CHORE: Add OneBranch release pipelines for mssql-python-odbc

OneBranchPipelines/build-release-odbc-pipeline.yml

@@ -0,0 +1,210 @@
+# =========================================================================================
+# OneBranch Build Pipeline for mssql-python-odbc
+# =========================================================================================
+# Builds the standalone ODBC driver-binary package `mssql-python-odbc`.
+#
+# This package ships ONLY the Microsoft ODBC Driver 18 binaries as data. There is
+# NO compiled Python extension, so every wheel is tagged `py3-none-<platform>` and a
+# SINGLE build per platform covers all supported Python versions (3.10+). That is why
+# this pipeline has NO per-Python-version matrix (unlike mssql-python) and produces
+# only 7 wheels total:
+#   - Windows: x64, arm64
+#   - macOS:   universal2
+#   - Linux:   manylinux_2_28 (x86_64, aarch64), musllinux_1_2 (x86_64, aarch64)
+#
+# Publishing to PyPI is handled by the companion official-release-odbc-pipeline.yml
+# using the SAME shared ESRP identity (variable group 'ESRP Federated Creds (AME)').
+#
+# INFRA PREREQUISITES (see companion release pipeline for the definition ID):
+#   - Register this YAML as a new ADO build definition (e.g. 'Build-Release-ODBC-Pipeline').
+#   - Share the 'ESRP Federated Creds (AME)' variable group with the new pipeline.
+#   - Ensure the reused pools/images are available: Python-1ES-pool
+#     (PYTHON-1ES-MMS2022 for Windows, PYTHON-1ES-UB2404 for Linux) and the
+#     'Magnitude Test-mssql-rs-mssql-python' Azure subscription for ACR login.
+# =========================================================================================
+
+# Build number format: YYDDD.r
+name: $(Year:YY)$(DayOfYear)$(Rev:.r)
+
+# Only trigger when ODBC-package inputs change (path filters are literal prefixes,
+# not globs, in Azure DevOps). Unrelated mssql-python commits do not rebuild this.
+trigger:
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - setup_odbc.py
+      - mssql_python_odbc
+      - mssql_python/libs
+      - OneBranchPipelines/build-release-odbc-pipeline.yml
+      - OneBranchPipelines/stages/build-odbc-windows-stage.yml
+      - OneBranchPipelines/stages/build-odbc-macos-stage.yml
+      - OneBranchPipelines/stages/build-odbc-linux-stage.yml
+      - OneBranchPipelines/jobs/consolidate-odbc-artifacts-job.yml
+
+pr:
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - setup_odbc.py
+      - mssql_python_odbc
+      - mssql_python/libs
+      - OneBranchPipelines/build-release-odbc-pipeline.yml
+      - OneBranchPipelines/stages/build-odbc-windows-stage.yml
+      - OneBranchPipelines/stages/build-odbc-macos-stage.yml
+      - OneBranchPipelines/stages/build-odbc-linux-stage.yml
+      - OneBranchPipelines/jobs/consolidate-odbc-artifacts-job.yml
+
+parameters:
+  - name: oneBranchType
+    displayName: 'OneBranch Template Type'
+    type: string
+    values:
+      - 'Official'
+      - 'NonOfficial'
+    default: 'NonOfficial'
+
+  - name: runSdlTasks
+    displayName: 'Run SDL Security Tasks'
+    type: boolean
+    default: true
+
+  # Windows: one wheel per architecture (NO per-Python matrix).
+  - name: odbcWindowsConfigs
+    type: object
+    default:
+      - arch: 'x64'
+      - arch: 'arm64'
+
+  # macOS: single universal2 wheel.
+  - name: odbcMacosConfigs
+    type: object
+    default:
+      - name: 'universal2'
+
+  # Linux: one wheel per libc/arch combo.
+  - name: odbcLinuxConfigs
+    type: object
+    default:
+      - { tag: 'manylinux_2_28', arch: 'x86_64', platform: 'linux/amd64' }
+      - { tag: 'manylinux_2_28', arch: 'aarch64', platform: 'linux/arm64' }
+      - { tag: 'musllinux', arch: 'x86_64', platform: 'linux/amd64' }
+      - { tag: 'musllinux', arch: 'aarch64', platform: 'linux/arm64' }
+
+variables:
+  # Scheduled builds run as Official; manual/PR builds use the parameter.
+  - name: effectiveOneBranchType
+    ${{ if eq(variables['Build.Reason'], 'Schedule') }}:
+      value: 'Official'
+    ${{ else }}:
+      value: '${{ parameters.oneBranchType }}'
+
+  - template: /OneBranchPipelines/variables/common-variables.yml@self
+  - template: /OneBranchPipelines/variables/onebranch-variables.yml@self
+  # Maps 'ESRP Federated Creds (AME)' group vars to the Signing* names used by the
+  # per-stage EsrpMalwareScanning tasks.
+  - template: /OneBranchPipelines/variables/signing-variables.yml@self
+  - group: 'ESRP Federated Creds (AME)'
+
+resources:
+  repositories:
+    - repository: templates
+      type: git
+      name: 'OneBranch.Pipelines/GovernedTemplates'
+      ref: 'refs/heads/main'
+
+extends:
+  template: 'v2/OneBranch.${{ variables.effectiveOneBranchType }}.CrossPlat.yml@templates'
+
+  parameters:
+    featureFlags:
+      WindowsHostVersion:
+        Version: '2022'
+
+    globalSdl:
+      baseline:
+        baselineFile: $(Build.SourcesDirectory)/.gdn/.gdnbaselines
+        suppressionSet: default
+      suppression:
+        suppressionFile: $(Build.SourcesDirectory)/.gdn/.gdnsuppress
+        suppressionSet: default
+
+      # This pipeline compiles NO first-party native code — it only packages the
+      # pre-built ODBC driver binaries, which are signed and governed by the Microsoft
+      # ODBC Driver team's own SDL. Native/binary analyzers are therefore disabled here;
+      # every wheel is still malware-scanned per stage (EsrpMalwareScanning@5).
+      binskim:
+        enabled: false
+        justificationForDisabling: 'No first-party native code is built here; the packaged ODBC driver binaries are pre-built/pre-signed and covered by the ODBC Driver team SDL. Wheels are malware-scanned per stage.'
+      apiscan:
+        enabled: false
+        justificationForDisabling: 'No first-party native binaries are produced by this pipeline.'
+      armory:
+        enabled: false
+      codeql:
+        enabled: false
+        justificationForDisabling: 'This pipeline only packages pre-built driver binaries; no first-party source is compiled.'
+
+      credscan:
+        enabled: ${{ parameters.runSdlTasks }}
+      policheck:
+        enabled: ${{ parameters.runSdlTasks }}
+        break: true
+        exclusionFile: '$(REPO_ROOT)/.config/PolicheckExclusions.xml'
+      publishLogs:
+        enabled: ${{ parameters.runSdlTasks }}
+      sbom:
+        enabled: ${{ parameters.runSdlTasks }}
+        packageName: 'mssql-python-odbc'
+      tsa:
+        enabled: ${{ and(eq(variables.effectiveOneBranchType, 'Official'), parameters.runSdlTasks) }}
+        configFile: '$(REPO_ROOT)/.config/tsaoptions.json'
+
+    stages:
+      # WINDOWS BUILD STAGES (2: x64, arm64)
+      - ${{ each config in parameters.odbcWindowsConfigs }}:
+          - template: /OneBranchPipelines/stages/build-odbc-windows-stage.yml@self
+            parameters:
+              stageName: ODBC_Win_${{ config.arch }}
+              jobName: BuildWheel
+              architecture: ${{ config.arch }}
+              oneBranchType: '${{ variables.effectiveOneBranchType }}'
+
+      # MACOS BUILD STAGE (1: universal2)
+      - ${{ each config in parameters.odbcMacosConfigs }}:
+          - template: /OneBranchPipelines/stages/build-odbc-macos-stage.yml@self
+            parameters:
+              stageName: ODBC_MacOS_${{ config.name }}
+              jobName: BuildWheel
+              oneBranchType: '${{ variables.effectiveOneBranchType }}'
+
+      # LINUX BUILD STAGES (4: manylinux/musllinux x x86_64/aarch64)
+      - ${{ each config in parameters.odbcLinuxConfigs }}:
+          - template: /OneBranchPipelines/stages/build-odbc-linux-stage.yml@self
+            parameters:
+              stageName: ODBC_Linux_${{ config.tag }}_${{ config.arch }}
+              jobName: BuildWheel
+              linuxTag: ${{ config.tag }}
+              arch: ${{ config.arch }}
+              dockerPlatform: ${{ config.platform }}
+              oneBranchType: '${{ variables.effectiveOneBranchType }}'
+
+      # CONSOLIDATE STAGE (waits for all 7 platform stages)
+      - stage: Consolidate
+        displayName: 'Consolidate All ODBC Artifacts'
+        dependsOn:
+          - ODBC_Win_x64
+          - ODBC_Win_arm64
+          - ODBC_MacOS_universal2
+          - ODBC_Linux_manylinux_2_28_x86_64
+          - ODBC_Linux_manylinux_2_28_aarch64
+          - ODBC_Linux_musllinux_x86_64
+          - ODBC_Linux_musllinux_aarch64
+        jobs:
+          - template: /OneBranchPipelines/jobs/consolidate-odbc-artifacts-job.yml@self
+            parameters:
+              oneBranchType: '${{ variables.effectiveOneBranchType }}'
+              expectedWheelCount: 7

OneBranchPipelines/jobs/consolidate-odbc-artifacts-job.yml

@@ -0,0 +1,68 @@
+# Consolidate ODBC Artifacts Job Template
+# Downloads the per-platform `mssql-python-odbc` wheels from all build stages and
+# consolidates them into a single dist/ folder for the release pipeline to publish.
+# Expected: 7 wheels (2 Windows + 1 macOS universal2 + 4 Linux).
+parameters:
+  - name: oneBranchType
+    type: string
+    default: 'Official'
+  - name: expectedWheelCount
+    type: number
+    default: 7
+
+jobs:
+  - job: ConsolidateArtifacts
+    displayName: 'Consolidate All ODBC Platform Artifacts'
+    condition: succeeded()
+
+    pool:
+      type: linux
+      isCustom: true
+      name: Azure Pipelines
+      vmImage: 'ubuntu-latest'
+
+    variables:
+      # Consolidation only moves files; no binaries to scan.
+      - name: ob_sdl_binskim_enabled
+        value: false
+      - name: ob_outputDirectory
+        value: '$(Build.ArtifactStagingDirectory)'
+
+    steps:
+      - checkout: self
+        fetchDepth: 1
+
+      # Download ALL artifacts from the current build (one per platform stage).
+      - task: DownloadPipelineArtifact@2
+        displayName: 'Download All ODBC Platform Artifacts'
+        inputs:
+          buildType: 'current'
+          targetPath: '$(Pipeline.Workspace)/all-artifacts'
+
+      - bash: |
+          set -e
+          mkdir -p $(ob_outputDirectory)/dist
+
+          echo "Finding all .whl files..."
+          find $(Pipeline.Workspace)/all-artifacts -name "*.whl" -exec ls -lh {} \;
+
+          echo "Copying all wheels to consolidated dist/..."
+          find $(Pipeline.Workspace)/all-artifacts -name "*.whl" -exec cp -v {} $(ob_outputDirectory)/dist/ \;
+
+          echo "Consolidated wheels:"
+          ls -lh $(ob_outputDirectory)/dist/
+          WHEEL_COUNT=$(ls -1 $(ob_outputDirectory)/dist/*.whl 2>/dev/null | wc -l)
+          echo "Total wheel count: $WHEEL_COUNT (expected ${{ parameters.expectedWheelCount }})"
+          if [ "$WHEEL_COUNT" -ne "${{ parameters.expectedWheelCount }}" ]; then
+            echo "WARNING: expected ${{ parameters.expectedWheelCount }} wheels but found $WHEEL_COUNT"
+          else
+            echo "SUCCESS: all ${{ parameters.expectedWheelCount }} ODBC wheels consolidated."
+          fi
+        displayName: 'Consolidate ODBC wheels'
+
+      - task: PublishPipelineArtifact@1
+        displayName: 'Publish Consolidated ODBC Artifacts'
+        inputs:
+          targetPath: '$(ob_outputDirectory)'
+          artifact: 'drop_Consolidate_ConsolidateArtifacts'
+          publishLocation: 'pipeline'