FEAT: add standalone conda build pipeline + build-validation tooling

OneBranchPipelines/jobs/consolidate-conda-artifacts-job.yml

@@ -0,0 +1,129 @@
+# Consolidate Conda Artifacts Job Template
+# Collects the per-platform self-contained mssql-python conda packages (which vendor
+# the ODBC payload) that each build leg staged under conda/<subdir>/ and gathers
+# them into a single conda/ tree for the release pipeline to publish.
+#
+# BEST-EFFORT (build pipeline): conda is a downstream repackage of the ESRP-signed
+# wheels and must NEVER block the primary wheel deliverable, so a missing/short set
+# only WARNS here. The HARD count gate lives in the release pipeline (which refuses
+# to publish an incomplete conda set), symmetric with how the wheel/odbc drops are
+# best-effort collected in the build and gated at release time.
+#
+# Expected packages (validated conda subdirs). The self-contained mssql-python
+# package (which vendors the ODBC payload) is emitted per-Python by each build leg;
+# there is NO separate companion package:
+#   win-64        : 5 py x mssql-python                                       = 5
+#   win-arm64     : 3 py x mssql-python  (py3.12-3.14, cross-built on x64)    = 3
+#   osx-64        : 5 py x mssql-python  (Intel Mac, cross-built via Rosetta) = 5
+#   osx-arm64     : 5 py x mssql-python  (Apple Silicon, native)              = 5
+#   linux-64      : 5 py x mssql-python  (glibc x86_64 host, native)          = 5
+#   linux-aarch64 : 5 py x mssql-python  (x86_64 host + QEMU, best-effort)    = 5
+#   ------------------------------------------------------------------------------
+#   TOTAL (PyPI parity minus musllinux)                                      = 28
+# win-arm64 is cross-built for py3.12-3.14 only (py3.10/3.11 have no win-arm64 deps
+# on Anaconda defaults); its runtime import is skipped on the x64 host, so its arch
+# is enforced by the PE-machine assert (assert_pe_machine.py). musllinux (no conda
+# musl subdir) is intentionally NOT conda-built. This job is BEST-EFFORT and never
+# hard-fails on a short set; the release pipeline's conda-release-step enforces the
+# hard gate (required subdirs present + complete Python matrix) before publish.
+parameters:
+  - name: oneBranchType
+    type: string
+    default: 'Official'
+  # Artifact item pattern the consolidate job downloads. Defaults to the integrated
+  # wheel-pipeline leg artifacts; the standalone conda-build pipeline overrides it with
+  # its drop_Conda* leg artifacts.
+  - name: downloadItemPattern
+    type: string
+    default: |
+      drop_Win_*/**
+      drop_MacOS_*/**
+      drop_Linux_*/**
+      drop_ODBC_BuildAll_*/**
+
+jobs:
+  - job: ConsolidateArtifacts
+    displayName: 'Consolidate All Conda Packages'
+    condition: succeeded()
+
+    pool:
+      type: linux
+      isCustom: true
+      name: Azure Pipelines
+      vmImage: 'ubuntu-latest'
+
+    variables:
+      # Consolidation only moves files; no binaries to scan.
+      - name: ob_sdl_binskim_enabled
+        value: false
+      - name: ob_outputDirectory
+        value: '$(Build.ArtifactStagingDirectory)'
+
+    steps:
+      - checkout: self
+        fetchDepth: 1
+
+      # The conda packages are staged INSIDE the mssql-python build-leg artifacts
+      # (drop_Win_*, drop_MacOS_*, drop_Linux_*) under conda/<subdir>/. Scope the
+      # download to those stages so every leg's self-contained mssql-python conda is
+      # gathered in one place. (drop_ODBC_BuildAll_* is included only for its wheels,
+      # which ride along and are ignored below -- we pick only *.conda / *.tar.bz2.)
+      - task: DownloadPipelineArtifact@2
+        displayName: 'Download All Platform Artifacts'
+        inputs:
+          buildType: 'current'
+          itemPattern: ${{ parameters.downloadItemPattern }}
+          targetPath: '$(Pipeline.Workspace)/all-artifacts'
+
+      - bash: |
+          set -e
+          echo "Collecting conda packages (preserving <subdir>/ layout)..."
+          mkdir -p $(ob_outputDirectory)/conda
+
+          # Copy every mssql-python* conda package into conda/<subdir>/. Each build
+          # leg wrote the self-contained mssql-python package under a conda/<subdir>/
+          # folder, so the parent dir name IS the target subdir.
+          found=0
+          while IFS= read -r p; do
+            subdir=$(basename "$(dirname "$p")")
+            mkdir -p "$(ob_outputDirectory)/conda/$subdir"
+            cp -v "$p" "$(ob_outputDirectory)/conda/$subdir/"
+            found=1
+          done < <(find $(Pipeline.Workspace)/all-artifacts -type f \( -name 'mssql-python*.conda' -o -name 'mssql-python*.tar.bz2' \))
+
+          echo ""
+          echo "Consolidated conda tree:"
+          find $(ob_outputDirectory)/conda -type f | sort
+
+          PKG_COUNT=$(find $(ob_outputDirectory)/conda -type f \( -name '*.conda' -o -name '*.tar.bz2' \) | wc -l)
+          echo ""
+          echo "Per-subdir conda package counts:"
+          for d in $(ob_outputDirectory)/conda/*/; do
+            [ -d "$d" ] || continue
+            sub=$(basename "$d")
+            n=$(find "$d" -type f \( -name '*.conda' -o -name '*.tar.bz2' \) | wc -l)
+            printf '  %-14s %s\n' "$sub" "$n"
+          done
+          echo "Total conda package count: $PKG_COUNT (full PyPI-parity set = 28)"
+
+          # BEST-EFFORT: warn only, never exit non-zero — a conda hiccup on any leg
+          # must not fail this build or block the wheel release. The release pipeline's
+          # conda-release-step enforces the hard gate (required subdirs + full Python
+          # matrix) before anything is published.
+          if [ "$found" != "1" ]; then
+            echo "##vso[task.logissue type=warning]No conda packages found in the build-leg artifacts."
+          else
+            echo "Collected $PKG_COUNT conda package(s) (best-effort; release-time gate enforces completeness)."
+          fi
+        displayName: 'Consolidate conda packages'
+
+      - task: PublishPipelineArtifact@1
+        displayName: 'Publish Consolidated Conda Artifacts'
+        inputs:
+          targetPath: '$(ob_outputDirectory)'
+          # Distinct name so it does not collide with the wheel consolidate artifact
+          # (drop_Consolidate_ConsolidateArtifacts) or the odbc one
+          # (drop_ConsolidateOdbc_ConsolidateArtifacts) in the same run. Matches the
+          # OneBranch auto-name for a stage named `ConsolidateConda`.
+          artifact: 'drop_ConsolidateConda_ConsolidateArtifacts'
+          publishLocation: 'pipeline'

OneBranchPipelines/scripts/.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf