CHORE: Update 1ES ADO Pipelines

[bewithgaurav]

Work Item / Issue Reference

AB#40479

GitHub Issue: #<ISSUE_NUMBER>

---

Summary

Sync ADO Repo with GH
Changes:
This pull request introduces a comprehensive set of Secure Development Lifecycle (SDL) configuration files to the repository. These files establish baseline settings for automated security and compliance tools (TSA, CredScan, PoliCheck, Guardian), define which code paths and file types are included or excluded from scanning, and document the configuration for future maintenance. This setup helps ensure that only production code is scanned for credentials and terminology issues, while test, example, and documentation files are safely excluded.

SDL Tool Configuration and Documentation:

• Added .config/SDL_CONFIGURATION.md, providing detailed documentation for how TSA, CredScan, and PoliCheck are configured, what paths are included/excluded, and maintenance guidance for the team.
• Introduced .config/tsaoptions.json to configure Threat and Security Assessment (TSA) for the project, specifying project details, notification settings, and codebase scanning patterns.

Security and Compliance Exclusions:

• Added .config/CredScanSuppressions.json to suppress false positives from credential scanning in non-production code (tests, benchmarks, engineering, and pipeline files).
• Added .config/PolicheckExclusions.xml to exclude specific folders and files (tests, benchmarks, docs, examples, build artifacts, virtual environments, and standard documentation files) from politically incorrect term scanning.

Guardian Baseline Integration:

• Added .gdn/.gdnbaselines to establish Guardian security baselines, including signatures and metadata for compliance tracking.

[Copilot]

Pull Request Overview

This pull request updates the Azure DevOps (ADO) pipeline infrastructure for the mssql-python project by introducing comprehensive OneBranch 1ES pipeline configurations and Security Development Lifecycle (SDL) compliance tooling. The changes primarily focus on establishing automated build, release, and security scanning infrastructure while addressing CredScan compliance issues in test files.

Key Changes:

• Introduced complete OneBranch pipeline infrastructure for Windows, macOS, and Linux builds with security scanning integration
• Added SDL configuration files for TSA, CredScan, PoliCheck, and Guardian tools
• Updated test passwords to include "Test" prefix for CredScan compliance
• Removed unused custom __setattr__ implementation from module initialization

Reviewed Changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tests/test_012_connection_string_integration.py	Updated test password from P@ss;w}}rd to TestP@ss;w}}rd for CredScan compliance
tests/test_010_connection_string_parser.py	Updated test password from p@ss;w}}rd to TestP@ss;w}}rd for CredScan compliance
tests/test_003_connection.py	Added sys import and removed trailing whitespace
mssql_python/init.py	Removed custom __setattr__ implementation for lowercase setting
es-metadata.yml	Added 1ES metadata with service ownership and routing configuration
OneBranchPipelines/variables/*.yml	Added variable configuration files for common, build, signing, symbol, and OneBranch-specific settings
OneBranchPipelines/steps/*.yml	Added step templates for symbol publishing, malware scanning, and code signing
OneBranchPipelines/stages/*.yml	Added stage templates for Windows, macOS, and Linux builds
OneBranchPipelines/jobs/*.yml	Added job template for artifact consolidation
OneBranchPipelines/build-release-package-pipeline.yml	Main build pipeline with SDL scanning and multi-platform wheel building
OneBranchPipelines/official-release-pipeline.yml	Production release pipeline for PyPI publishing via ESRP
OneBranchPipelines/dummy-release-pipeline.yml	Test release pipeline using Maven ContentType for safe testing
.config/tsaoptions.json	TSA configuration for security issue tracking
.config/SDL_CONFIGURATION.md	Comprehensive SDL configuration documentation
.config/PolicheckExclusions.xml	PoliCheck exclusions for tests, docs, and configuration files
.config/CredScanSuppressions.json	CredScan suppressions for non-production code paths
.gdn/.gdnbaselines	Guardian security baseline signatures
.gdn/.gdnsuppress	Guardian suppression configuration
CONTRIBUTING.md	Minor formatting fix for Microsoft org members line

Comments suppressed due to low confidence (1)

tests/test_003_connection.py:24

• Import of 'sys' is not used.

import sys

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

📊 Code Coverage Report

🔥 Diff Coverage 100%

🎯 Overall Coverage 77%

📈 Total Lines Covered: 5065 out of 6536 📁 Project: mssql-python

---

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

No lines with coverage information in this diff.

---

📋 Files Needing Attention

📉 Files with overall lowest coverage (click to expand)

mssql_python.pybind.logger_bridge.cpp: 59.2%
mssql_python.helpers.py: 66.6%
mssql_python.row.py: 67.4%
mssql_python.pybind.ddbc_bindings.cpp: 70.4%
mssql_python.pybind.connection.connection.cpp: 76.3%
mssql_python.ddbc_bindings.py: 79.6%
mssql_python.pybind.connection.connection_pool.cpp: 79.6%
mssql_python.pybind.ddbc_bindings.h: 79.7%
mssql_python.connection.py: 82.5%
mssql_python.cursor.py: 83.6%

---

🔗 Quick Links

⚙️ Build Summary	📋 Coverage Details
View Azure DevOps Build	Browse Full Coverage Report