Make onnxscript release 1ES compliant (#2071)

Co-authored-by: Justin Chu <[email protected]>
Co-authored-by: Copilot <[email protected]>

.azure-pipelines/release-dev.yml

@@ -3,9 +3,28 @@
 # To configure triggers, see https://github.com/microsoft/onnx-converters-private/wiki/ONNX-Script-release
 trigger: none
 
-pool:
-  vmImage: ubuntu-latest
 variables:
   CI: 'true'
-steps:
-  - template: _release-template.yml
+
+resources:
+  repositories:
+  - repository: 1esPipelines
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  # The pipeline extends the 1ES PT which will inject different SDL and compliance tasks.
+  # For non-production pipelines, use "Unofficial" as defined below.
+  # For productions pipelines, use "Official".
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    sdl:
+      sourceAnalysisPool:
+        name: onnxruntime-Win-CPU-2022
+        os: windows
+    pool:
+      name: 'onnxruntime-Ubuntu2204-AMD-CPU'
+      os: 'linux'
+    stages:
+    - template: stages/release-stage.yml

.azure-pipelines/release.yml

@@ -2,15 +2,30 @@
 
 trigger: none
 
-pool:
-  vmImage: ubuntu-latest
 variables:
   CI: 'true'
   # Set the release environment variable to build a release version of the wheel
   ONNX_SCRIPT_RELEASE: 1
-steps:
-  - template: _release-template.yml
-  # Test the wheels. This needs to happen after PublishBuildArtifacts
-  # to avoid interference with the artifacts
-  - script: python -m pip install dist/*.whl --no-deps
-    displayName: 'Install wheel'
+
+resources:
+  repositories:
+  - repository: 1esPipelines
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  # The pipeline extends the 1ES PT which will inject different SDL and compliance tasks.
+  # For non-production pipelines, use "Unofficial" as defined below.
+  # For productions pipelines, use "Official".
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    sdl:
+      sourceAnalysisPool:
+        name: onnxruntime-Win-CPU-2022
+        os: windows
+    pool:
+      name: 'onnxruntime-Ubuntu2204-AMD-CPU'
+      os: 'linux'
+    stages:
+    - template: stages/release-stage.yml

.azure-pipelines/stages/jobs/steps/release-steps.yml

@@ -0,0 +1,20 @@
+steps:
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '3.11'
+  displayName: 'Set Up Python'
+- script: python -m pip install --upgrade pip build wheel
+  displayName: 'Install Python build dependencies'
+- script: python -m build
+  displayName: 'Build ONNX Script wheel'
+- task: CopyFiles@2
+  displayName: 'Copy Python Wheel to: $(Build.ArtifactStagingDirectory)'
+  inputs:
+    SourceFolder: 'dist'
+    Contents: '*.*'
+    TargetFolder: '$(Build.ArtifactStagingDirectory)'
+- task: 1ES.PublishPipelineArtifact@1
+  displayName: 'Publish Python Wheel'
+  inputs:
+    ArtifactName: 'onnxscript'
+    targetPath: '$(Build.ArtifactStagingDirectory)'

.azure-pipelines/stages/release-stage.yml

@@ -0,0 +1,11 @@
+stages:
+- stage: Stage
+  jobs:
+  - job: Job
+    steps:
+    - template: jobs/steps/release-steps.yml
+    # Test the wheels. This needs to happen after PublishBuildArtifacts
+    # to avoid interference with the artifacts
+    - script: python -m pip install dist/*.whl --no-deps
+      displayName: 'Install wheel'
+      condition: eq(variables['ONNX_SCRIPT_RELEASE'], 1)