Add SBOMs generation for Windows artifacts

[sethmlarson]

Requires python/cpython#115789 to be checked in to work.

• Does checkout.yml essentially pull CPython's source code into the release-tools directory?
• Do the Windows artifacts have pip included? I couldn't find it in ensurepip for the embed artifacts
• Is it possible to run Azure Pipelines off of a branch besides master so I can test this code before enabling it for future releases?

cc @zooba

[zooba]

Does checkout.yml essentially pull CPython's source code into the release-tools directory?

Best to assume it clones into $(Build.SourcesDirectory) or else just the default current working directory.

Do the Windows artifacts have pip included? I couldn't find it in ensurepip for the embed artifacts

I think we get it from ensurepip? The embedded distro does not, as it's not really the point (you'd install packages when you build your app and then redistribute the whole thing ready to go).

• Is it possible to run Azure Pipelines off of a branch besides master so I can test this code before enabling it for future releases?

Yes, but much easier if you push to the main repo rather than a fork. Then your branch will appear in the dropdown when you go to queue the build.

To run from a fork you'd need to change the repo it's associated with, which would upset me because I'm also working in this pipeline at the moment and it would spoil my testing 😆

[zooba]

Any reason we wouldn't/shouldn't just do all of them? (Omitting the select -First 1 should pass them all as separate args, and then sys.argv[1:] in Python can get them all.)

[zooba]

Suggested change

	- task: PublishPipelineArtifact@0
	displayName: 'Publish artifact: sbom'
	inputs:
	targetPath: '$(Build.BinariesDirectory)\sbom'
	artifactName: sbom
	- publish: '$(Build.BinariesDirectory)\sbom'
	artifact: sbom
	displayName: 'Publish artifact: sbom'

This is the preferred format for simple cases now (should auto-update when they need to make changes to the publish task).

[zooba]

I assume we're going to get chances to this template as well to SSH the files up to the server?

[sethmlarson]

Yeah that's the plan, I might do that in a follow-up PR though. Maybe I'll remove this dependsOn for now.

[sethmlarson]

Thanks for the review @zooba, I've closed this PR and created a new one on this repo for easier testing and addressed your comments in the new PR.