Do not review yet

.Pipelines/pipeline-unit-tests.yml

@@ -0,0 +1,154 @@
+# ADO pipeline that runs the msal Python test suite.
+# Unit tests run first (no secrets); E2E tests run after, with the MSID Lab
+# certificate fetched from Key Vault. Triggered on every push to the
+# working branch.
+
+trigger:
+  branches:
+    include:
+    - 4gust/ado-pipeline
+pr: none
+
+stages:
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Stage 1 · Unit tests — no Key Vault, no service connection.
+# ─────────────────────────────────────────────────────────────────────────────
+- stage: UnitTests
+  displayName: 'Unit tests'
+  jobs:
+  - job: Pytest
+    displayName: 'pytest (unit)'
+    pool:
+      vmImage: ubuntu-22.04
+    strategy:
+      matrix:
+        Python39:
+          python.version: '3.9'
+        Python310:
+          python.version: '3.10'
+        Python311:
+          python.version: '3.11'
+        Python312:
+          python.version: '3.12'
+        Python313:
+          python.version: '3.13'
+        Python314:
+          python.version: '3.14'
+    steps:
+    - task: UsePythonVersion@0
+      displayName: 'Use Python $(python.version)'
+      inputs:
+        versionSpec: '$(python.version)'
+
+    - script: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt
+        pip install pytest pytest-azurepipelines
+      displayName: 'Install Python dependencies'
+
+    - bash: |
+        mkdir -p test-results
+        set -o pipefail
+        pytest -vv \
+          --junitxml=test-results/junit.xml \
+          --ignore=tests/test_e2e.py \
+          --ignore=tests/test_e2e_manual.py \
+          --ignore=tests/test_fmi_e2e.py \
+          2>&1 | tee test-results/pytest.log
+      displayName: 'Run pytest (unit only)'
+
+    - task: PublishTestResults@2
+      displayName: 'Publish JUnit test results'
+      condition: succeededOrFailed()
+      inputs:
+        testResultsFormat: 'JUnit'
+        testResultsFiles: 'test-results/junit.xml'
+        failTaskOnFailedTests: true
+        testRunTitle: 'Unit tests · Python $(python.version)'
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Stage 2 · E2E tests — runs only if unit tests pass. Fetches the MSID Lab
+# certificate from Key Vault (mirrors MSAL.NET's
+# build/template-install-keyvault-secrets.yaml).
+# ─────────────────────────────────────────────────────────────────────────────
+- stage: E2ETests
+  displayName: 'E2E tests'
+  dependsOn: UnitTests
+  condition: succeeded()
+  jobs:
+  - job: Pytest
+    displayName: 'pytest (E2E)'
+    pool:
+      vmImage: ubuntu-22.04
+    strategy:
+      matrix:
+        Python39:
+          python.version: '3.9'
+        Python310:
+          python.version: '3.10'
+        Python311:
+          python.version: '3.11'
+        Python312:
+          python.version: '3.12'
+        Python313:
+          python.version: '3.13'
+        Python314:
+          python.version: '3.14'
+    steps:
+    - task: UsePythonVersion@0
+      displayName: 'Use Python $(python.version)'
+      inputs:
+        versionSpec: '$(python.version)'
+
+    - script: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt
+        pip install pytest pytest-azurepipelines
+      displayName: 'Install Python dependencies'
+
+    - task: AzureKeyVault@2
+      displayName: 'Fetch MSID Lab certificate from Key Vault'
+      inputs:
+        azureSubscription: 'AuthSdkResourceManager'
+        KeyVaultName: 'msidlabs'
+        SecretsFilter: 'LabAuth'
+        RunAsPreJob: false
+
+    - bash: |
+        set -euo pipefail
+        if [ -z "${LAB_AUTH_B64:-}" ]; then
+          echo "##vso[task.logissue type=error]LabAuth secret is empty — Key Vault retrieval failed."
+          exit 1
+        fi
+        CERT_PATH="$(Agent.TempDirectory)/lab-auth.pfx"
+        printf '%s' "$LAB_AUTH_B64" | base64 -d > "$CERT_PATH"
+        echo "##vso[task.setvariable variable=LAB_APP_CLIENT_CERT_PFX_PATH]$CERT_PATH"
+        echo "Lab cert written to: $CERT_PATH ($(wc -c < "$CERT_PATH") bytes)"
+      displayName: 'Decode lab certificate to PFX'
+      env:
+        LAB_AUTH_B64: $(LabAuth)
+
+    - bash: |
+        mkdir -p test-results
+        set -o pipefail
+        pytest -vv \
+          --junitxml=test-results/junit.xml \
+          tests/test_e2e.py tests/test_fmi_e2e.py \
+          2>&1 | tee test-results/pytest.log
+      displayName: 'Run pytest (E2E only)'
+      env:
+        LAB_APP_CLIENT_CERT_PFX_PATH: $(LAB_APP_CLIENT_CERT_PFX_PATH)
+
+    - task: PublishTestResults@2
+      displayName: 'Publish JUnit test results'
+      condition: succeededOrFailed()
+      inputs:
+        testResultsFormat: 'JUnit'
+        testResultsFiles: 'test-results/junit.xml'
+        failTaskOnFailedTests: true
+        testRunTitle: 'E2E tests · Python $(python.version)'
+
+    - bash: rm -f "$(Agent.TempDirectory)/lab-auth.pfx"
+      displayName: 'Remove lab certificate from agent'
+      condition: always()