/sku.py
11+
# Required when runPublish is true; unused otherwise.
12+
# publishTarget - 'test.pypi.org (Preview / RC)' or 'pypi.org (Pre-ESRP)'
13+
# Required when runPublish is true; unused otherwise.
14+
# runPublish - When true: also run Validate, Build, and Publish stages.
15+
# When false (PR / merge builds): only PreBuildCheck + CI run.
1016
#
1117
# Stage flow:
1218
#
13-
# PreBuildCheck ─► CI
19+
# runPublish: true → PreBuildCheck ─► Validate ─► CI ─► Build ─► PublishMSALPython
20+
# └─► PublishPyPI
21+
# runPublish: false → PreBuildCheck ─► CI (Validate / Build / Publish are skipped)
22+
23+
parameters:
24+
- name: packageVersion
25+
type: string
26+
default: ''
27+
- name: publishTarget
28+
type: string
29+
default: ''
30+
- name: runPublish
31+
type: boolean
32+
default: false
1433

1534
stages:
1635

@@ -53,12 +72,55 @@ stages:
5372
GdnBreakGdnToolPoliCheck: true
5473

5574
# ══════════════════════════════════════════════════════════════════════════════
56-
# Stage 1 · CI — run the full test matrix across all supported Python versions.
75+
# Stage 1 · Validate — verify packageVersion matches msal/sku.py __version__
76+
# Skipped when runPublish is false (PR / merge builds).
77+
# ══════════════════════════════════════════════════════════════════════════════
78+
- stage: Validate
79+
displayName: 'Validate version'
80+
dependsOn: PreBuildCheck
81+
condition: and(${{ parameters.runPublish }}, eq(dependencies.PreBuildCheck.result, 'Succeeded'))
82+
jobs:
83+
- job: ValidateVersion
84+
displayName: 'Check version matches source'
85+
pool:
86+
vmImage: ubuntu-latest
87+
steps:
88+
- task: UsePythonVersion@0
89+
inputs:
90+
versionSpec: '3.12'
91+
displayName: 'Set up Python'
92+
93+
- bash: |
94+
PARAM_VER="${{ parameters.packageVersion }}"
95+
SKU_VER=$(grep '__version__' msal/sku.py | sed 's/.*"\(.*\)".*/\1/')
96+
97+
if [ -z "$PARAM_VER" ]; then
98+
echo "##vso[task.logissue type=error]packageVersion is required. Enter the version to publish (must match msal/sku.py __version__)."
99+
exit 1
100+
elif [ "$PARAM_VER" != "$SKU_VER" ]; then
101+
echo "##vso[task.logissue type=error]Version mismatch: parameter '$PARAM_VER' != msal/sku.py '$SKU_VER'"
102+
echo "Update msal/sku.py __version__ to match the packageVersion parameter, or correct the parameter."
103+
exit 1
104+
else
105+
echo "Version validated: $PARAM_VER"
106+
fi
107+
displayName: 'Verify version parameter matches msal/sku.py'
108+
109+
# ══════════════════════════════════════════════════════════════════════════════
110+
# Stage 2 · CI — run the full test matrix across all supported Python versions.
111+
# Always runs. Waits for Validate when runPublish is true;
112+
# runs immediately when Validate is skipped (PR / merge builds).
57113
# ══════════════════════════════════════════════════════════════════════════════
58114
- stage: CI
59115
displayName: 'Run tests'
60-
dependsOn: PreBuildCheck
61-
condition: eq(dependencies.PreBuildCheck.result, 'Succeeded')
116+
dependsOn:
117+
- PreBuildCheck
118+
- Validate
119+
condition: |
120+
and(
121+
eq(dependencies.PreBuildCheck.result, 'Succeeded'),
122+
in(dependencies.Validate.result, 'Succeeded', 'Skipped')
123+
)
62124
jobs:
63125
- job: Test
64126
displayName: 'Run unit tests'
@@ -130,7 +192,12 @@ stages:
130192

131193
- bash: rm -f "$(Agent.TempDirectory)/lab-auth.pfx"
132194
displayName: 'Clean up lab certificate'
133-
condition: and(always(), ne(variables['LAB_APP_CLIENT_ID'], ''))
195+
condition: always()
196+
197+
# ══════════════════════════════════════════════════════════════════════════════
198+
# Stage 3 · Build — build sdist + wheel (release only)
199+
# ══════════════════════════════════════════════════════════════════════════════
200+
- stage: Build
134201
displayName: 'Build package'
135202
dependsOn: CI
136203
condition: and(eq(dependencies.CI.result, 'Succeeded'), eq(${{ parameters.runPublish }}, true))
@@ -166,6 +233,7 @@ stages:
166233
# ══════════════════════════════════════════════════════════════════════════════
167234
# Stage 4a · Publish to test.pypi.org (Preview / RC)
168235
# Runs when: runPublish is true AND publishTarget == 'test.pypi.org (Preview / RC)'
236+
# Note: requires MSAL-Test-Python-Upload SC in ADO (pending test.pypi.org token)
169237
# ══════════════════════════════════════════════════════════════════════════════
170238
- stage: PublishMSALPython
171239
displayName: 'Publish to test.pypi.org (Preview)'
@@ -216,16 +284,16 @@ stages:
216284
displayName: 'Upload to MSAL-Test-Python-Upload (skip existing)'
217285
218286
# ══════════════════════════════════════════════════════════════════════════════
219-
# Stage 4b · Publish to PyPI (Production)
220-
# Runs when: runPublish is true AND publishTarget == 'pypi.org (Production)'
287+
# Stage 4b · Publish to PyPI (ESRP Production)
288+
# Runs when: runPublish is true AND publishTarget == 'pypi.org (ESRP Production)'
221289
# ══════════════════════════════════════════════════════════════════════════════
222290
- stage: PublishPyPI
223-
displayName: 'Publish to PyPI (Production)'
291+
displayName: 'Publish to PyPI (ESRP Production)'
224292
dependsOn: Build
225293
condition: >
226294
and(
227295
eq(dependencies.Build.result, 'Succeeded'),
228-
eq('${{ parameters.publishTarget }}', 'pypi.org (Production)')
296+
eq('${{ parameters.publishTarget }}', 'pypi.org (ESRP Production)')
229297
)
230298
jobs:
231299
- deployment: DeployPyPI
@@ -265,4 +333,4 @@ stages:
265333
-r "MSAL-Prod-Python-Upload" \
266334
--config-file $(PYPIRC_PATH) \
267335
$(Pipeline.Workspace)/python-dist/*
268-
displayName: 'Upload to MSAL-Prod-Python-Upload'
336+
displayName: 'Upload to PyPI (ESRP Production)'

0 commit comments

Comments
 (0)