FEAT: Add conda packaging recipes and publish tooling for mssql-python

.github/workflows/conda-audit.yml

@@ -0,0 +1,85 @@
+---
+# N3: PR-triggered conda build + masking-immune RUNPATH audit.
+#
+# The OneBranch conda-build pipeline is `trigger: none` / `pr: none`, so its blocking
+# audit never runs on a PR. This lightweight GitHub Actions job builds ONE real
+# linux-64 conda package from the SHIPPED PyPI wheels and runs
+# eng/scripts/audit_bundled_binaries.py on it, so a regression in the $ORIGIN climb,
+# the declared conda deps (krb5/libtool/openssl), or the expected DT_NEEDED set fails
+# the PR automatically -- the full-agent runtime masking cannot hide it.
+#
+# The PyPI mssql-python-odbc binaries are not yet pre-baked with the climb, so the
+# recipe's assertion-only default would (correctly) refuse to mutate them; this PR
+# gate sets CONDA_ALLOW_UNSIGNED_PATCH=1 to build a DEV-patched climb and audit THAT.
+# The signed release path stays assertion-only (see conda/mssql-python/build.sh).
+name: conda-audit
+
+on:
+  pull_request:
+    paths:
+      - 'conda/**'
+      - 'eng/scripts/audit_bundled_binaries.py'
+      - 'OneBranchPipelines/scripts/build-conda-packages.sh'
+      - 'tests/test_027_conda_release_metadata.py'
+      - 'tests/test_029_bundled_binary_audit.py'
+      - '.github/workflows/conda-audit.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  linux-conda-audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Unit-test the audit + release validator
+        run: |
+          python -m pip install --quiet pytest zstandard
+          # --noconftest: tests/conftest.py imports mssql_python (the native ddbc_bindings
+          # extension), which is NOT built in this repackage-only gate. test_027/test_029
+          # are pure conda validator/audit tests using only built-in fixtures, so skip
+          # conftest to avoid that unrelated import.
+          python -m pytest --noconftest \
+                           tests/test_029_bundled_binary_audit.py \
+                           tests/test_027_conda_release_metadata.py -q
+
+      - name: Fetch the shipped linux wheels from PyPI
+        run: |
+          set -euo pipefail
+          mkdir -p wheels
+          # --no-deps: pull ONLY the two wheels we repackage (not azure-identity etc).
+          python -m pip download --no-deps mssql-python mssql-python-odbc -d wheels
+          echo "Downloaded:"; ls -1 wheels
+
+      - name: Build + audit a linux-64 conda package
+        env:
+          # PyPI odbc binaries are not pre-baked; build a DEV-patched climb here and
+          # audit it. NEVER used on the signed release path.
+          CONDA_ALLOW_UNSIGNED_PATCH: '1'
+        run: |
+          set -euo pipefail
+          mssql_whl="$(ls wheels/mssql_python-*.whl | grep -v mssql_python_odbc | head -1)"
+          odbc_whl="$(ls wheels/mssql_python_odbc-*.whl | head -1)"
+          MSSQL_VER="$(basename "$mssql_whl" | sed -nE 's/^mssql_python-([^-]+)-.*/\1/p')"
+          ODBC_VER="$(basename "$odbc_whl" | sed -nE 's/^mssql_python_odbc-([^-]+)-.*/\1/p')"
+          echo "mssql-python=$MSSQL_VER  mssql-python-odbc=$ODBC_VER"
+          bash OneBranchPipelines/scripts/build-conda-packages.sh \
+            "$PWD/wheels" \
+            "$PWD/conda" \
+            "$RUNNER_TEMP/conda-bld" \
+            "$MSSQL_VER" \
+            "$ODBC_VER" \
+            "3.11" \
+            "linux-64"
+
+      - name: Explicit standalone audit of the built package
+        run: |
+          set -euo pipefail
+          python -m pip install --quiet zstandard
+          python eng/scripts/audit_bundled_binaries.py --root "$RUNNER_TEMP/conda-bld/bld"