CHORE: lock release build dependencies

[Sumit Sarabhai (sumitmsft)]

Work Item / Issue Reference

AB#47861

---

Summary

Locks the Python dependencies used by daily and release artifact builds to exact versions and SHA-256 hashes across Linux, macOS, Windows, and ODBC packaging.

Adds a Monday refresh workflow that regenerates platform-specific locks, validates wheel compatibility across the supported build matrix, and opens one reviewed update PR.

Validation

• Built the Windows x64 native wheel with locked dependencies.
• Passed dependency tests: 35 passed, 3 skipped.
• Built and validated the ODBC wheel with locked tooling.
• Validated hash-locked dependency resolution across the supported Linux and Windows matrices.
• The draft PR will run PR-safe GitHub lock validation and a NonOfficial OneBranch build before merge.

[github-actions]

📊 Code Coverage Report

🔥 Diff Coverage 100%

🎯 Overall Coverage 83%

📈 Total Lines Covered: 7959 out of 9522 📁 Project: mssql-python

---

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

No lines with coverage information in this diff.

---

📋 Files Needing Attention

📉 Files with overall lowest coverage (click to expand)

mssql_python.pybind.logger_bridge.cpp: 57.9%
mssql_python.pybind.ddbc_bindings.h: 61.5%
mssql_python.pybind.logger_bridge.hpp: 70.8%
mssql_python.pybind.ddbc_bindings.cpp: 77.5%
mssql_python.row.py: 77.6%
mssql_python.pybind.connection.connection_pool.cpp: 81.6%
mssql_python.pybind.connection.connection.cpp: 84.4%
mssql_python.logging.py: 85.5%
mssql_python.helpers.py: 89.3%
mssql_python.pooling.py: 90.1%

---

🔗 Quick Links

⚙️ Build Summary	📋 Coverage Details
View Azure DevOps Build	Browse Full Coverage Report

[Copilot]

🔵 Needs a closer look

It changes release-critical build/pipeline behavior and introduces scheduled automation with write permissions, warranting final human review despite appearing internally consistent.

Pull request overview

Locks the Python toolchain dependencies used by the OneBranch release build/test pipelines (and ODBC packaging) to fully pinned, SHA-256-hashed lockfiles, and adds a GitHub workflow + contract tests to keep those locks refreshed and enforce their use across platforms.

Changes:

• Replaces ad-hoc pip install invocations in OneBranch build stages with --require-hashes -r eng/requirements-*.txt installs.
• Adds platform-specific .in inputs and compiled .txt lockfiles (pins + hashes) for Linux, macOS, Windows, plus a Linux test environment lock.
• Adds a scheduled “refresh build dependencies” GitHub Actions workflow and a new pytest contract suite to validate lock/pipeline/workflow invariants.

File summaries

File	Description
tests/test_release_build_dependencies.py	Adds contract tests enforcing exact pins + hashes, pipeline consumption of locks, and workflow PR-safety/immutability.
OneBranchPipelines/stages/build-linux-single-stage.yml	Switches Linux build/test dependency installation to hash-locked requirements files.
OneBranchPipelines/stages/build-macos-single-stage.yml	Switches macOS dependency installation to a hash-locked build requirements file.
OneBranchPipelines/stages/build-windows-single-stage.yml	Switches Windows dependency installation to a hash-locked build requirements file and removes redundant pip upgrade steps.
OneBranchPipelines/stages/build-odbc-all-stage.yml	Switches ODBC build tooling installation to a hash-locked requirements file.
eng/requirements-build-linux.in	Defines the direct Linux build dependency inputs for lock generation.
eng/requirements-build-linux.txt	Adds the compiled Linux build lock with pins + SHA-256 hashes.
eng/requirements-test-linux.in	Defines the combined Linux test environment inputs (build + runtime).
eng/requirements-test-linux.txt	Adds the compiled Linux test lock with pins + SHA-256 hashes.
eng/requirements-build-macos.in	Defines macOS build inputs (including the cryptography<49 constraint).
eng/requirements-build-macos.txt	Adds the compiled macOS build lock with pins + SHA-256 hashes.
eng/requirements-build-windows.in	Defines the direct Windows build dependency inputs for lock generation.
eng/requirements-build-windows.txt	Adds the compiled Windows build lock with pins + SHA-256 hashes.
eng/requirements-build-odbc.in	Defines the direct ODBC packaging tooling inputs for lock generation.
eng/requirements-build-odbc.txt	Adds the compiled ODBC tooling lock with pins + SHA-256 hashes.
.github/workflows/refresh-build-dependencies.yml	Adds a scheduled + PR-safe workflow to regenerate locks, validate compatibility across the build matrix, and open a single tracked refresh PR.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Gaurav Sharma (bewithgaurav)]

this closes most of the gap, but linux can still pull in packages that were not
reviewed during a release build. requesting changes so the same protection
applies everywhere.

[Sumit Sarabhai (sumitmsft)]

this closes most of the gap, but linux can still pull in packages that were not reviewed during a release build. requesting changes so the same protection applies everywhere.

Are you specifically referring to:

azure-identity==1.25.3
mssql-python-odbc==18.6.2.1

I see these are the only two packages which are remaining. Linux installs the newly built mssql-python wheel before applying the test lock. That wheel declares azure-identity>=1.12.0 and mssql-python-odbc==,,,;

Can you tell me which packages are you referring to in case I am missing anything? Gaurav Sharma (@bewithgaurav)

[Copilot]

🟢 Approval recommended

The changes consistently enforce hash-locked dependency installs across pipelines and add automated refresh + contract tests without introducing correctness or safety issues in the reviewed diffs.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes release-critical dependency installation and introduces automation that writes to the repository and opens PRs, which warrants final human review of operational/release implications.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The Linux release stage still installs the built wheel in a way that can resolve dependencies from an index, undermining the “immutable/no-PyPI” contract the PR is establishing.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (2)

OneBranchPipelines/stages/build-linux-single-stage.yml:384

• Same as the manylinux branch: installing the built wheel without --no-index can silently pull mssql-python-odbc (or other deps) from an index if local artifacts are missing. Add --no-index to force resolution from the local wheel cache/find-links only.

                    # Install the reviewed runtime/test closure first so installing
                    # mssql-python cannot resolve Azure Identity dependencies from PyPI.
                    $PY -m pip install -q --require-hashes -r /workspace/eng/requirements-test-linux.txt;
                    echo "Installing: $WHEEL";
                    $PY -m pip install -q "$WHEEL";

tests/test_release_build_dependencies.py:258

• If the Linux pipeline wheel install is updated to use --no-index, this expected command string must be updated as well; otherwise this test will no longer match the pipeline script.

    wheel_install = '$PY -m pip install -q "$WHEEL";'

• Files reviewed: 14/16 changed files
• Comments generated: 2
• Review effort level: Lite

[Gaurav Sharma (bewithgaurav)]

lgtm