Address Copilot review: fix benchmark branch condition, switch to PublishPipelineArtifact@1; add TSA config, PostBuildCleanup, job retries

Author: RyAuld

.Pipelines/template-pipeline-stages.yml

@@ -68,6 +68,14 @@ stages:
         GdnBreakGdnToolCredScan: true
         GdnBreakGdnToolPoliCheck: true
 
+    - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
+      displayName: 'Publish Security Analysis Logs (TSA)'
+      condition: succeededOrFailed()
+
+    - task: mspremier.PostBuildCleanup.PostBuildCleanup-task.PostBuildCleanup@3
+      displayName: 'Clean agent directories'
+      condition: always()
+
 # ══════════════════════════════════════════════════════════════════════════════
 # Stage 1 · Validate — verify packageVersion matches msal/sku.py __version__
 #           Skipped when runPublish is false (PR / merge builds).
@@ -123,6 +131,7 @@ stages:
   jobs:
   - job: Test
     displayName: 'Run unit tests'
+    retries: 3
     pool:
       vmImage: ubuntu-latest
     strategy:

.Pipelines/tsaConfig.json

@@ -0,0 +1,17 @@
+{
+    "codebaseName": "MSAL Python",
+    "notificationAliases": [
+        "IdentityDevExDotnet@microsoft.com"
+    ],
+    "codebaseAdmins": [
+        "EUROPE\\aadidagt"
+    ],
+    "instanceUrl": "https://identitydivision.visualstudio.com",
+    "projectName": "IDDP",
+    "areaPath": "IDDP\\DevEx-Client-SDK\\Python",
+    "iterationPath": "IDDP\\Unscheduled",
+    "tools": [
+        "credscan",
+        "policheck"
+    ]
+}

azure-pipelines.yml

@@ -33,7 +33,12 @@ stages:
   condition: |
     and(
       succeeded('CI'),
-      eq(variables['Build.Reason'], 'IndividualCI')
+      eq(variables['Build.SourceBranch'], 'refs/heads/dev'),
+      or(
+        eq(variables['Build.Reason'], 'IndividualCI'),
+        eq(variables['Build.Reason'], 'BatchedCI'),
+        eq(variables['Build.Reason'], 'Manual')
+      )
     )
   jobs:
   - job: Benchmark
@@ -61,9 +66,9 @@ stages:
         pytest --benchmark-only --benchmark-json benchmark.json --log-cli-level INFO tests/test_benchmark.py
       displayName: 'Run benchmarks'
 
-    - task: PublishBuildArtifacts@1
+    - task: PublishPipelineArtifact@1
       displayName: 'Publish benchmark results'
       condition: succeededOrFailed()
       inputs:
-        PathtoPublish: 'benchmark.json'
-        ArtifactName: 'benchmark-results'
+        targetPath: 'benchmark.json'
+        artifact: 'benchmark-results'