CHORE: lock release build dependencies

[Sumit Sarabhai (sumitmsft)]

Work Item / Issue Reference

AB#47861

---

Summary

Locks the Python dependencies used by daily and release artifact builds to exact versions and SHA-256 hashes across Linux, macOS, Windows, and ODBC packaging.

Adds a Monday refresh workflow that regenerates platform-specific locks, validates wheel compatibility across the supported build matrix, and opens one reviewed update PR.

Validation

• Built the Windows x64 native wheel with locked dependencies.
• Passed dependency tests: 35 passed, 3 skipped.
• Built and validated the ODBC wheel with locked tooling.
• Validated hash-locked dependency resolution across the supported Linux and Windows matrices.
• The draft PR will run PR-safe GitHub lock validation and a NonOfficial OneBranch build before merge.

[github-actions]

📊 Code Coverage Report

🔥 Diff Coverage 100%

🎯 Overall Coverage 82%

📈 Total Lines Covered: 8191 out of 9889 📁 Project: mssql-python

---

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

No lines with coverage information in this diff.

---

📋 Files Needing Attention

📉 Files with overall lowest coverage (click to expand)

mssql_python.pybind.performance_counter.hpp: 0.7%
mssql_python.pybind.logger_bridge.cpp: 57.9%
mssql_python.pybind.ddbc_bindings.h: 61.5%
mssql_python.pybind.logger_bridge.hpp: 70.8%
mssql_python.row.py: 77.6%
mssql_python.pybind.ddbc_bindings.cpp: 77.7%
mssql_python.pybind.connection.connection_pool.cpp: 81.8%
mssql_python.logging.py: 85.5%
mssql_python.helpers.py: 89.3%
mssql_python.pooling.py: 90.1%

---

🔗 Quick Links

⚙️ Build Summary	📋 Coverage Details
View Azure DevOps Build	Browse Full Coverage Report

[Copilot]

🔵 Needs a closer look

It changes release-critical build/pipeline behavior and introduces scheduled automation with write permissions, warranting final human review despite appearing internally consistent.

Pull request overview

Locks the Python toolchain dependencies used by the OneBranch release build/test pipelines (and ODBC packaging) to fully pinned, SHA-256-hashed lockfiles, and adds a GitHub workflow + contract tests to keep those locks refreshed and enforce their use across platforms.

Changes:

• Replaces ad-hoc pip install invocations in OneBranch build stages with --require-hashes -r eng/requirements-*.txt installs.
• Adds platform-specific .in inputs and compiled .txt lockfiles (pins + hashes) for Linux, macOS, Windows, plus a Linux test environment lock.
• Adds a scheduled “refresh build dependencies” GitHub Actions workflow and a new pytest contract suite to validate lock/pipeline/workflow invariants.

File summaries

File	Description
tests/test_release_build_dependencies.py	Adds contract tests enforcing exact pins + hashes, pipeline consumption of locks, and workflow PR-safety/immutability.
OneBranchPipelines/stages/build-linux-single-stage.yml	Switches Linux build/test dependency installation to hash-locked requirements files.
OneBranchPipelines/stages/build-macos-single-stage.yml	Switches macOS dependency installation to a hash-locked build requirements file.
OneBranchPipelines/stages/build-windows-single-stage.yml	Switches Windows dependency installation to a hash-locked build requirements file and removes redundant pip upgrade steps.
OneBranchPipelines/stages/build-odbc-all-stage.yml	Switches ODBC build tooling installation to a hash-locked requirements file.
eng/requirements-build-linux.in	Defines the direct Linux build dependency inputs for lock generation.
eng/requirements-build-linux.txt	Adds the compiled Linux build lock with pins + SHA-256 hashes.
eng/requirements-test-linux.in	Defines the combined Linux test environment inputs (build + runtime).
eng/requirements-test-linux.txt	Adds the compiled Linux test lock with pins + SHA-256 hashes.
eng/requirements-build-macos.in	Defines macOS build inputs (including the cryptography<49 constraint).
eng/requirements-build-macos.txt	Adds the compiled macOS build lock with pins + SHA-256 hashes.
eng/requirements-build-windows.in	Defines the direct Windows build dependency inputs for lock generation.
eng/requirements-build-windows.txt	Adds the compiled Windows build lock with pins + SHA-256 hashes.
eng/requirements-build-odbc.in	Defines the direct ODBC packaging tooling inputs for lock generation.
eng/requirements-build-odbc.txt	Adds the compiled ODBC tooling lock with pins + SHA-256 hashes.
.github/workflows/refresh-build-dependencies.yml	Adds a scheduled + PR-safe workflow to regenerate locks, validate compatibility across the build matrix, and open a single tracked refresh PR.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Gaurav Sharma (bewithgaurav)]

this closes most of the gap, but linux can still pull in packages that were not
reviewed during a release build. requesting changes so the same protection
applies everywhere.

[Sumit Sarabhai (sumitmsft)]

this closes most of the gap, but linux can still pull in packages that were not reviewed during a release build. requesting changes so the same protection applies everywhere.

Are you specifically referring to:

azure-identity==1.25.3
mssql-python-odbc==18.6.2.1

I see these are the only two packages which are remaining. Linux installs the newly built mssql-python wheel before applying the test lock. That wheel declares azure-identity>=1.12.0 and mssql-python-odbc==,,,;

Can you tell me which packages are you referring to in case I am missing anything? Gaurav Sharma (@bewithgaurav)

[Copilot]

🟢 Approval recommended

The changes consistently enforce hash-locked dependency installs across pipelines and add automated refresh + contract tests without introducing correctness or safety issues in the reviewed diffs.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes release-critical dependency installation and introduces automation that writes to the repository and opens PRs, which warrants final human review of operational/release implications.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes release build/install behavior across multiple platforms and introduces large lock/automation contracts that warrant a final human validation pass for pipeline safety and operational impact.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The macOS build lock input (eng/requirements-build-macos.in) omits required build/test tools (notably pybind11, pytest, and setuptools), which can break the macOS pipeline’s locked install and undermines reproducibility.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes high-impact release pipelines and introduces scheduled automation with write permissions, so a final human review of operational and security implications is warranted before approval.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes dependency resolution for multiple release pipelines and introduces new lock/refresh automation, which is operationally high impact and should receive final human review.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes cross-platform release pipeline dependency bootstrapping and introduces new lock-refresh automation with write permissions, so a final human review of end-to-end CI outcomes is warranted.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes release-critical pipeline dependency installation and introduces new lockfile/refresh automation that should receive final human validation despite tests.

Review details

• Files reviewed: 14/16 changed files
• Comments generated: 1
• Review effort level: Lite