Skip to content

Commit ca15513

Browse files
4gust4gust
committed
python version parallel tests
1 parent 97e7bfb commit ca15513

2 files changed

Lines changed: 235 additions & 174 deletions

File tree

‎.Pipelines/pipeline-release.yml‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
# ADO release pipeline for the msal Python package.
2+
#
3+
# Mirrors the GitHub CD flow in .github/workflows/python-package.yml (the `cd:` job):
4+
# - push to a `release-*` branch → publish to TestPyPI
5+
# - push of a tag (e.g. `1.36.0`) → publish to PyPI (with manual approval)
6+
#
7+
# Secrets are fetched at run time from Key Vault `msidlabs` via the
8+
# `AuthSdkResourceManager` service connection (same pattern as the lab cert in
9+
# pipeline-unit-tests.yml). Required Key Vault secrets:
10+
# - TestPyPiApiToken → TestPyPI API token (starts with `pypi-`)
11+
# - PyPiApiToken → PyPI API token (starts with `pypi-`)
12+
#
13+
# Required ADO setup before first run:
14+
# 1. Add the two secrets above to the `msidlabs` Key Vault.
15+
# 2. Authorize the `AuthSdkResourceManager` SC for this pipeline (one-time
16+
# "Permit" prompt on the first run).
17+
# 3. Create an Environment named `msal-py-pypi` with a required approver
18+
# (ADO → Pipelines → Environments → New environment → Approvals and checks).
19+
20+
trigger:
21+
branches:
22+
include:
23+
- release-*
24+
tags:
25+
include:
26+
- '*'
27+
28+
pr: none
29+
30+
variables:
31+
- name: pythonBuildVersion
32+
value: '3.12'
33+
34+
stages:
35+
36+
# ─────────────────────────────────────────────────────────────────────────────
37+
# Stage 1 · Build sdist + wheel, publish as a pipeline artifact.
38+
# ─────────────────────────────────────────────────────────────────────────────
39+
- stage: Build
40+
displayName: 'Build'
41+
jobs:
42+
- job: BuildDist
43+
displayName: 'sdist + wheel'
44+
pool:
45+
vmImage: ubuntu-22.04
46+
steps:
47+
- task: UsePythonVersion@0
48+
displayName: 'Use Python $(pythonBuildVersion)'
49+
inputs:
50+
versionSpec: $(pythonBuildVersion)
51+
52+
- bash: |
53+
set -euo pipefail
54+
python -m pip install --upgrade pip build twine
55+
python -m build --sdist --wheel --outdir dist/ .
56+
python -m twine check dist/*
57+
ls -la dist/
58+
displayName: 'Build + twine check'
59+
60+
- task: PublishPipelineArtifact@1
61+
displayName: 'Publish dist/ as pipeline artifact'
62+
inputs:
63+
targetPath: dist/
64+
artifact: python-dist
65+
66+
# ─────────────────────────────────────────────────────────────────────────────
67+
# Stage 2a · Publish to TestPyPI — runs on push to a release-* branch.
68+
# No approval gate (matches GitHub flow today).
69+
# ─────────────────────────────────────────────────────────────────────────────
70+
- stage: PublishTestPyPI
71+
displayName: 'Publish to TestPyPI'
72+
dependsOn: Build
73+
condition: |
74+
and(
75+
succeeded(),
76+
startsWith(variables['Build.SourceBranch'], 'refs/heads/release-')
77+
)
78+
jobs:
79+
- job: Upload
80+
displayName: 'twine upload → test.pypi.org'
81+
pool:
82+
vmImage: ubuntu-22.04
83+
steps:
84+
- checkout: none
85+
86+
- task: DownloadPipelineArtifact@2
87+
displayName: 'Download dist/ artifact'
88+
inputs:
89+
artifactName: python-dist
90+
targetPath: dist/
91+
92+
- task: UsePythonVersion@0
93+
displayName: 'Use Python $(pythonBuildVersion)'
94+
inputs:
95+
versionSpec: $(pythonBuildVersion)
96+
97+
- task: AzureKeyVault@2
98+
displayName: 'Fetch TestPyPI API token from Key Vault'
99+
inputs:
100+
azureSubscription: 'AuthSdkResourceManager'
101+
KeyVaultName: 'msidlabs'
102+
SecretsFilter: 'TestPyPiApiToken'
103+
RunAsPreJob: false
104+
105+
- bash: |
106+
set -euo pipefail
107+
python -m pip install --upgrade pip twine
108+
python -m twine upload \
109+
--repository-url https://test.pypi.org/legacy/ \
110+
--username __token__ \
111+
--password "$TWINE_PASSWORD" \
112+
--skip-existing \
113+
dist/*
114+
displayName: 'twine upload → test.pypi.org'
115+
env:
116+
TWINE_PASSWORD: $(TestPyPiApiToken)
117+
118+
# ─────────────────────────────────────────────────────────────────────────────
119+
# Stage 2b · Publish to PyPI — runs on push of a tag.
120+
# Manual approval enforced via the `msal-py-pypi` Environment.
121+
# ─────────────────────────────────────────────────────────────────────────────
122+
- stage: PublishPyPI
123+
displayName: 'Publish to PyPI'
124+
dependsOn: Build
125+
condition: |
126+
and(
127+
succeeded(),
128+
startsWith(variables['Build.SourceBranch'], 'refs/tags/')
129+
)
130+
jobs:
131+
- deployment: Upload
132+
displayName: 'twine upload → pypi.org'
133+
pool:
134+
vmImage: ubuntu-22.04
135+
environment: 'msal-py-pypi'
136+
strategy:
137+
runOnce:
138+
deploy:
139+
steps:
140+
- task: DownloadPipelineArtifact@2
141+
displayName: 'Download dist/ artifact'
142+
inputs:
143+
artifactName: python-dist
144+
targetPath: dist/
145+
146+
- task: UsePythonVersion@0
147+
displayName: 'Use Python $(pythonBuildVersion)'
148+
inputs:
149+
versionSpec: $(pythonBuildVersion)
150+
151+
- task: AzureKeyVault@2
152+
displayName: 'Fetch PyPI API token from Key Vault'
153+
inputs:
154+
azureSubscription: 'AuthSdkResourceManager'
155+
KeyVaultName: 'msidlabs'
156+
SecretsFilter: 'PyPiApiToken'
157+
RunAsPreJob: false
158+
159+
- bash: |
160+
set -euo pipefail
161+
python -m pip install --upgrade pip twine
162+
python -m twine upload \
163+
--username __token__ \
164+
--password "$TWINE_PASSWORD" \
165+
dist/*
166+
displayName: 'twine upload → pypi.org'
167+
env:
168+
TWINE_PASSWORD: $(PyPiApiToken)

0 commit comments

Comments
 (0)