centralise feed authentication for ADO pipelines

tools/ci_build/github/azure-pipelines/post-merge-jobs.yml

@@ -398,6 +398,11 @@ stages:
     - checkout: self
       submodules: false
 
+    - task: PipAuthenticate@1
+      displayName: 'Pip Authenticate'
+      inputs:
+        artifactFeeds: 'Lotus'
+
     - task: UsePythonVersion@0
       inputs:
         versionSpec: '3.12'

tools/ci_build/github/azure-pipelines/stages/nuget-cuda-packaging-stage.yml

@@ -72,16 +72,16 @@ stages:
         SpecificArtifact: ${{ parameters.SpecificArtifact }}
         BuildId: ${{ parameters.BuildId }}
 
-    - task: UsePythonVersion@0
-      displayName: 'Use Python'
-      inputs:
-        versionSpec: 3.12
-
     - task: PipAuthenticate@1
       displayName: 'Pip Authenticate'
       inputs:
         artifactFeeds: 'Lotus'
 
+    - task: UsePythonVersion@0
+      displayName: 'Use Python'
+      inputs:
+        versionSpec: 3.12
+
     - template: ../templates/set-version-number-variables-step.yml
 
     # Reconstruct the build dir

tools/ci_build/github/azure-pipelines/stages/nuget-linux-cuda-packaging-stage.yml

@@ -31,6 +31,10 @@ stages:
       value: ${{ parameters.CudaVersion }}
     steps:
     - template: ../templates/set-version-number-variables-step.yml
+    - task: PipAuthenticate@1
+      displayName: 'Pip Authenticate'
+      inputs:
+        artifactFeeds: 'Lotus'
     - task: UsePythonVersion@0
       displayName: Use Python 3.12
       inputs:
@@ -90,6 +94,10 @@ stages:
     - checkout: self
       clean: true
       submodules: recursive
+    - task: PipAuthenticate@1
+      displayName: 'Pip Authenticate'
+      inputs:
+        artifactFeeds: 'Lotus'
     - task: UsePythonVersion@0
       displayName: Use Python 3.12
       inputs:

tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml

@@ -348,16 +348,15 @@ stages:
         DisplayName: 'ESRP - Sign C# dlls'
         DoEsrp: true
 
-    - task: UsePythonVersion@0
-      displayName: 'Use Python'
-      inputs:
-        versionSpec: 3.12
-
     - task: PipAuthenticate@1
       displayName: 'Pip Authenticate'
       inputs:
         artifactFeeds: 'Lotus'
 
+    - task: UsePythonVersion@0
+      displayName: 'Use Python'
+      inputs:
+        versionSpec: 3.12
 
     - task: MSBuild@1
       displayName: 'Build Nuget Packages'

tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml

@@ -46,6 +46,12 @@ jobs:
     clean: true
     submodules: none
 
+  # Authenticate to Lotus to pull pip in UsePythonVersion task
+  - task: PipAuthenticate@1
+    displayName: 'Pip Authenticate'
+    inputs:
+      artifactFeeds: 'Lotus'
+
   - ${{ if eq(parameters.OnnxruntimeArch, 'x64') }}:
     # Only need to install Python on x64 agents as Python is pre-installed on arm64 agents
     - task: UsePythonVersion@0

tools/ci_build/github/azure-pipelines/templates/setup-build-tools.yml

@@ -16,17 +16,17 @@ parameters:
 steps:
 - template: telemetry-steps.yml
 
+- task: PipAuthenticate@1
+  displayName: 'Pip Authenticate'
+  inputs:
+    artifactFeeds: 'Lotus'
+
 - task: UsePythonVersion@0
   displayName: 'Use Python ${{ parameters.python_version }} ${{ parameters.host_cpu_arch }}'
   inputs:
     versionSpec: ${{ parameters.python_version }}
     architecture: ${{ parameters.host_cpu_arch }}
 
-- task: PipAuthenticate@1
-  displayName: 'Pip Authenticate'
-  inputs:
-    artifactFeeds: 'Lotus'
-
 # The following task does not support different arches.
 - task: UseNode@1
   condition: and(succeeded(), ne(variables['Agent.OS'], 'Windows_NT'))