From a526c99640b2874954a906df37aba8b3f75067af Mon Sep 17 00:00:00 2001 From: David Fan Date: Wed, 12 Aug 2026 03:26:55 +0000 Subject: [PATCH 1/2] Use authenticated package sources in packaging pipelines Configure Java and Windows wheel packaging to use authenticated package sources and avoid ad hoc dependency bootstrap downloads. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d78d7b1-43f9-4fe3-972f-3a70b59db4f6 --- .pipelines/java_packaging.yml | 6 ++ .../onebranch-windows-build-stage.yml | 3 + .pipelines/templates/setup-maven-feed.yml | 79 +++++++++++++++++++ .pipelines/templates/setup-python-feed.yml | 52 ++++++++++++ .../github/azure-pipeline/java_packaging.yml | 6 ++ .../templates/windows-build-stage.yml | 2 + 6 files changed, 148 insertions(+) create mode 100644 .pipelines/templates/setup-maven-feed.yml create mode 100644 .pipelines/templates/setup-python-feed.yml diff --git a/.pipelines/java_packaging.yml b/.pipelines/java_packaging.yml index 403395fee..73aec8fb8 100644 --- a/.pipelines/java_packaging.yml +++ b/.pipelines/java_packaging.yml @@ -13,6 +13,8 @@ stages: pool: {name: 'onnxruntime-Win-CPU-2022'} steps: + - template: templates/setup-maven-feed.yml + - task: PowerShell@2 displayName: 'Set version' inputs: @@ -62,6 +64,8 @@ stages: pool: {name: 'Azure-Pipelines-EO-Ubuntu-2004-aiinfra'} steps: + - template: templates/setup-maven-feed.yml + - task: PowerShell@2 displayName: 'Set version' inputs: @@ -110,6 +114,8 @@ stages: vmImage: 'macOS-14' steps: + - template: templates/setup-maven-feed.yml + - task: PowerShell@2 displayName: 'Set version' inputs: diff --git a/.pipelines/templates/onebranch-windows-build-stage.yml b/.pipelines/templates/onebranch-windows-build-stage.yml index e98387e8a..2fb45df73 100644 --- a/.pipelines/templates/onebranch-windows-build-stage.yml +++ b/.pipelines/templates/onebranch-windows-build-stage.yml @@ -49,6 +49,9 @@ stages: displayName: 'locate vsdevcmd via vswhere' - task: UsePythonVersion@0 + + - template: setup-python-feed.yml + - script: | call $(vsdevcmd) -arch=amd64 set PYTHONPATH= diff --git a/.pipelines/templates/setup-maven-feed.yml b/.pipelines/templates/setup-maven-feed.yml new file mode 100644 index 000000000..07744a797 --- /dev/null +++ b/.pipelines/templates/setup-maven-feed.yml @@ -0,0 +1,79 @@ +parameters: +- name: artifactFeed + type: string + default: 'Lotus' + +- name: feedUrl + type: string + default: 'https://pkgs.dev.azure.com/aiinfra/_packaging/Lotus/maven/v1' + +steps: +- task: MavenAuthenticate@0 + displayName: 'Authenticate Maven feed' + inputs: + artifactsFeeds: ${{ parameters.artifactFeed }} + +- task: PowerShell@2 + displayName: 'Configure Gradle feed isolation' + env: + ORT_EXTENSIONS_MAVEN_FEED_NAME: ${{ parameters.artifactFeed }} + ORT_EXTENSIONS_MAVEN_FEED_URL: ${{ parameters.feedUrl }} + inputs: + targetType: 'inline' + script: | + $gradleInitDir = Join-Path $HOME '.gradle/init.d' + New-Item -ItemType Directory -Force -Path $gradleInitDir | Out-Null + + $initScript = @' + import groovy.xml.XmlSlurper + import org.gradle.api.GradleException + import org.gradle.api.artifacts.repositories.MavenArtifactRepository + + def feedName = System.getenv('ORT_EXTENSIONS_MAVEN_FEED_NAME') + def feedUrl = System.getenv('ORT_EXTENSIONS_MAVEN_FEED_URL') + def settingsFile = new File(System.getProperty('user.home'), '.m2/settings.xml') + if (!settingsFile.exists()) { + throw new GradleException("Maven settings file was not created: ${settingsFile}") + } + + def server = new XmlSlurper().parse(settingsFile).servers.server.find { + it.id.text() == feedName + } + if (!server) { + throw new GradleException("Credentials for Maven feed '${feedName}' were not found") + } + + def feedUsername = server.username.text() + def feedPassword = server.password.text() + def configureRepository = { repository -> + if (repository instanceof MavenArtifactRepository) { + repository.setUrl(feedUrl) + repository.credentials { + username = feedUsername + password = feedPassword + } + } + } + + gradle.settingsEvaluated { settings -> + settings.pluginManagement.repositories.clear() + settings.pluginManagement.repositories.maven { + name = feedName + url = uri(feedUrl) + credentials { + username = feedUsername + password = feedPassword + } + } + } + + gradle.beforeProject { project -> + [project.buildscript.repositories, project.repositories].each { repositories -> + repositories.all(configureRepository) + repositories.whenObjectAdded(configureRepository) + } + } + '@ + + Set-Content -Path (Join-Path $gradleInitDir 'package-feed.init.gradle') ` + -Value $initScript -Encoding utf8 diff --git a/.pipelines/templates/setup-python-feed.yml b/.pipelines/templates/setup-python-feed.yml new file mode 100644 index 000000000..c3af266e0 --- /dev/null +++ b/.pipelines/templates/setup-python-feed.yml @@ -0,0 +1,52 @@ +parameters: +- name: artifactFeed + type: string + default: 'Lotus' + +- name: nugetFeedUrl + type: string + default: 'https://pkgs.dev.azure.com/aiinfra/_packaging/Lotus/nuget/v3/index.json' + +steps: +- task: PipAuthenticate@1 + displayName: 'Authenticate Python package feed' + inputs: + artifactFeeds: ${{ parameters.artifactFeed }} + onlyAddExtraIndex: false + +- task: NuGetAuthenticate@1 + displayName: 'Authenticate NuGet package feed' + +- task: PowerShell@2 + displayName: 'Configure cibuildwheel package isolation' + env: + ORT_EXTENSIONS_NUGET_FEED_URL: ${{ parameters.nugetFeedUrl }} + inputs: + targetType: 'inline' + script: | + $ErrorActionPreference = 'Stop' + if (-not $env:PIP_INDEX_URL) { + throw 'PIP_INDEX_URL is not configured by PipAuthenticate.' + } + + $nuget = Get-Command nuget.exe -ErrorAction Stop + $cibwCache = Join-Path '$(Agent.TempDirectory)' 'cibuildwheel-cache' + New-Item -ItemType Directory -Force -Path $cibwCache | Out-Null + Copy-Item -Force -Path $nuget.Source -Destination (Join-Path $cibwCache 'nuget.exe') + Write-Host "##vso[task.setvariable variable=CIBW_CACHE_PATH]$cibwCache" + + $nugetConfigDir = Join-Path $env:APPDATA 'NuGet' + New-Item -ItemType Directory -Force -Path $nugetConfigDir | Out-Null + $nugetConfig = @" + + + + + + + + + + + "@ + Set-Content -Path (Join-Path $nugetConfigDir 'NuGet.Config') -Value $nugetConfig diff --git a/tools/ci_build/github/azure-pipeline/java_packaging.yml b/tools/ci_build/github/azure-pipeline/java_packaging.yml index 654e2fe26..9e8e6234c 100644 --- a/tools/ci_build/github/azure-pipeline/java_packaging.yml +++ b/tools/ci_build/github/azure-pipeline/java_packaging.yml @@ -40,6 +40,8 @@ extends: artifact: WindowsBinaries steps: + - template: /.pipelines/templates/setup-maven-feed.yml@self + - task: PowerShell@2 displayName: 'Set version' inputs: @@ -92,6 +94,8 @@ extends: artifact: LinuxBinaries steps: + - template: /.pipelines/templates/setup-maven-feed.yml@self + - task: PowerShell@2 displayName: 'Set version' inputs: @@ -150,6 +154,8 @@ extends: artifact: drop-onnxruntime-extensions-java-cpu steps: + - template: /.pipelines/templates/setup-maven-feed.yml@self + - task: PowerShell@2 displayName: 'Set version' inputs: diff --git a/tools/ci_build/github/azure-pipeline/templates/windows-build-stage.yml b/tools/ci_build/github/azure-pipeline/templates/windows-build-stage.yml index f938670b5..1cd4194c5 100644 --- a/tools/ci_build/github/azure-pipeline/templates/windows-build-stage.yml +++ b/tools/ci_build/github/azure-pipeline/templates/windows-build-stage.yml @@ -63,6 +63,8 @@ stages: versionSpec: '3.13' addToPath: true + - template: /.pipelines/templates/setup-python-feed.yml@self + - script: | call $(vsdevcmd) -arch=amd64 set PYTHONPATH= From 9b7a8ce82e287ecf373c3f38dbd6a744a2f4fee8 Mon Sep 17 00:00:00 2001 From: David Fan Date: Wed, 12 Aug 2026 03:54:24 +0000 Subject: [PATCH 2/2] Write NuGet configuration as UTF-8 Remove the XML declaration so leading whitespace cannot invalidate the generated configuration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d78d7b1-43f9-4fe3-972f-3a70b59db4f6 --- .pipelines/templates/setup-python-feed.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.pipelines/templates/setup-python-feed.yml b/.pipelines/templates/setup-python-feed.yml index c3af266e0..efa16c9a6 100644 --- a/.pipelines/templates/setup-python-feed.yml +++ b/.pipelines/templates/setup-python-feed.yml @@ -38,7 +38,6 @@ steps: $nugetConfigDir = Join-Path $env:APPDATA 'NuGet' New-Item -ItemType Directory -Force -Path $nugetConfigDir | Out-Null $nugetConfig = @" - @@ -49,4 +48,4 @@ steps: "@ - Set-Content -Path (Join-Path $nugetConfigDir 'NuGet.Config') -Value $nugetConfig + Set-Content -Path (Join-Path $nugetConfigDir 'NuGet.Config') -Value $nugetConfig -Encoding utf8