Make python package pipeline 1ES compliant

tools/ci_build/github/azure-pipelines/py-package-test-pipeline.yml

@@ -31,10 +31,12 @@ stages:
         machine_pool:
           vmImage: 'macOS-13'
         itemPattern: '*/*mac*x86_64.whl'
+        arch: 'x86_64'
     - template: templates/py-package-smoking-test.yml
       parameters:
         job_name: Test_LINUX_x86_64_Wheels
         itemPattern: '*/*manylinux*x86_64.whl'
+        arch: 'x86_64'
         machine_pool:
           name: 'onnxruntime-Ubuntu2204-AMD-CPU'
 

tools/ci_build/github/azure-pipelines/py-packaging-pipeline.yml

@@ -50,10 +50,10 @@ parameters:
   displayName: 'Linux packages cmake build type. Linux Only.'
   default: 'Release'
   values:
-   - Debug
-   - Release
-   - RelWithDebInfo
-   - MinSizeRel
+  - Debug
+  - Release
+  - RelWithDebInfo
+  - MinSizeRel
 
 # Only applies to QNN packages.
 - name: qnn_sdk_version
@@ -63,17 +63,33 @@ parameters:
 
 trigger: none
 
-stages:
-- template: stages/py-cpu-packaging-stage.yml
+resources:
+  repositories:
+  - repository: 1esPipelines
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+extends:
+  # The pipeline extends the 1ES PT which will inject different SDL and compliance tasks.
+  # For non-production pipelines, use "Unofficial" as defined below.
+  # For productions pipelines, use "Official".
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
   parameters:
-    enable_linux_cpu: ${{ parameters.enable_linux_cpu }}
-    enable_windows_cpu: ${{ parameters.enable_windows_cpu }}
-    enable_mac_cpu: ${{ parameters.enable_mac_cpu }}
-    enable_linux_arm: ${{ parameters.enable_linux_arm }}
-    enable_windows_arm64_qnn: ${{ parameters.enable_windows_arm64_qnn }}
-    enable_windows_arm64ec_qnn: ${{ parameters.enable_windows_arm64ec_qnn }}
-    enable_windows_x64_qnn: ${{ parameters.enable_windows_x64_qnn }}
-    enable_linux_x64_qnn: ${{ parameters.enable_linux_x64_qnn }}
-    build_py_parameters: ${{ parameters.build_py_parameters }}
-    cmake_build_type: ${{ parameters.cmake_build_type }}
-    qnn_sdk_version: ${{ parameters.qnn_sdk_version }}
+    sdl:
+      sourceAnalysisPool:
+        name: onnxruntime-Win-CPU-2022
+        os: windows
+    stages:
+    - template: stages/py-cpu-packaging-stage.yml
+      parameters:
+        enable_linux_cpu: ${{ parameters.enable_linux_cpu }}
+        enable_windows_cpu: ${{ parameters.enable_windows_cpu }}
+        enable_mac_cpu: ${{ parameters.enable_mac_cpu }}
+        enable_linux_arm: ${{ parameters.enable_linux_arm }}
+        enable_windows_arm64_qnn: ${{ parameters.enable_windows_arm64_qnn }}
+        enable_windows_arm64ec_qnn: ${{ parameters.enable_windows_arm64ec_qnn }}
+        enable_windows_x64_qnn: ${{ parameters.enable_windows_x64_qnn }}
+        enable_linux_x64_qnn: ${{ parameters.enable_linux_x64_qnn }}
+        build_py_parameters: ${{ parameters.build_py_parameters }}
+        cmake_build_type: ${{ parameters.cmake_build_type }}
+        qnn_sdk_version: ${{ parameters.qnn_sdk_version }}

tools/ci_build/github/azure-pipelines/stages/py-cpu-packaging-stage.yml

@@ -151,10 +151,11 @@ stages:
           Contents: '*.whl'
           TargetFolder: '$(Build.ArtifactStagingDirectory)'
 
-      - task: PublishBuildArtifacts@1
+      - task: 1ES.PublishPipelineArtifact@1
         displayName: 'Publish Artifact: ONNXRuntime python wheel'
         inputs:
-          ArtifactName: onnxruntime
+          artifactName: onnxruntime-win-$(PythonVersion)
+          targetPath: '$(Build.ArtifactStagingDirectory)'
 
       - script: |
           7z x *.whl
@@ -199,7 +200,9 @@ stages:
       workspace:
         clean: all
       pool:
-        vmImage: 'macOS-13'
+        name: "Azure Pipelines"
+        image: "macOS-13"
+        os: macOS
       variables:
         MACOSX_DEPLOYMENT_TARGET: '13.3'
       strategy:
@@ -251,74 +254,81 @@ stages:
           Contents: '*.whl'
           TargetFolder: '$(Build.ArtifactStagingDirectory)'
 
-      - task: PublishBuildArtifacts@1
+      - task: 1ES.PublishPipelineArtifact@1
         displayName: 'Publish Artifact: ONNXRuntime python wheel'
         inputs:
-          ArtifactName: onnxruntime
+          artifactName: onnxruntime-macos-$(PythonVersion)
+          targetPath: '$(Build.ArtifactStagingDirectory)'
 
       - template: ../templates/component-governance-component-detection-steps.yml
         parameters:
           condition: 'succeeded'
 
 
-  - ${{ if eq(parameters.enable_linux_arm, true) }}:
-    - stage: Python_Packaging_Linux_ARM
-      dependsOn: []
-      jobs:
-        - template: ../templates/py-linux.yml
-          parameters:
-            arch: 'aarch64'
-            machine_pool: 'onnxruntime-linux-ARM64-CPU-2019'
-            extra_build_arg: ${{ parameters.build_py_parameters }}
-            cmake_build_type: ${{ parameters.cmake_build_type }}
-
-  - ${{ if eq(parameters.enable_linux_cpu, true) }}:
-    - stage: Python_Packaging_Linux_CPU
-      dependsOn: []
-      jobs:
+- ${{ if eq(parameters.enable_linux_arm, true) }}:
+  - stage: Python_Packaging_Linux_ARM
+    dependsOn: []
+    jobs:
       - template: ../templates/py-linux.yml
         parameters:
-          arch: 'x86_64'
-          machine_pool: 'onnxruntime-Ubuntu2204-AMD-CPU-Large'
+          arch: 'aarch64'
+          machine_pool: 'onnxruntime-linux-ARM64-CPU-2019'
           extra_build_arg: ${{ parameters.build_py_parameters }}
           cmake_build_type: ${{ parameters.cmake_build_type }}
+          is1ES: true
 
-  - ${{ if eq(parameters.enable_windows_arm64_qnn, true) }}:
-    - stage: Python_Packaging_Windows_ARM64_QNN
-      dependsOn: []
-      jobs:
-      - template: ../templates/py-win-arm64-qnn.yml
+- ${{ if eq(parameters.enable_linux_cpu, true) }}:
+  - stage: Python_Packaging_Linux_CPU
+    dependsOn: []
+    jobs:
+    - template: ../templates/py-linux.yml
+      parameters:
+        arch: 'x86_64'
+        machine_pool: 'onnxruntime-Ubuntu2204-AMD-CPU-Large'
+        extra_build_arg: ${{ parameters.build_py_parameters }}
+        cmake_build_type: ${{ parameters.cmake_build_type }}
+        is1ES: true
+
+- ${{ if eq(parameters.enable_windows_arm64_qnn, true) }}:
+  - stage: Python_Packaging_Windows_ARM64_QNN
+    dependsOn: []
+    jobs:
+    - template: ../templates/py-win-arm64-qnn.yml
+      parameters:
+        MACHINE_POOL: 'onnxruntime-qnn-windows-vs-2022-arm64'
+        QNN_SDK: ${{ parameters.qnn_sdk_version }}
+        BUILD_PY_PARAMETERS: ${{ parameters.build_py_parameters }}
+        is1ES: true
+
+- ${{ if eq(parameters.enable_windows_arm64ec_qnn, true) }}:
+  - stage: Python_Packaging_Windows_arm64ec_QNN
+    dependsOn: []
+    jobs:
+      - template: ../templates/py-win-arm64ec-qnn.yml
         parameters:
-          MACHINE_POOL: 'onnxruntime-qnn-windows-vs-2022-arm64'
+          MACHINE_POOL: 'Onnxruntime-QNNEP-Windows-2022-CPU'
           QNN_SDK: ${{ parameters.qnn_sdk_version }}
           BUILD_PY_PARAMETERS: ${{ parameters.build_py_parameters }}
+          is1ES: true
 
-  - ${{ if eq(parameters.enable_windows_arm64ec_qnn, true) }}:
-    - stage: Python_Packaging_Windows_arm64ec_QNN
-      dependsOn: []
-      jobs:
-        - template: ../templates/py-win-arm64ec-qnn.yml
-          parameters:
-            MACHINE_POOL: 'Onnxruntime-QNNEP-Windows-2022-CPU'
-            QNN_SDK: ${{ parameters.qnn_sdk_version }}
-            BUILD_PY_PARAMETERS: ${{ parameters.build_py_parameters }}
-
-  - ${{ if eq(parameters.enable_windows_x64_qnn, true) }}:
-    - stage: Python_Packaging_Windows_x64_QNN
-      dependsOn: []
-      jobs:
-        - template: ../templates/py-win-x64-qnn.yml
-          parameters:
-            MACHINE_POOL: 'Onnxruntime-QNNEP-Windows-2022-CPU'
-            QNN_SDK: ${{ parameters.qnn_sdk_version }}
-            BUILD_PY_PARAMETERS: ${{ parameters.build_py_parameters }}
-
-  - ${{ if eq(parameters.enable_linux_x64_qnn, true) }}:
-    - stage: Python_Packaging_Linux_x64_QNN
-      dependsOn: []
-      jobs:
-      - template: ../templates/py-linux-qnn.yml
+- ${{ if eq(parameters.enable_windows_x64_qnn, true) }}:
+  - stage: Python_Packaging_Windows_x64_QNN
+    dependsOn: []
+    jobs:
+      - template: ../templates/py-win-x64-qnn.yml
         parameters:
-          machine_pool: 'onnxruntime-Ubuntu2204-AMD-CPU'
-          extra_build_arg: ${{ parameters.build_py_parameters }}
-          cmake_build_type: ${{ parameters.cmake_build_type }}
+          MACHINE_POOL: 'Onnxruntime-QNNEP-Windows-2022-CPU'
+          QNN_SDK: ${{ parameters.qnn_sdk_version }}
+          BUILD_PY_PARAMETERS: ${{ parameters.build_py_parameters }}
+          is1ES: true
+
+- ${{ if eq(parameters.enable_linux_x64_qnn, true) }}:
+  - stage: Python_Packaging_Linux_x64_QNN
+    dependsOn: []
+    jobs:
+    - template: ../templates/py-linux-qnn.yml
+      parameters:
+        machine_pool: 'onnxruntime-Ubuntu2204-AMD-CPU'
+        extra_build_arg: ${{ parameters.build_py_parameters }}
+        cmake_build_type: ${{ parameters.cmake_build_type }}
+        is1ES: true

tools/ci_build/github/azure-pipelines/templates/py-linux-qnn.yml

@@ -6,10 +6,10 @@ parameters:
   type: string
   default: 'Release'
   values:
-   - Debug
-   - Release
-   - RelWithDebInfo
-   - MinSizeRel
+  - Debug
+  - Release
+  - RelWithDebInfo
+  - MinSizeRel
 
 - name: device
   type: string
@@ -27,68 +27,82 @@ parameters:
   displayName: QNN SDK version
   type: string
   default: 2.31.0.250130
+
+- name: is1ES
+  displayName: 'Whether the pipeline is running in 1ES'
+  type: boolean
+  default: false
 
 jobs:
 - job: Linux_py_qnn_Wheels_x64
   timeoutInMinutes: 240
   workspace:
     clean: all
-  pool: ${{ parameters.machine_pool }}
+  pool:
+    name: ${{ parameters.machine_pool }}
+    os: linux
   variables:
-    # The build machine pool doesn't have dotnet, so it can't run CG.
-    - name: skipComponentGovernanceDetection
-      value: true
-    - name: ORT_CACHE_DIR
-      value: $(Agent.TempDirectory)/ort_ccache
-    - name: TODAY
-      value: $[format('{0:dd}{0:MM}{0:yyyy}', pipeline.startTime)]
-    - name: extra_build_args
-      ${{ if ne(parameters.extra_build_arg, '') }}:
-        value: -x ${{ parameters.extra_build_arg }}
-      ${{ if eq(parameters.extra_build_arg, '') }}:
-        value: ''
+  # The build machine pool doesn't have dotnet, so it can't run CG.
+  - name: skipComponentGovernanceDetection
+    value: true
+  - name: ORT_CACHE_DIR
+    value: $(Agent.TempDirectory)/ort_ccache
+  - name: TODAY
+    value: $[format('{0:dd}{0:MM}{0:yyyy}', pipeline.startTime)]
+  - name: extra_build_args
+    ${{ if ne(parameters.extra_build_arg, '') }}:
+      value: -x ${{ parameters.extra_build_arg }}
+    ${{ if eq(parameters.extra_build_arg, '') }}:
+      value: ''
   steps:
 
-    - checkout: self
-      clean: true
-      submodules: none
+  - checkout: self
+    clean: true
+    submodules: none
 
-    - template: jobs/download_linux_qnn_sdk.yml
-      parameters:
-        QnnSDKVersion: ${{ parameters.QnnSdk }}
+  - template: jobs/download_linux_qnn_sdk.yml
+    parameters:
+      QnnSDKVersion: ${{ parameters.QnnSdk }}
 
-    - template: set-nightly-build-option-variable-step.yml
+  - template: set-nightly-build-option-variable-step.yml
 
-    - template: get-docker-image-steps.yml
-      parameters:
-        Dockerfile: tools/ci_build/github/linux/docker/inference/x86_64/python/cpu/Dockerfile
-        Context: tools/ci_build/github/linux/docker/inference/x86_64/python/cpu
-        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
-        Repository: onnxruntimecpubuildpythonx86_64_qnn
+  - template: get-docker-image-steps.yml
+    parameters:
+      Dockerfile: tools/ci_build/github/linux/docker/inference/x86_64/python/cpu/Dockerfile
+      Context: tools/ci_build/github/linux/docker/inference/x86_64/python/cpu
+      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+      Repository: onnxruntimecpubuildpythonx86_64_qnn
 
-    - template: linux-build-step-with-cache.yml
-      parameters:
-        WithCache: ${{parameters.with_cache}}
-        Today: $(TODAY)
-        AdditionalKey: Linux_py_qnn_Wheels_x64
-        CacheDir: $(ORT_CACHE_DIR)
-        ChangeEveryCommit: true
-        BuildStep:
-          - task: Bash@3
-            displayName: 'Build Python Wheel'
-            inputs:
-              targetType: filePath
-              filePath: tools/ci_build/github/linux/run_python_dockerbuild.sh
-              arguments: -i onnxruntimecpubuildpythonx86_64_qnn -d "${{ parameters.device }}" -c ${{ parameters.cmake_build_type }} $(extra_build_args)
-            env:
-              ADDITIONAL_DOCKER_PARAMETER: "--volume $(QnnSDKRootDir):/qnn_sdk"
+  - template: linux-build-step-with-cache.yml
+    parameters:
+      WithCache: ${{parameters.with_cache}}
+      Today: $(TODAY)
+      AdditionalKey: Linux_py_qnn_Wheels_x64
+      CacheDir: $(ORT_CACHE_DIR)
+      ChangeEveryCommit: true
+      BuildStep:
+      - task: Bash@3
+        displayName: 'Build Python Wheel'
+        inputs:
+          targetType: filePath
+          filePath: tools/ci_build/github/linux/run_python_dockerbuild.sh
+          arguments: -i onnxruntimecpubuildpythonx86_64_qnn -d "${{ parameters.device }}" -c ${{ parameters.cmake_build_type }} $(extra_build_args)
+        env:
+          ADDITIONAL_DOCKER_PARAMETER: "--volume $(QnnSDKRootDir):/qnn_sdk"
+  - ${{ if eq(parameters.is1ES, true) }}:
+    - task: 1ES.PublishPipelineArtifact@1
+      displayName: 'Publish Artifact: Linux ONNXRuntime QNN python wheel'
+      inputs:
+        targetPath: '$(Build.BinariesDirectory)/dist'
+        artifactName: onnxruntime-linux-qnn-x64
 
-    - task: PublishBuildArtifacts@1
+  - ${{ if eq(parameters.is1ES, false) }}:
+    - task: PublishPipelineArtifact@1
       displayName: 'Publish Artifact: Linux ONNXRuntime QNN python wheel'
       inputs:
-        PathtoPublish: '$(Build.BinariesDirectory)/dist'
-        ArtifactName: onnxruntime-linux-qnn-x64
+        targetPath: '$(Build.BinariesDirectory)/dist'
+        artifactName: onnxruntime-linux-qnn-x64
 
-    - template: component-governance-component-detection-steps.yml
-      parameters :
-        condition : 'succeeded'
+  - template: component-governance-component-detection-steps.yml
+    parameters:
+      condition: 'succeeded'