CI enabled flag (#33387)

* try ci_enabled flag

* try using a gh env var

* fix import

* set env var, add filter in discover_targeted_packages

* add Public param to ci.yml test

* retry setting env var

* pass through template

* missing paren

* don't look for Public in ci.yml

* try again

* remove unrecognized arg

* print vars

* try checking build.reason

* few fixes + prints

* try testing skip

* try more prints

* try more prints

* try more prints

* try nonempty packages list

* ignore discover_targeted_packages for now

* try again

* try again

* try no parameter

* missed import

* accidentally deleted other var

* try again

* fix

* test set PULLREQUEST

* missed var

* set var correctly

* don't fail docs step

* remove condition

* comment

* fake pull request run

* with discover targeted packages filter run

* remove print debugs

* try only publish artifacts if they exist for docs

* remove filter for now

* try again

* set in right tempalte

* switch to a service we actually want to disable

* formatting

* feedback

* block on release if ci_enabled=false

* test disabling ci for template, should block on release

* remove test setting from azure-template

* remove unused import and add small doc

Author: kristapratico

doc/eng_sys_checks.md

@@ -153,6 +153,8 @@ The various tooling abstracted by the environments within `eng/tox/tox.ini` take
 
 Packages with classifier `Development Status :: 7 - Inactive`, are **not** built by default and as such normal `checks` like `mypy` and `pylint` are also not run against them. Older "core" packages like `azure-common` and `azure-servicemanagement-legacy` are present, but excluded from the build due to this restriction.
 
+Additionally, packages with the pyproject.toml option `ci_enabled = false` will **skip** normal checks and tests. This is used for packages that are not yet compliant with certain CI checks. If `ci_enabled = false` is present in the package's pyproject.toml, it will be blocked from releasing until it is removed and all required CI checks pass.
+
 To temporarily **override** this restriction, a dev need only set the queue time variable: `ENABLE_PACKAGE_NAME`. The `-` in package names should be replaced by an `_`, as that is how the environment variable will be set on the actual CI machine anyway.
 
 - `ENABLE_AZURE_COMMON=true`

eng/pipelines/templates/stages/archetype-python-release.yml

@@ -46,6 +46,14 @@ stages:
                           PackageName: ${{artifact.name}}
                           ServiceName: ${{parameters.ServiceDirectory}}
                           ForRelease: true
+
+                    - task: PythonScript@0
+                      displayName: Verify CI enabled
+                      condition: succeeded()
+                      inputs:
+                        scriptPath: 'scripts/devops_tasks/verify_ci_enabled.py'
+                        arguments: '--package-name ${{ artifact.name }} --service ${{ parameters.ServiceDirectory }}'
+
                     - pwsh: |
                         Get-ChildItem -Recurse $(Pipeline.Workspace)/${{parameters.ArtifactName}}/${{artifact.name}}
                       workingDirectory: $(Pipeline.Workspace)

eng/pipelines/templates/steps/build-extended-artifacts.yml

@@ -86,10 +86,15 @@ steps:
       ArtifactPath: '$(Build.ArtifactStagingDirectory)'
       ArtifactName: 'packages_extended'
 
+  - pwsh: |
+      $directoryExists = Test-Path -Path "$(Build.SourcesDirectory)/_docs"
+      Write-Output "##vso[task.setvariable variable=DirectoryExists]$directoryExists"
+    displayName: Check if docs directory exists
+  
   - template: /eng/common/pipelines/templates/steps/publish-artifact.yml
     parameters:
       ArtifactPath: '$(Build.SourcesDirectory)/_docs'
-      CustomCondition: ${{ parameters.BuildDocs }}
+      CustomCondition: and(${{ parameters.BuildDocs }}, eq(variables['DirectoryExists'], 'True'))
       ArtifactName: 'documentation'
 
   - ${{if eq(variables['System.TeamProject'], 'internal') }}:

scripts/devops_tasks/verify_ci_enabled.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python
+
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+# --------------------------------------------------------------------------------------------
+
+import argparse
+import sys
+import os
+
+from ci_tools.environment_exclusions import get_config_setting
+
+root_dir = os.path.abspath(os.path.join(os.path.abspath(__file__), "..", "..", ".."))
+
+def verify_ci_enabled(package_name: str, package_path: str) -> None:
+    """Verifies that ci_enabled=false is not present in the package's pyproject.toml.
+    This prevents releasing packages that have disabled their CI.
+    """
+
+    ci_enabled = get_config_setting(package_path, "ci_enabled")
+    if ci_enabled is False:
+        print(
+            f"ci_enabled is set to false in {package_name}/pyproject.toml. " \
+            "You must remove this setting before releasing the package."
+        )
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description="Verifies ci_enabled=true or is not present in the package's pyproject.toml, Called from DevOps YAML Pipeline"
+    )
+
+    parser.add_argument(
+        "--package-name",
+        required=True,
+        help="name of package (accepts both formats: azure-service-package and azure_service_package)",
+    )
+    parser.add_argument(
+        "--service",
+        required=True,
+        help="name of the service for which to set the dev build id (e.g. keyvault)",
+    )
+
+    args = parser.parse_args()
+
+    package_name = args.package_name.replace("_", "-")
+    path_to_setup = os.path.join(root_dir, "sdk", args.service, package_name, "setup.py")
+    verify_ci_enabled(package_name, path_to_setup)

sdk/metricsadvisor/azure-ai-metricsadvisor/pyproject.toml

@@ -4,3 +4,4 @@ pylint = false
 pyright = false
 type_check_samples = false
 verifytypes = false
+ci_enabled = false

tools/azure-sdk-tools/ci_tools/environment_exclusions.py

@@ -5,6 +5,7 @@
 # Licensed under the MIT License. See License.txt in the project root for license information.
 # --------------------------------------------------------------------------------------------
 from ci_tools.parsing import get_config_setting
+from ci_tools.variables import in_public
 import os
 from typing import Any
 
@@ -42,6 +43,7 @@ def is_check_enabled(package_path: str, check: str, default: Any = True) -> bool
     In order:
      - Checks <CHECK>_OPT_OUT for package name.
      - Honors override variable if one is present: <PACKAGE_NAME>_<CHECK>. (Note the _ in the package name, `-` is not a valid env variable character.)
+     - Checks for `ci_enabled` flag in pyproject.toml and skips all checks if set to false.
      - Finally falls back to the pyproject.toml at package root (if one exists) for a tools setting enabling/disabling <check>.
     """
     if package_path.endswith("setup.py"):
@@ -50,6 +52,10 @@ def is_check_enabled(package_path: str, check: str, default: Any = True) -> bool
     if package_path == ".":
         package_path = os.getcwd()
 
+    ci_enabled = get_config_setting(package_path, "ci_enabled", default)
+    if not in_public() and ci_enabled is False:
+        return False
+
     # now pull the new pyproject.toml configuration
     config = get_config_setting(package_path, check.strip().lower(), default)
 

tools/azure-sdk-tools/ci_tools/variables.py

@@ -59,5 +59,14 @@ def in_ci() -> int:
     return 0
 
 
+def in_public() -> int:
+    # Returns 3 if the build originates from a pull request
+    # 0 otherwise
+    if os.getenv("BUILD_REASON") == "PullRequest" or os.getenv("GITHUB_EVENT_NAME") == "pull_request":
+        return 3
+
+    return 0
+
+
 DEV_BUILD_IDENTIFIER = os.getenv("SDK_DEV_BUILD_IDENTIFIER", "a")
 DEFAULT_BUILD_ID = os.getenv("GITHUB_RUN_ID", os.getenv("BUILD.BUILDID", os.getenv("SDK_BUILD_ID", "20220101.1")))