Repository navigation
Publish mobius releases through ESRP - #808
Merged
Merged
Conversation
Add 1ES Official build and publish pipelines using the configured ESRP managed identity and AIFrameworks publisher. Consume the successful official build artifacts instead of rebuilding for publication. Remove direct GitHub PyPI publishing and document Azure DevOps onboarding, authorization, approvals, and release procedures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Justin Chu <justinchuby@users.noreply.github.com>
Performance Comparison
|
Keep the ESRP pull request focused on pipeline configuration as requested. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Justin Chu <justinchuby@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Private 1ES template expansion, artifact handoff, production approval enforcement, and ESRP/PyPI authorization remain unvalidated and require an end-to-end Azure DevOps release check before cutover.
No open issues 🎉
What changed in this PR
Moves mobius-onnx release publishing from GitHub Actions to Azure DevOps, using 1ES Official pipelines to build distributions and ESRP to publish them to PyPI.
Changes:
- Adds tag-triggered and manual release builds with distribution metadata and wheel installation checks.
- Adds an ESRP publishing pipeline that consumes release artifacts behind production environment checks.
- Removes direct GitHub Actions publishing and documents provisioning, authorization, and release procedures.
Hosted template expansion and ESRP publication remain unvalidated pending Azure DevOps provisioning.
| File | Description |
|---|---|
CONTRIBUTING.md |
Documents Azure DevOps setup, permissions, and release procedures. |
.github/workflows/publish.yml |
Removes direct PyPI publishing through GitHub Actions. |
.azure-pipelines/release.yml |
Builds, validates, and stages wheel and source distributions. |
.azure-pipelines/publish.yml |
Submits release artifacts to ESRP after production environment checks. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v*tags or manual runs, verify distribution metadata, and check wheel installation.ESRPCodeSignmanaged-identity settings andAIFrameworkspublisher.Implementation notes
https://api.esrp.microsoft.comand limits the ESRP input to the downloaded distribution directory.Validation
git diff --checkpasses.