From 76ce6c0736b9a4c5dbc26a52141381d485e463ef Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Wed, 2 Sep 2026 15:49:30 +0100 Subject: [PATCH 1/2] Move the Arm64 PGO VM to a new resource group --- windows-release/start-arm64vm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows-release/start-arm64vm.yml b/windows-release/start-arm64vm.yml index eb83b2d0..94d1e3af 100644 --- a/windows-release/start-arm64vm.yml +++ b/windows-release/start-arm64vm.yml @@ -21,7 +21,7 @@ jobs: inlineScript: | $ErrorActionPreference = 'Stop' - $rg = 'cpythonbuild' + $rg = 'pythonarm64' $vm = 'pythonarm64' # Compute UTC time minus 12 hours, format HHmm (e.g. 1830) From 500546988e0118d6f45a7658f9a4e42525c27214 Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Wed, 2 Sep 2026 16:46:09 +0100 Subject: [PATCH 2/2] Added to README and added parameters --- windows-release/README.md | 75 +++++++++++++++++++++++++++++++ windows-release/start-arm64vm.yml | 19 ++++---- 2 files changed, 86 insertions(+), 8 deletions(-) diff --git a/windows-release/README.md b/windows-release/README.md index 4fd307df..a8ff8a01 100644 --- a/windows-release/README.md +++ b/windows-release/README.md @@ -73,4 +73,79 @@ Note that regular signing checks (such as `signtool.exe verify /pa python.exe`) and malware scans will treat the files as correctly signed. It's only more complicated to verify that it was signed _specifically_ with our cert. +## Auto-start ARM64 VM + +Until Azure Pipelines offers ARM64 machines as standard, we use a custom VM to run PGO profiling. +This VM is hosted on Steve's subscription and is automatically launched by the start-arm64vm.yml stage. + +To replicate the configuration for a new subscription or VM, here are the steps: + +* Visit https://dev.azure.com/Python/cpython/_settings/adminservices to update/create an + Azure Resource Manager connection using Workload Identity Federation (a.k.a. OIDC). +* Create two custom roles in your Azure Subscription. The full JSON for each role is below, + and can be uploaded to the Azure Portal as a starting point for the role. +* Assign the "VM Restarter" role to the service principal/account used for WIF *on the resource group* +* Assign the "VM Updater" role to the service principal *on the VM*. This allows the VM to be updated, + but does not allow the workflow permission to create new VMs. +* Visit https://dev.azure.com/Python/cpython/_settings/agentqueues?queueId=24&view=agents and click + "New agent" to get the download URL for the Azure Pipelines agent. Extract onto the VM an run `config.cmd`. + Give `https://dev.azure.com/Python` as the server URL. +* Visit https://dev.azure.com/Python/_usersSettings/tokens to create a PAT with "Agent Pools (Read & manage)" + scope and paste it into the VM's config script when prompted. +* Give "Windows ARM64" as the pool name; any (unique) agent name is okay. +* Ensure Git is installed on the VM and you're ready to run. + +The VM Restarter role (manually set the assignable scopes to your subscription after uploading to the portal): + +```json +{ + "properties": { + "roleName": "VM Restarter", + "description": "Allows starting, stopping, and scheduling of VMs.", + "assignableScopes": [], + "permissions": [ + { + "actions": [ + "Microsoft.Compute/virtualMachines/read", + "Microsoft.Compute/virtualMachines/start/action", + "Microsoft.Compute/virtualMachines/powerOff/action", + "Microsoft.Compute/virtualMachines/restart/action", + "Microsoft.Compute/virtualMachines/deallocate/action", + "Microsoft.DevTestLab/schedules/delete", + "Microsoft.DevTestLab/schedules/read", + "Microsoft.DevTestLab/schedules/write", + "Microsoft.DevTestLab/schedules/Execute/action", + "Microsoft.DevTestLab/schedules/Retarget/action" + ], + "notActions": [], + "dataActions": [], + "notDataActions": [] + } + ] + } +} +``` + +The VM Updater role: + +```json +{ + "properties": { + "roleName": "VM Updater", + "description": "Allows creating or modifying VMs.", + "assignableScopes": [], + "permissions": [ + { + "actions": [ + "Microsoft.Compute/virtualMachines/write" + ], + "notActions": [], + "dataActions": [], + "notDataActions": [] + } + ] + } +} +``` + (Further documentation to be added as we find out what ought to be documented.) diff --git a/windows-release/start-arm64vm.yml b/windows-release/start-arm64vm.yml index 94d1e3af..11300639 100644 --- a/windows-release/start-arm64vm.yml +++ b/windows-release/start-arm64vm.yml @@ -1,6 +1,9 @@ parameters: DoARM64: false DoPGOARM64: false + ServiceConnection: "Steve's VM" + ResourceGroup: 'pythonarm64' + VMName: 'pythonarm64' jobs: # Only include the job if we need the VM, which means ARM64 PGO. @@ -13,25 +16,25 @@ jobs: - checkout: none - task: AzureCLI@2 - displayName: 'Start pythonarm64 and set auto-shutdown to (UTC now - 1h)' + displayName: 'Start ARM64 VM and set auto-shutdown to (UTC now + 8h)' inputs: - azureSubscription: "Steve's VM" # WIF service connection name + azureSubscription: ${{ parameters.ServiceConnection }} scriptType: pscore scriptLocation: inlineScript inlineScript: | $ErrorActionPreference = 'Stop' - $rg = 'pythonarm64' - $vm = 'pythonarm64' + $rg = '${{ parameters.ResourceGroup }}' + $vm = '${{ parameters.VMName }}' - # Compute UTC time minus 12 hours, format HHmm (e.g. 1830) - $shutdownTime = (Get-Date).ToUniversalTime().AddHours(-12).ToString('HHmm') + # Compute UTC time plus 8 hours, format HHmm (e.g. 1830) + $shutdownTime = (Get-Date).ToUniversalTime().AddHours(8).ToString('HHmm') Write-Host "Setting auto-shutdown time to: $shutdownTime UTC" - # Configure daily auto-shutdown in 12 hours + # Configure daily auto-shutdown in 8 hours az vm auto-shutdown -g $rg -n $vm --time $shutdownTime | Out-Null if ($?) { - Write-Host "Successfully configured auto-shutdown for ARM64 VM in 12 hours." + Write-Host "Successfully configured auto-shutdown for ARM64 VM in 8 hours." } else { Write-Host "##[warning]Failed to configure ARM64 VM auto-shutdown." }