build: add Component Governance support

eng/ci/library-release.yml

@@ -32,6 +32,11 @@ extends:
       name: 1es-pool-azfunc
       image: 1es-windows-2022
       os: windows
+    sdl:
+      componentgovernance:
+        alertWarningLevel: Medium
+        failOnAlert: true
+        verbosity: Normal
 
     stages:
       - stage: ReleaseV1_BumpVersion

eng/ci/official-build.yml

@@ -38,6 +38,11 @@ extends:
       name: 1es-pool-azfunc
       image: 1es-windows-2022
       os: windows
+    sdl:
+      componentgovernance:
+        alertWarningLevel: Medium
+        failOnAlert: true
+        verbosity: Normal
 
     stages:
       - stage: Build

eng/ci/public-build.yml

@@ -36,6 +36,10 @@ extends:
          compiled:
            enabled: true # still only runs for default branch
          runSourceLanguagesInSourceAnalysis: true
+      componentgovernance:
+        alertWarningLevel: Medium
+        failOnAlert: true
+        verbosity: Normal
     settings:
       skipBuildTagsForGitHubPullRequests: ${{ variables['System.PullRequest.IsFork'] }}
 

eng/templates/jobs/build.yml

@@ -32,3 +32,4 @@ jobs:
           python -m pip install build
           python -m build
         displayName: 'Build Python SDK for $(PYTHON_VERSION)'
+      - template: /eng/templates/steps/generate-component-governance-requirements.yml@self

eng/templates/official/jobs/build-artifacts.yml

@@ -31,3 +31,4 @@ jobs:
           python -m pip install build
           python -m build
         displayName: 'Build Python SDK'
+      - template: /eng/templates/steps/generate-component-governance-requirements.yml@self

eng/templates/official/release/build-artifacts.yml

@@ -72,4 +72,7 @@ jobs:
           python -m pip install build
           cd ${{ parameters.projectDirectory }}
           python -m build
-        displayName: 'Build ${{ parameters.projectDisplayName }}'
+        displayName: 'Build ${{ parameters.projectDisplayName }}'
+      - template: /eng/templates/steps/generate-component-governance-requirements.yml@self
+        parameters:
+          projectDirectory: ${{ parameters.projectDirectory }}

eng/templates/steps/generate-component-governance-requirements.yml

@@ -0,0 +1,39 @@
+parameters:
+  - name: projectDirectory
+    type: string
+    default: '.'
+
+steps:
+  - bash: |
+      if ! python -c "import tomllib" 2>/dev/null; then
+        python -m pip install tomli
+      fi
+
+      python - <<'PY'
+      from pathlib import Path
+
+      try:
+          import tomllib
+      except ModuleNotFoundError:
+          import tomli as tomllib
+
+      pyproject = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
+      optional_dependencies = pyproject["project"].get("optional-dependencies", {})
+      requirements = [
+          *pyproject["build-system"].get("requires", []),
+          *pyproject["project"].get("dependencies", []),
+          *(
+              dependency
+              for group in optional_dependencies.values()
+              for dependency in group
+          ),
+      ]
+      requirements = list(dict.fromkeys(requirements))
+      Path("requirements.txt").write_text(
+          "\n".join(requirements) + "\n",
+          encoding="utf-8",
+      )
+      print(f"Generated requirements.txt with {len(requirements)} direct dependencies")
+      PY
+    displayName: 'Generate Component Governance requirements'
+    workingDirectory: $(Build.SourcesDirectory)/${{ parameters.projectDirectory }}