Add OneBranch pipeline templates for CI and Release by RyAuld · Pull Request #925 · AzureAD/microsoft-authentication-library-for-python

RyAuld · 2026-06-08T21:44:00Z

Summary

Wraps existing CI and release pipelines with OneBranch pipeline templates for compliance (SDL, TSA, CodeQL).

Changes

azure-pipelines.yml: Extended with v2/OneBranch.NonOfficial.CrossPlat.yml template. Added globalSdl config for CredScan, PoliCheck, CodeQL (Python). Converted Benchmark stage to OneBranch pool syntax.
.Pipelines/pipeline-publish.yml: Extended with v2/OneBranch.Official.CrossPlat.yml template. Added ManualValidation approval gate. Includes ESRP client ID fix. Converted deployment job to regular job (OneBranch compatibility).
.Pipelines/template-pipeline-stages.yml: Removed explicit PreBuildCheck/SDL stage (handled by OneBranch globalSdl). Converted pools to OneBranch syntax (type: linux, isCustom: true, ubuntu-22.04). Added ob_outputDirectory variable to all jobs.
.config/tsaoptions.json: New file required for OneBranch TSA (security scan results upload).

ADO Pipeline Changes

Disabled reportBuildStatus on redundant pipelines (2708, 769, 3067) so only MSAL.Python-PR-OneBranch-Official (3064) reports PR status.
Registered pipeline 3067 in Product Catalog as Production (required by OneBranch Official template).
Disabled MSAL-Python-SDL-CI (769) - classic pipeline running CredScan, PoliCheck, Component Detection, and SBOM. All of these are now handled by OneBranch globalSdl and auto-injected tasks.

Validation

CI build passed: https://dev.azure.com/IdentityDivision/IDDP/_build/results?buildId=1647358
Publish build passed (test.pypi stage expected failure - no SC): https://dev.azure.com/IdentityDivision/IDDP/_build/results?buildId=1647357

- azure-pipelines.yml: extends v2/OneBranch.NonOfficial.CrossPlat.yml - pipeline-publish.yml: extends v2/OneBranch.Official.CrossPlat.yml - template-pipeline-stages.yml: remove PreBuildCheck stage (SDL now via globalSdl), convert pools to OneBranch syntax (type: linux, isCustom, ob_outputDirectory) OneBranch provides: TSA, CredScan, PoliCheck, CodeQL (Python), and compliance tracking. Release pipeline adds ManualValidation@1 approval gate before ESRP publish. Also includes ESRP client ID fix (38d4 -> 384d). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Rename PublishPipelineArtifact artifacts to drop_<stage>_<job> convention - Add default values for packageVersion and publishTarget parameters - Fixes pipeline queue validation errors Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

OneBranch custom Linux pools don't support deployment strategy (runOnce). Convert to a regular job with explicit artifact download. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Required by OneBranch SDL pipeline to upload security scan results to TSA. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

1ES PT requires 1ES Hosted Pools for Official templates. Remove isCustom/vmImage and let OneBranch manage pool selection with just 'type: linux'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

OneBranch auto-publishes artifacts from ob_outputDirectory at job end. Explicit PublishPipelineArtifact tasks are not allowed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Without isCustom, OneBranch tries to run in a container using LinuxContainerImage variable which isn't configured. isCustom: true tells OneBranch to use MS-hosted agents directly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR migrates the repository’s Azure DevOps CI and release pipelines to OneBranch governed templates to meet compliance requirements (SDL/TSA/CodeQL), while preserving the existing test/build/publish flow.

Changes:

Wraps CI and release pipelines using OneBranch v2 governed templates and configures globalSdl (CredScan, PoliCheck, CodeQL + TSA upload).
Refactors shared stages template to remove the bespoke SDL stage and updates pools/jobs to OneBranch-compatible syntax (including ob_outputDirectory).
Adds .config/tsaoptions.json required for OneBranch TSA integration.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
azure-pipelines.yml	Switches PR/CI to OneBranch NonOfficial template and updates Benchmark stage to OneBranch pool/output patterns.
.Pipelines/template-pipeline-stages.yml	Removes explicit SDL stage (now handled by OneBranch), updates pool syntax, and adds `ob_outputDirectory` per job.
.Pipelines/pipeline-publish.yml	Switches release pipeline to OneBranch Official template, adds an explicit approval stage for prod, and adapts build/publish to OneBranch artifact/output conventions.
.config/tsaoptions.json	Introduces OneBranch TSA options configuration for security results upload.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Resolve merge conflict (keep OneBranch rewrite, ESRP fix unchanged) - Remove packageVersion default to force explicit input on each release - Pin vmImage to ubuntu-22.04 for reproducibility Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

RyAuld · 2026-06-08T22:07:50Z

Addressed all review comments in latest push:

packageVersion default removed - no longer hardcoded. Validate stage will force explicit input on each release.
Pinned ubuntu-22.04 across all jobs in template-pipeline-stages.yml, pipeline-publish.yml, and azure-pipelines.yml for reproducibility.

Also resolved merge conflict with dev (ESRP fix already present in our branch) and disabled reportBuildStatus on the old/redundant pipelines (2708, 769, 3067) so only the PR pipeline reports status.

Avery-Dunn · 2026-06-08T22:54:00Z

+          enabled: false
+        interpretedLanguages: python
+        tsaEnabled: true
+    featureFlags:


There was an SFI item we had to handle earlier this year that request 1ES approved build agents through the WindowsHostVersion: '1ESWindows2022' feature flag:

https://identitydivision.visualstudio.com/IDDP/_git/MSAL.NET-OneBranch?path=/.pipelines/OneBranch.Official.yml&version=GBmain&line=70&lineEnd=71&lineStartColumn=1&lineEndColumn=1&lineStyle=plain&_a=contents

https://identitydivision.visualstudio.com/IDDP/_git/MSAL.NET-OneBranch/pullrequest/22988

Without it we might get a new SFI item, though I'm not sure because it might've been because MSAL .NET was explicitly using custom build agents in some stages.

What is the recommended version for Linux?

I looked into the docs and I don't think this is a hard requirement. It also locks you into a specific image version. I'd like to merge as-is and see if it produces a warning like the Windows version did. It may only be required for Windows agents since that's where the SFI item originated.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

RyAuld and others added 8 commits June 5, 2026 13:50

fix: use root-relative path for template reference in publish pipeline

f7d3d09

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix: convert deployment job to regular job for OneBranch compatibility

10c382e

OneBranch custom Linux pools don't support deployment strategy (runOnce). Convert to a regular job with explicit artifact download. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

add .config/tsaoptions.json for OneBranch TSA upload

75a24ca

Required by OneBranch SDL pipeline to upload security scan results to TSA. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix: remove isCustom pool config, use OneBranch managed pools

336d744

1ES PT requires 1ES Hosted Pools for Official templates. Remove isCustom/vmImage and let OneBranch manage pool selection with just 'type: linux'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix: replace PublishPipelineArtifact with ob_outputDirectory copy

d57526d

OneBranch auto-publishes artifacts from ob_outputDirectory at job end. Explicit PublishPipelineArtifact tasks are not allowed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

RyAuld requested a review from a team as a code owner June 8, 2026 21:44

Copilot AI review requested due to automatic review settings June 8, 2026 21:44

Copilot started reviewing on behalf of RyAuld June 8, 2026 21:44 View session

Copilot AI reviewed Jun 8, 2026

View reviewed changes

Comment thread .Pipelines/pipeline-publish.yml Outdated

Comment thread .Pipelines/template-pipeline-stages.yml

Comment thread .Pipelines/template-pipeline-stages.yml

RyAuld added 2 commits June 8, 2026 15:43

retrigger CI

645c76d

retrigger CI

8f52f9f

Avery-Dunn reviewed Jun 8, 2026

View reviewed changes

Comment thread .Pipelines/pipeline-publish.yml

Add debug parameter for system.debug verbose logging

0fac0d3

Copilot AI review requested due to automatic review settings June 8, 2026 22:53

Copilot started reviewing on behalf of RyAuld June 8, 2026 22:53 View session

Avery-Dunn reviewed Jun 8, 2026

View reviewed changes

Copilot AI reviewed Jun 8, 2026

View reviewed changes

Comment thread .Pipelines/pipeline-publish.yml Outdated

Comment thread azure-pipelines.yml

Comment thread .Pipelines/pipeline-publish.yml

Fix packageVersion default: use empty string instead of space

2a101f1

Avery-Dunn reviewed Jun 8, 2026

View reviewed changes

Comment thread .Pipelines/template-pipeline-stages.yml

Add PostAnalysis task to break build on PoliCheck failures

c1f0ea7

Copilot AI review requested due to automatic review settings June 8, 2026 23:39

Copilot started reviewing on behalf of RyAuld June 8, 2026 23:39 View session

Copilot AI reviewed Jun 8, 2026

View reviewed changes

Comment thread .Pipelines/template-pipeline-stages.yml

Comment thread .Pipelines/pipeline-publish.yml

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OneBranch pipeline templates for CI and Release#925

Add OneBranch pipeline templates for CI and Release#925
RyAuld wants to merge 14 commits into
devfrom
ryauld/onebranch-pipelines

RyAuld commented Jun 8, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RyAuld commented Jun 8, 2026

Uh oh!

Uh oh!

Avery-Dunn Jun 8, 2026 •

edited

Loading

Uh oh!

RyAuld Jun 8, 2026

Uh oh!

RyAuld Jun 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

RyAuld commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

ADO Pipeline Changes

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RyAuld commented Jun 8, 2026

Uh oh!

Uh oh!

Avery-Dunn Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

RyAuld Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

RyAuld Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

RyAuld commented Jun 8, 2026 •

edited

Loading

Avery-Dunn Jun 8, 2026 •

edited

Loading