Make onnxscript release 1ES compliant

.azure-pipelines/release-dev.yml

@@ -8,4 +8,4 @@ pool:
 variables:
   CI: 'true'
 steps:
-  - template: _release-template.yml
+- template: stages/_release-template-stage.yml

.azure-pipelines/release.yml

@@ -2,15 +2,29 @@
 
 trigger: none
 
-pool:
-  vmImage: ubuntu-latest
 variables:
   CI: 'true'
   # Set the release environment variable to build a release version of the wheel
   ONNX_SCRIPT_RELEASE: 1
-steps:
-  - template: _release-template.yml
-  # Test the wheels. This needs to happen after PublishBuildArtifacts
-  # to avoid interference with the artifacts
-  - script: python -m pip install dist/*.whl --no-deps
-    displayName: 'Install wheel'
+
+resources:
+  repositories:
+  - repository: 1esPipelines
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+extends:
+  # The pipeline extends the 1ES PT which will inject different SDL and compliance tasks.
+  # For non-production pipelines, use "Unofficial" as defined below.
+  # For productions pipelines, use "Official".
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    sdl:
+      sourceAnalysisPool:
+        name: onnxruntime-Win-CPU-2022
+        os: windows
+    pool:
+      name: 'onnxruntime-Ubuntu2204-AMD-CPU'
+      os: 'linux'
+    stages:
+    - template: stages/release_stage.yml

.azure-pipelines/stages/_release-template-stage.yml

@@ -0,0 +1,33 @@
+# Template steps for the release pipeline
+
+parameters:
+- name: is1ES
+  displayName: 'Is 1ES pipeline'
+  type: boolean
+  default: false
+steps:
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '3.11'
+  displayName: 'Set Up Python'
+- script: python -m pip install --upgrade pip build wheel
+  displayName: 'Install Python build dependencies'
+- script: python -m build
+  displayName: 'Build ONNX Script wheel'
+- task: CopyFiles@2
+  displayName: 'Copy Python Wheel to: $(Build.ArtifactStagingDirectory)'
+  inputs:
+    SourceFolder: 'dist'
+    Contents: '*.*'
+    TargetFolder: '$(Build.ArtifactStagingDirectory)'
+- ${{ if eq(parameters.is1ES, false) }}:
+  - task: PublishPipelineArtifact@1
+    displayName: 'Publish Python Wheel'
+    inputs:
+      ArtifactName: 'onnxscript'
+- ${{ if eq(parameters.is1ES, true) }}:
+  - task: 1ES.PublishPipelineArtifact@1
+    displayName: 'Publish Python Wheel'
+    inputs:
+      ArtifactName: 'onnxscript'
+      targetPath: '$(Build.ArtifactStagingDirectory)'

.azure-pipelines/stages/release_stage.yml

@@ -0,0 +1,14 @@
+#As 2/21/2025, 1ES doesn't like non-stage templates, so we need to wrap all non-stage templates with a stage template
+
+stages:
+- stage: Stage
+  jobs:
+  - job: Job
+    steps:
+    - template: _release-template-stage.yml
+      parameters:
+        is1ES: true
+    # Test the wheels. This needs to happen after PublishBuildArtifacts
+    # to avoid interference with the artifacts
+    - script: python -m pip install dist/*.whl --no-deps
+      displayName: 'Install wheel'