centralise feed authentication for ADO pipelines (#27997)

eserscor · sanaa-hamel-microsoft · sanaa-hamel-microsoft · commit 93e3d614eedd · 2026-04-10T12:21:28.000-04:00
### Description

Centralise feed authentication &amp; setup for build systems on ADO build
pipelines.

### Motivation and Context

SDL requires official build pipelines use a single controlled feed for
external resources.

---------

Co-authored-by: Sanaa Hamel &lt;sanaahamel@microsoft.com&gt;
diff --git a/tools/ci_build/github/azure-pipelines/linux-gpu-tensorrt-cuda-minimal-ci-pipeline.yml b/tools/ci_build/github/azure-pipelines/linux-gpu-tensorrt-cuda-minimal-ci-pipeline.yml
@@ -67,10 +67,9 @@ jobs:
     clean: true
     submodules: none
 
-  - task: UsePythonVersion@0
-    inputs:
+  - template: templates/setup-feeds-and-python-steps.yml
+    parameters:
       versionSpec: '3.12'
-      addToPath: true
       architecture: 'x64'
 
   - template: templates/get-docker-image-steps.yml
diff --git a/tools/ci_build/github/azure-pipelines/nuget/templates/test_win.yml b/tools/ci_build/github/azure-pipelines/nuget/templates/test_win.yml
@@ -37,15 +37,9 @@ stages:
       value: '-Dorg.gradle.daemon=false'
 
     steps:
-    - task: UsePythonVersion@0
-      inputs:
-        versionSpec: '3.12'
-        addToPath: true
-        architecture: x64
-    - task: PipAuthenticate@1
-      displayName: 'Pip Authenticate'
-      inputs:
-        artifactFeeds: 'Lotus'
+    - template: ../../templates/setup-feeds-and-python-steps.yml
+      parameters:
+        architecture: 'x64'
 
     - task: NuGetToolInstaller@0
       displayName: Use Nuget 6.10.x
@@ -69,7 +63,7 @@ stages:
     - download: build
       displayName: 'Download Nuget'
       artifact: 'drop-signed-nuget-${{ parameters.ArtifactSuffix }}'
-   
+
 
     - template: get-nuget-package-version-as-variable.yml
       parameters:
diff --git a/tools/ci_build/github/azure-pipelines/post-merge-jobs.yml b/tools/ci_build/github/azure-pipelines/post-merge-jobs.yml
@@ -398,11 +398,9 @@ stages:
     - checkout: self
       submodules: false
 
-    - task: UsePythonVersion@0
-      inputs:
-        versionSpec: '3.12'
-        addToPath: true
-        architecture: x64
+    - template: templates/setup-feeds-and-python-steps.yml
+      parameters:
+        architecture: 'x64'
 
     - task: CmdLine@2
       displayName: 'Run build_custom_android_package.py'
@@ -432,11 +430,10 @@ stages:
       vmImage: "macOS-14"
 
     steps:
-    - task: UsePythonVersion@0
-      inputs:
+    - template: templates/setup-feeds-and-python-steps.yml
+      parameters:
         versionSpec: "3.12"
-        addToPath: true
-        architecture: "x64"
+        architecture: 'x64'
 
     - template: templates/use-xcode-version.yml
 
diff --git a/tools/ci_build/github/azure-pipelines/stages/jobs/react-natvie-andriod-e2e-test-job.yml b/tools/ci_build/github/azure-pipelines/stages/jobs/react-natvie-andriod-e2e-test-job.yml
@@ -23,12 +23,9 @@ jobs:
     ANDROID_AVD_HOME: $(Agent.TempDirectory)
   timeoutInMinutes: 90
   steps:
-  - task: UsePythonVersion@0
-    displayName: Use python 3.12
-    inputs:
-      versionSpec: "3.12"
-      addToPath: true
-      architecture: "x64"
+  - template: ../../templates/setup-feeds-and-python-steps.yml
+    parameters:
+      architecture: 'x64'
 
   - task: JavaToolInstaller@0
     displayName: Use jdk 17
diff --git a/tools/ci_build/github/azure-pipelines/stages/nuget-cuda-packaging-stage.yml b/tools/ci_build/github/azure-pipelines/stages/nuget-cuda-packaging-stage.yml
@@ -40,6 +40,9 @@ stages:
     steps:
     - checkout: self
       submodules: true
+
+    - template: ../templates/setup-feeds-and-python-steps.yml
+
     - template: ../templates/flex-downloadPipelineArtifact.yml
       parameters:
         StepName: 'Download Pipeline Artifact - NuGet'
@@ -72,16 +75,6 @@ stages:
         SpecificArtifact: ${{ parameters.SpecificArtifact }}
         BuildId: ${{ parameters.BuildId }}
 
-    - task: UsePythonVersion@0
-      displayName: 'Use Python'
-      inputs:
-        versionSpec: 3.12
-
-    - task: PipAuthenticate@1
-      displayName: 'Pip Authenticate'
-      inputs:
-        artifactFeeds: 'Lotus'
-
     - template: ../templates/set-version-number-variables-step.yml
 
     # Reconstruct the build dir
diff --git a/tools/ci_build/github/azure-pipelines/stages/nuget-linux-cuda-packaging-stage.yml b/tools/ci_build/github/azure-pipelines/stages/nuget-linux-cuda-packaging-stage.yml
@@ -30,11 +30,8 @@ stages:
     - name: CUDA_VERSION
       value: ${{ parameters.CudaVersion }}
     steps:
+    - template: ../templates/setup-feeds-and-python-steps.yml
     - template: ../templates/set-version-number-variables-step.yml
-    - task: UsePythonVersion@0
-      displayName: Use Python 3.12
-      inputs:
-        versionSpec: 3.12
     - template: ../templates/get-docker-image-steps.yml
       parameters:
         Dockerfile: tools/ci_build/github/linux/docker/inference/x86_64/default/cuda${{ variables.CUDA_VERSION_MAJOR }}/Dockerfile
@@ -90,10 +87,7 @@ stages:
     - checkout: self
       clean: true
       submodules: recursive
-    - task: UsePythonVersion@0
-      displayName: Use Python 3.12
-      inputs:
-        versionSpec: 3.12
+    - template: ../templates/setup-feeds-and-python-steps.yml
     - template: ../templates/get-docker-image-steps.yml
       parameters:
         Dockerfile: tools/ci_build/github/linux/docker/inference/x86_64/default/cuda${{ variables.CUDA_VERSION_MAJOR }}/Dockerfile
diff --git a/tools/ci_build/github/azure-pipelines/stages/nuget-win-cuda-packaging-stage.yml b/tools/ci_build/github/azure-pipelines/stages/nuget-win-cuda-packaging-stage.yml
@@ -127,6 +127,8 @@ stages:
     - checkout: onnxruntime-inference-examples # due to checkout multiple repos, the root directory is $(Build.SourcesDirectory)/onnxruntime-inference-examples
       submodules: false
 
+    - template: ../templates/setup-feeds-and-python-steps.yml
+
     - script: dir $(Build.SourcesDirectory)
     - template: ../templates/jobs/download_win_gpu_library.yml
       parameters:
diff --git a/tools/ci_build/github/azure-pipelines/stages/py-win-gpu-stage.yml b/tools/ci_build/github/azure-pipelines/stages/py-win-gpu-stage.yml
@@ -201,17 +201,11 @@ stages:
           clean: true
           submodules: none
 
-        - task: UsePythonVersion@0
-          inputs:
+        - template: ../templates/setup-feeds-and-python-steps.yml
+          parameters:
             versionSpec: ${{ parameters.PYTHON_VERSION }}
-            addToPath: true
             architecture: 'x64'
 
-        - task: PipAuthenticate@1
-          displayName: 'Pip Authenticate'
-          inputs:
-            artifactFeeds: 'Lotus'
-
         - template: ../templates/jobs/download_win_gpu_library.yml
           parameters:
             CudaVersion: ${{ parameters.CudaVersion }}
diff --git a/tools/ci_build/github/azure-pipelines/stages/py-win-webgpu-stage.yml b/tools/ci_build/github/azure-pipelines/stages/py-win-webgpu-stage.yml
@@ -155,17 +155,11 @@ stages:
           clean: true
           submodules: none
 
-        - task: UsePythonVersion@0
-          inputs:
+        - template: ../templates/setup-feeds-and-python-steps.yml
+          parameters:
             versionSpec: ${{ parameters.PYTHON_VERSION }}
-            addToPath: true
             architecture: 'x64'
 
-        - task: PipAuthenticate@1
-          displayName: 'Pip Authenticate'
-          inputs:
-            artifactFeeds: 'Lotus'
-
         - script: python -m pip install -r $(Build.SourcesDirectory)\tools\ci_build\github\windows\python\requirements.txt
           env:
             TMPDIR: "$(Agent.TempDirectory)"
diff --git a/tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml b/tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml
@@ -348,16 +348,7 @@ stages:
         DisplayName: 'ESRP - Sign C# dlls'
         DoEsrp: true
 
-    - task: UsePythonVersion@0
-      displayName: 'Use Python'
-      inputs:
-        versionSpec: 3.12
-
-    - task: PipAuthenticate@1
-      displayName: 'Pip Authenticate'
-      inputs:
-        artifactFeeds: 'Lotus'
-
+    - template: setup-feeds-and-python-steps.yml
 
     - task: MSBuild@1
       displayName: 'Build Nuget Packages'
diff --git a/tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml b/tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml
@@ -46,12 +46,10 @@ jobs:
     clean: true
     submodules: none
 
-  - ${{ if eq(parameters.OnnxruntimeArch, 'x64') }}:
-    # Only need to install Python on x64 agents as Python is pre-installed on arm64 agents
-    - task: UsePythonVersion@0
-      displayName: Use Python 3.12
-      inputs:
-        versionSpec: 3.12
+  # Authenticate to Lotus to pull pip in UsePythonVersion task
+  - template: ../templates/setup-feeds-and-python-steps.yml
+    parameters:
+      architecture: ${{ parameters.OnnxruntimeArch }}
 
   - template: set-version-number-variables-step.yml
   - ${{ if eq(parameters.OnnxruntimeArch, 'x64') }}:
diff --git a/tools/ci_build/github/azure-pipelines/templates/check_test_result.yml b/tools/ci_build/github/azure-pipelines/templates/check_test_result.yml
@@ -3,18 +3,12 @@ parameters:
   type: string
 
 steps:
-  - task: UsePythonVersion@0
-    inputs:
+
+  - template: setup-feeds-and-python-steps.yml
+    parameters:
       versionSpec: '3.x'
-      addToPath: true
       architecture: 'x64'
 
-  - task: PipAuthenticate@1
-    displayName: 'Pip Authenticate'
-    inputs:
-      artifactFeeds: 'Lotus'
-
-
   - task: PythonScript@0
     displayName: 'Check test result yml'
     inputs:
diff --git a/tools/ci_build/github/azure-pipelines/templates/foundry-local-nuget-packaging.yml b/tools/ci_build/github/azure-pipelines/templates/foundry-local-nuget-packaging.yml
@@ -58,15 +58,7 @@ stages:
         artifactName: 'onnxruntime-osx'
         targetPath: '$(Build.BinariesDirectory)/osx'
 
-    - task: UsePythonVersion@0
-      inputs:
-        versionSpec: '3.12'
-        addToPath: true
-
-    - task: PipAuthenticate@1
-      displayName: 'Pip Authenticate'
-      inputs:
-        artifactFeeds: 'Lotus'
+    - template: setup-feeds-and-python-steps.yml
 
     - task: PowerShell@2
       displayName: 'Create osx directories'
diff --git a/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-linux.yml b/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-linux.yml
@@ -12,10 +12,7 @@ steps:
       SecretsFilter: "java-pgp-pwd,java-pgp-key"
       RunAsPreJob: false
 
-  - task: UsePythonVersion@0
-    displayName: "Use Python 3.12"
-    inputs:
-      versionSpec: "3.12"
+  - template: setup-feeds-and-python-steps.yml
 
   - task: PythonScript@0
     displayName: "Sign files: GnuPG, sha1, and md5"
diff --git a/tools/ci_build/github/azure-pipelines/templates/jar-packaging.yml b/tools/ci_build/github/azure-pipelines/templates/jar-packaging.yml
@@ -15,15 +15,9 @@ steps:
 - checkout: self
   submodules: false
 
-- task: UsePythonVersion@0
-  inputs:
+- template: setup-feeds-and-python-steps.yml
+  parameters:
     versionSpec: '3.13'
-    addToPath: true
-
-- task: PipAuthenticate@1
-  displayName: 'Pip Authenticate'
-  inputs:
-    artifactFeeds: 'Lotus'
 
 - template: set-version-number-variables-step.yml
 
diff --git a/tools/ci_build/github/azure-pipelines/templates/linux-wasm-ci.yml b/tools/ci_build/github/azure-pipelines/templates/linux-wasm-ci.yml
@@ -84,10 +84,9 @@ jobs:
       git submodule update --init --recursive
     workingDirectory: '$(Build.SourcesDirectory)'
     displayName: 'Checkout submodules'
-  - task: UsePythonVersion@0
-    inputs:
-      versionSpec: '3.12'
-      addToPath: true
+  - template: templates/setup-feeds-and-python-steps.yml
+    parameters:
+      versionSpec: "3.12"
       architecture: $(buildArch)
   - task: NodeTool@0
     inputs:
diff --git a/tools/ci_build/github/azure-pipelines/templates/make_java_win_binaries.yml b/tools/ci_build/github/azure-pipelines/templates/make_java_win_binaries.yml
@@ -22,29 +22,35 @@ parameters:
 steps:
 - task: PowerShell@2
   displayName: 'Build and Package Java Artifacts'
+  env:
+    msbuild_platform: ${{ parameters.msbuildPlatform }}
+    java_artifact_id: ${{ parameters.java_artifact_id }}
+    pre_release_version_suffix_string: ${{ parameters.PreReleaseVersionSuffixString }}
+    pre_release_version_suffix_number: ${{ parameters.PreReleaseVersionSuffixNumber }}
+    build_only: ${{ parameters.buildOnly }}
   inputs:
     targetType: 'inline'
     script: |
       # Define arguments for the Python script
       $scriptArgs = @(
-        "--sources-dir", "$(Build.SourcesDirectory)",
-        "--binaries-dir", "$(Build.BinariesDirectory)",
-        "--platform", "${{ parameters.msbuildPlatform }}",
-        "--build-config", "RelWithDebInfo",
-        "--java-artifact-id", "${{ parameters.java_artifact_id }}",
-        "--pre-release-version-suffix-string", "${{ parameters.PreReleaseVersionSuffixString }}",
-        "--pre-release-version-suffix-number", "${{ parameters.PreReleaseVersionSuffixNumber }}",
-        "--commit-hash", "$(OnnxRuntimeGitCommitHash)"
+        "--sources-dir",                        "${env:BUILD_SOURCESDIRECTORY}",
+        "--binaries-dir",                       "${env:BUILD_BINARIESDIRECTORY}",
+        "--platform",                           "${env:msbuild_platform}",
+        "--build-config",                       "RelWithDebInfo",
+        "--java-artifact-id",                   "${env:java_artifact_id}",
+        "--pre-release-version-suffix-string",  "${env:pre_release_version_suffix_string}",
+        "--pre-release-version-suffix-number",  "${env:pre_release_version_suffix_number}",
+        "--commit-hash",                        "${env:ONNXRUNTIMEGITCOMMITHASH}"
       )
 
       # Conditionally add the --build-only flag if the parameter is true
-      if ('${{ parameters.buildOnly }}' -eq 'True') {
+      if (${env:build_only} -eq 'True') {
         $scriptArgs += "--build-only"
       }
 
       # Define the path to the python script within your repository
-      $scriptPath = "$(Build.SourcesDirectory)/tools/ci_build/manage_java_artifacts.py"
+      $scriptPath = "${env:BUILD_SOURCESDIRECTORY}/tools/ci_build/manage_java_artifacts.py"
 
       # Execute the Python script, passing all arguments
       Write-Host "Executing Python script: $scriptPath with arguments: $($scriptArgs -join ' ')"
-      python $scriptPath $scriptArgs
+      python $scriptPath $scriptArgs
diff --git a/tools/ci_build/github/azure-pipelines/templates/managed-nuget-for-foundry-local.yml b/tools/ci_build/github/azure-pipelines/templates/managed-nuget-for-foundry-local.yml
@@ -37,10 +37,7 @@ stages:
     steps:
     - template: set-version-number-variables-step.yml
 
-    - task: UsePythonVersion@0
-      displayName: 'Use Python'
-      inputs:
-        versionSpec: 3.12
+    - template: setup-feeds-and-python-steps.yml
 
     - task: DownloadPipelineArtifact@0
       displayName: 'Download Pipeline Artifact - win-x64'
diff --git a/tools/ci_build/github/azure-pipelines/templates/publish-nuget-steps.yml b/tools/ci_build/github/azure-pipelines/templates/publish-nuget-steps.yml
@@ -30,10 +30,7 @@ stages:
     - checkout: self
       submodules: false
 
-    - task: UsePythonVersion@0
-      inputs:
-        versionSpec: '3.12'
-        addToPath: true
+    - template: setup-feeds-and-python-steps.yml
 
     - template: set-version-number-variables-step.yml
 
@@ -130,5 +127,3 @@ stages:
         packageParentPath: '$(Build.BinariesDirectory)'
         publishVstsFeed: '2692857e-05ef-43b4-ba9c-ccf1c22c437c/7982ae20-ed19-4a35-a362-a96ac99897b7'
         allowPackageConflicts: true
-
-
diff --git a/tools/ci_build/github/azure-pipelines/templates/py-package-smoking-test.yml b/tools/ci_build/github/azure-pipelines/templates/py-package-smoking-test.yml
@@ -37,9 +37,8 @@ jobs:
   steps:
   - checkout: none
 
-  - task: UsePythonVersion@0
-    displayName: 'Use Python'
-    inputs:
+  - template: setup-feeds-and-python-steps.yml
+    parameters:
       versionSpec: $(PythonVersion)
 
   - download: build   # pipeline resource identifier.
diff --git a/tools/ci_build/github/azure-pipelines/templates/setup-build-tools.yml b/tools/ci_build/github/azure-pipelines/templates/setup-build-tools.yml
diff --git a/tools/ci_build/github/azure-pipelines/templates/setup-feeds-and-python-steps.yml b/tools/ci_build/github/azure-pipelines/templates/setup-feeds-and-python-steps.yml
diff --git a/tools/ci_build/github/azure-pipelines/templates/validate-package.yml b/tools/ci_build/github/azure-pipelines/templates/validate-package.yml
diff --git a/tools/ci_build/github/azure-pipelines/templates/win-wasm-ci.yml b/tools/ci_build/github/azure-pipelines/templates/win-wasm-ci.yml
