Feature/OIDC token refresh

.azure-pipelines/macos-standalone-release.yml → .azure-pipelines/mac-and-linux-standalone-release.yml

@@ -1,19 +1,21 @@
-# Azure CLI - macOS Release Pipeline (Build → Sign → Test → Publish)
+# Azure CLI - macOS and Linux Standalone Validation Pipeline
 #
-# Purpose: Complete end-to-end macOS release pipeline
+# Purpose: Manually validate macOS and Linux standalone tarballs and the Homebrew Cask.
+# This is an ad hoc testing pipeline, not the production release pipeline.
 # Architecture: Chains 4 job templates in sequence
 #
 # Pipeline Flow:
 #   1. macos-build-jobs.yml        → Build unsigned tarballs (ARM64 + Intel)
 #   2. macos-sign-notarize-jobs.yml → Sign and notarize via ESRP
-#   3. macos-test-jobs.yml         → Test cask (local file://) + offline install
-#   4. macos-publish-jobs.yml      → GitHub release + Homebrew cask update
+#   3. cask-generation-and-tests.yml → Test cask (local file://) + offline install
+#   4. publish-jobs.yml            → GitHub release + Homebrew cask update
 #
 # Output Artifacts:
-#   - cli-build-unsigned-arm64, cli-build-unsigned-x86_64 (intermediate)
-#   - cli-signed-notarized-arm64, cli-signed-notarized-x86_64 (final)
+#   - macos-cli-signed-notarized-arm64, macos-cli-signed-notarized-x86_64 (final)
+#   - linux-cli-final-arm64, linux-cli-final-x86_64 (final)
 
 trigger: none
+pr: none
 
 parameters:
   # Build parameters
@@ -49,11 +51,6 @@ parameters:
     type: string
     default: 'Azure/homebrew-azure-cli'
 
-  - name: GitHubServiceConnection
-    displayName: 'GitHub Service Connection'
-    type: string
-    default: 'Azure'
-
   - name: ESRPServiceConnection
     displayName: 'ESRP Service Connection'
     type: string
@@ -76,6 +73,8 @@ variables:
   - template: templates/variables.yml
   - ${{ if eq(variables['System.TeamProject'], 'release') }}:
     - group: 'AME ESRP Variable Group'
+    - group: 'esrp-signing-codes'
+    - group: 'get-github-pat-token'
 
   - name: GitHubRepo
     value: ${{ parameters.GitHubRepo }}
@@ -100,10 +99,10 @@ variables:
   - name: skipNugetSecurityAnalysis
     value: true
 
-name: macos-release-$(Build.BuildId)
+name: standalone-release-$(Build.BuildId)
 
 # ============================================================================
-# JOBS: End-to-end macOS release flow
+# JOBS: End-to-end standalone release flow
 # ============================================================================
 jobs:
 # ============================================================================
@@ -115,6 +114,12 @@ jobs:
     MacosArm64Image: ${{ variables.macos_arm64_pool }}
     MacosIntelImage: ${{ variables.macos_intel_pool }}
 
+- template: templates/linux/linux-build-jobs.yml
+  parameters:
+    PythonVersion: ${{ parameters.PythonVersion }}
+    LinuxArm64Pool: ${{ variables.ubuntu_arm64_pool }}
+    LinuxX64Pool: ${{ variables.ubuntu_pool }}
+
 # Jobs included:
 # - BuildMacOSCli (matrix: ARM64 + Intel)
 # - VerifyMacOSCli (matrix: ARM64 + Intel)
@@ -140,46 +145,58 @@ jobs:
 # - SignBinaries (matrix: ARM64 + Intel)
 # - CreateNotarizeBundle (matrix: ARM64 + Intel)
 # - Notarize (matrix: ARM64 + Intel)
-# - CreateFinalTarball (matrix: ARM64 + Intel)
+# - CreateMacOSFinalTarball (matrix: ARM64 + Intel)
 # Artifacts: cli-signed-notarized-arm64, cli-signed-notarized-x86_64
 
 # ============================================================================
 # PHASE 3a: TEST (local file:// cask + offline install)
 # ============================================================================
 - ${{ if eq(variables['System.TeamProject'], 'release') }}:
-  - template: templates/macos/macos-cask-generation-and-tests.yml
+  - template: templates/standalone/cask-generation-and-tests.yml
     parameters:
       MacosArm64Image: ${{ variables.macos_arm64_pool }}
       MacosIntelImage: ${{ variables.macos_intel_pool }}
+      LinuxArm64Pool: ${{ variables.ubuntu_arm64_pool }}
+      LinuxX64Pool: ${{ variables.ubuntu_pool }}
       PythonVersion: ${{ parameters.PythonVersion }}
       GitHubRepo: $(GitHubRepo)
       Debug: ${{ parameters.Debug }}
-      dependsOn:
-      - CreateFinalTarball
+      CaskDependsOn:
+      - CreateMacOSFinalTarball
+      - BuildLinuxCli
+      MacosDependsOn:
+      - CreateMacOSFinalTarball
+      LinuxDependsOn:
+      - BuildLinuxCli
 
 # Jobs included:
-# - TestTempTapCask (matrix: ARM64 + Intel) - tests cask with local file:// URLs
-# - TestOfflineInstall (matrix: ARM64 + Intel) - tests direct tarball install
+# - TestMacOSTempTapCask (matrix: ARM64 + Intel) - tests the macOS cask
+# - TestLinuxTempTapCask (matrix: ARM64 + x86_64) - tests the Linux cask
+# - TestMacOSOfflineInstall (matrix: ARM64 + Intel) - tests macOS tarballs
+# - TestLinuxOfflineInstall (matrix: ARM64 + x86_64) - tests Linux tarballs
 
 # ============================================================================
 # PHASE 3b: PUBLISH (GitHub + Homebrew tap)
 # ============================================================================
 - ${{ if eq(variables['System.TeamProject'], 'release') }}:
-  - template: templates/macos/macos-publish-jobs.yml
+  - template: templates/standalone/publish-jobs.yml
     parameters:
       PublishToGitHub: ${{ parameters.PublishToGitHub }}
       UpdateHomebrew: ${{ parameters.UpdateHomebrew }}
       TestAfterPublish: false
       GitHubRepo: $(GitHubRepo)
-      GitHubServiceConnection: ${{ parameters.GitHubServiceConnection }}
       HomebrewTapRepo: ${{ parameters.HomebrewTapRepo }}
       MacosArm64Image: ${{ variables.macos_arm64_pool }}
       MacosIntelImage: ${{ variables.macos_intel_pool }}
+      LinuxArm64Pool: ${{ variables.ubuntu_arm64_pool }}
+      LinuxX64Pool: ${{ variables.ubuntu_pool }}
       PythonVersion: ${{ parameters.PythonVersion }}
       Debug: ${{ parameters.Debug }}
       dependsOn:
-      - TestTempTapCask
-      - TestOfflineInstall
+      - TestMacOSTempTapCask
+      - TestLinuxTempTapCask
+      - TestMacOSOfflineInstall
+      - TestLinuxOfflineInstall
 
 # Jobs included:
 # - CreateGitHubRelease (conditional)

.azure-pipelines/templates/azdev_setup.yml

@@ -17,7 +17,7 @@ steps:
       . env/bin/activate
 
       python -m pip install -U pip "setuptools<81"
-      pip install --upgrade "azdev==0.2.12"
+      pip install --upgrade "azdev==0.2.13"
       azdev --version
 
       if [ -z "$CLI_EXT_REPO_PATH" ]; then

.azure-pipelines/templates/linux/linux-build-jobs.yml

@@ -0,0 +1,95 @@
+# Linux tarball build jobs for the Homebrew Cask release.
+
+parameters:
+  - name: PythonVersion
+    type: string
+    default: '3.14'
+  - name: LinuxArm64Pool
+    type: string
+    default: 'pool-ubuntu-latest-arm64'
+  - name: LinuxX64Pool
+    type: string
+    default: 'pool-ubuntu-2204'
+  - name: condition
+    type: string
+    default: 'succeeded()'
+  - name: dependsOn
+    type: object
+    default: []
+
+jobs:
+- job: BuildLinuxCli
+  displayName: 'Linux | Build and verify CLI'
+  condition: ${{ parameters.condition }}
+  dependsOn: ${{ parameters.dependsOn }}
+  strategy:
+    matrix:
+      ARM64:
+        Architecture: 'arm64'
+        PoolName: ${{ parameters.LinuxArm64Pool }}
+      X64:
+        Architecture: 'x86_64'
+        PoolName: ${{ parameters.LinuxX64Pool }}
+  pool:
+    name: $(PoolName)
+  timeoutInMinutes: 60
+
+  steps:
+  - checkout: self
+    fetchDepth: 1
+
+  - template: setup-homebrew.yml
+
+  - bash: |
+      set -euo pipefail
+
+      brew install python@${{ parameters.PythonVersion }}
+      PYTHON_PATH="$(brew --prefix python@${{ parameters.PythonVersion }})/libexec/bin/python"
+      "$PYTHON_PATH" --version
+      echo "##vso[task.setvariable variable=PythonPath]$PYTHON_PATH"
+    displayName: 'Install Homebrew Python'
+
+  - bash: |
+      set -euo pipefail
+
+      ARCH="$(Architecture)"
+      OUTPUT_DIR="$(Build.ArtifactStagingDirectory)/cli-build"
+      "$(PythonPath)" scripts/release/standalone/build_binary_tar_gz.py \
+        --platform-tag "linux-$ARCH" \
+        --output-dir "$OUTPUT_DIR"
+
+      SOURCE_TARBALL=$(find "$OUTPUT_DIR" -name "azure-cli-*-linux-$ARCH-nopython.tar.gz" -print -quit)
+      VERSION=$(basename "$SOURCE_TARBALL" | sed -E "s/^azure-cli-(.*)-linux-$ARCH-nopython\.tar\.gz$/\1/")
+      RELEASE_TARBALL="$OUTPUT_DIR/azure-cli-$VERSION-linux-$ARCH.tar.gz"
+      cp "$SOURCE_TARBALL" "$RELEASE_TARBALL"
+      sha256sum "$RELEASE_TARBALL" > "$RELEASE_TARBALL.sha256"
+      rm "$SOURCE_TARBALL" "$SOURCE_TARBALL.sha256"
+
+      echo "Release tarball: $RELEASE_TARBALL"
+      cat "$RELEASE_TARBALL.sha256"
+    displayName: 'Build release tarball'
+    env:
+      PYTHON_MAJOR_MINOR: ${{ parameters.PythonVersion }}
+
+  - bash: |
+      set -euo pipefail
+
+      ARCH="$(Architecture)"
+      TARBALL=$(find "$(Build.ArtifactStagingDirectory)/cli-build" -name "azure-cli-*-linux-$ARCH.tar.gz" -print -quit)
+      EXTRACT_DIR=$(mktemp -d)
+      trap 'rm -rf "$EXTRACT_DIR" || true' EXIT
+
+      tar -xzf "$TARBALL" -C "$EXTRACT_DIR"
+      export AZ_PYTHON="$(PythonPath)"
+      export AZURE_CORE_COLLECT_TELEMETRY=False
+      "$EXTRACT_DIR/bin/az" version
+    displayName: 'Smoke test release tarball'
+
+  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
+    displayName: 'Generate SBOM'
+    inputs:
+      BuildDropPath: $(Build.ArtifactStagingDirectory)/cli-build
+
+  - publish: $(Build.ArtifactStagingDirectory)/cli-build
+    artifact: 'linux-cli-final-$(Architecture)'
+    displayName: 'Publish Linux CLI ($(Architecture))'

.azure-pipelines/templates/linux/setup-homebrew.yml

@@ -0,0 +1,14 @@
+parameters: []
+
+steps:
+- bash: |
+    set -euo pipefail
+
+    if ! command -v brew >/dev/null 2>&1; then
+      NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+    fi
+
+    eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+    echo "##vso[task.prependpath]/home/linuxbrew/.linuxbrew/bin"
+    brew --version
+  displayName: 'Install Linuxbrew'

.azure-pipelines/templates/macos/macos-build-jobs.yml

@@ -80,7 +80,7 @@ jobs:
       echo "Architecture: $ARCH"
       $PYTHON --version
 
-      $PYTHON scripts/release/macos/build_binary_tar_gz.py \
+      $PYTHON scripts/release/standalone/build_binary_tar_gz.py \
         --platform-tag macos-$ARCH \
         --output-dir dist/binary_tar_gz
 

.azure-pipelines/templates/macos/macos-sign-notarize-jobs.yml

@@ -220,7 +220,7 @@ jobs:
 
     displayName: 'Create ZIP for each binary ($(Architecture))'
 
-  - task: EsrpCodeSigning@5
+  - task: EsrpCodeSigning@6
     displayName: 'ESRP - Sign binaries (Developer ID Application)'
     inputs:
       ConnectedServiceName: '${{ parameters.ESRPServiceConnection }}'
@@ -235,7 +235,7 @@ jobs:
       inlineOperation: |
         [
           {
-            "KeyCode": "CP-401337-Apple",
+            "KeyCode": "$(ESRPAppleKeyCode)",
             "OperationCode": "MacAppDeveloperSign",
             "ToolName": "sign",
             "ToolVersion": "1.0",
@@ -439,7 +439,7 @@ jobs:
 
     displayName: 'Prepare for notarization ($(Architecture))'
 
-  - task: EsrpCodeSigning@5
+  - task: EsrpCodeSigning@6
     displayName: 'ESRP - Notarize with Apple ($(Architecture))'
     inputs:
       ConnectedServiceName: '${{ parameters.ESRPServiceConnection }}'
@@ -454,7 +454,7 @@ jobs:
       inlineOperation: |
         [
           {
-            "KeyCode": "CP-401337-Apple",
+            "KeyCode": "$(ESRPAppleKeyCode)",
             "OperationCode": "MacAppNotarize",
             "ToolName": "sign",
             "ToolVersion": "1.0",
@@ -475,7 +475,7 @@ jobs:
 # ============================================================================
 # JOB: CREATE FINAL TARBALL (Both Architectures via Matrix)
 # ============================================================================
-- job: CreateFinalTarball
+- job: CreateMacOSFinalTarball
   displayName: 'macOS | Create Final Tarball'
   dependsOn:
   - DownloadAnalyze