Updating package release to run through the ESRP release pipeline

.vscode/cspell.json

@@ -425,6 +425,12 @@
         "thead"
       ]
     },
+    {
+      "filename": "doc/esrp_release.md",
+      "words": [
+        "ESRP"
+      ]
+    },
     {
       "filename": "sdk/core/azure-core/tests/test_serialization.py",
       "words": [

doc/esrp_release.md

@@ -0,0 +1,11 @@
+# ESRP Release Process
+
+Up until [this PR](https://github.com/Azure/azure-sdk-for-python/pull/29004) the azure-sdk-for-python team released packages to `PyPI` using our own PyPI account. After that PR, our releases will be handled by the central ESRP team.
+
+This process change should not affect the release process whatsoever. There will be no change in release experience. Owners will still queue an `internal` build for their service, then approve each individual package for release as necessary.
+
+The primary visible effect of these release changes is that these packages will be published by the `Microsoft` pypi account, _not_  `azure-sdk` account that has been used until now.
+
+## Break Glass - Yanking/Deleting
+
+Contact the `python` team via email, teams, or ICM: `[email protected]`. Additionally [this document](https://docs.opensource.microsoft.com/releasing/publish-binaries/python/) is the official writeup on break glass scenarios.

eng/pipelines/templates/stages/archetype-python-release.yml

@@ -96,23 +96,34 @@ stages:
                           scriptPath: 'scripts/devops_tasks/verify_dependencies_present.py'
                           arguments: '--package-name ${{ artifact.name }} --service ${{ parameters.ServiceDirectory }}'
 
-                      - task: TwineAuthenticate@1
-                        displayName: 'Authenticate to registry: pypi.org'
-                        inputs:
-                          pythonUploadServiceConnection: 'PyPI Upload (azure-sdk token)'
-
                       - task: TwineAuthenticate@0
                         displayName: 'Authenticate to feed: ${{parameters.DevFeedName}}'
                         inputs:
                           artifactFeeds: ${{parameters.DevFeedName}}
 
-                      - script: |
-                          set -e
-                          twine upload --repository 'pypi' --config-file $(PYPIRC_PATH) $(Pipeline.Workspace)/${{parameters.ArtifactName}}/${{artifact.name}}/*.whl
-                          echo "Uploaded whl to pypi"
-                          twine upload --repository 'pypi' --config-file $(PYPIRC_PATH) $(Pipeline.Workspace)/${{parameters.ArtifactName}}/${{artifact.name}}/*.zip
-                          echo "Uploaded zip to pypi"
-                        displayName: 'Publish package to registry: pypi.org'
+                      - pwsh: |
+                          $esrpDirectory = "$(Pipeline.Workspace)/esrp-release/${{parameters.ArtifactName}}/${{artifact.name}}"
+                          New-Item -ItemType Directory -Force -Path $esrpDirectory
+
+                          Get-ChildItem -Path "$(Pipeline.Workspace)/${{parameters.ArtifactName}}/${{artifact.name}}" `
+                            | Where-Object { ($_.Name -like "*.zip" -or $_.Name -like "*.whl") } `
+                            | Copy-Item -Destination $esrpDirectory
+
+                          Get-ChildItem $esrpDirectory
+                        displayName: Isolate files for ESRP Publish
+
+                      - task: EsrpRelease@2
+                        displayName: 'Publish to ESRP'
+                        inputs:
+                          ConnectedServiceName: 'ESRP Release Service'
+                          Intent: 'PackageDistribution'
+                          ContentType: 'PyPI'
+                          PackageLocation: $(Pipeline.Workspace)/esrp-release/${{parameters.ArtifactName}}/${{artifact.name}}
+                          Owners: $(Build.RequestedForEmail)
+                          Approvers: $(Build.RequestedForEmail)
+                          ServiceEndpointUrl: 'https://api.esrp.microsoft.com'
+                          MainPublisher: 'ESRPRELPACMANTEST'
+                          DomainTenantId: '72f988bf-86f1-41af-91ab-2d7cd011db47'
 
                       - script: |
                           set -e