Cherry-pick round 1

.github/workflows/build-cs-steps.yml

@@ -41,16 +41,41 @@ jobs:
         env:
           NUGET_AUTH_TOKEN: ${{ secrets.AZURE_DEVOPS_PAT }}
 
+      - name: Generate temporary NuGet.config
+        run: |
+          # The repo-level NuGet.config cleared all sources and only included ORT-Nightly.
+          # We generate a temporary one with both nuget.org and ORT-Nightly.
+          # We provide credentials to allow the ORT-Nightly feed to pull from its upstreams.
+          $xml = @"
+          <?xml version="1.0" encoding="utf-8"?>
+          <configuration>
+            <packageSources>
+              <clear />
+              <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+              <add key="ORT-Nightly" value="https://pkgs.dev.azure.com/aiinfra/PublicPackages/_packaging/ORT-Nightly/nuget/v3/index.json" />
+            </packageSources>
+            <packageSourceCredentials>
+              <ORT-Nightly>
+                <add key="Username" value="az" />
+                <add key="ClearTextPassword" value="${{ secrets.ORT_NIGHTLY_PAT }}" />
+              </ORT-Nightly>
+            </packageSourceCredentials>
+          </configuration>
+          "@
+          Set-Content -Path sdk/cs/NuGet.temp.config -Value $xml
+        shell: pwsh
+
       # TODO: once the nightly packaging is fixed, add back the commented out lines with /p:FoundryLocalCoreVersion="*-*"
       # /p:FoundryLocalCoreVersion="*-*" to always use nightly version of Foundry Local Core
       - name: Restore dependencies
         run: |
-          # dotnet restore sdk/cs/src/Microsoft.AI.Foundry.Local.csproj /p:UseWinML=${{ inputs.useWinML }} /p:FoundryLocalCoreVersion="*-*" --configfile sdk/cs/NuGet.config
-          dotnet restore sdk/cs/src/Microsoft.AI.Foundry.Local.csproj /p:UseWinML=${{ inputs.useWinML }} --configfile sdk/cs/NuGet.config
+          # Clear the local NuGet cache to avoid bad metadata or corrupted package states.
+          dotnet nuget locals all --clear
+          # Restore using the temporary config file with credentials.
+          dotnet restore sdk/cs/src/Microsoft.AI.Foundry.Local.csproj /p:UseWinML=${{ inputs.useWinML }} --configfile sdk/cs/NuGet.temp.config
 
       - name: Build solution
         run: |
-          # dotnet build sdk/cs/src/Microsoft.AI.Foundry.Local.csproj --no-restore --configuration ${{ inputs.buildConfiguration }} /p:UseWinML=${{ inputs.useWinML }} /p:FoundryLocalCoreVersion="*-*"
           dotnet build sdk/cs/src/Microsoft.AI.Foundry.Local.csproj --no-restore --configuration ${{ inputs.buildConfiguration }} /p:UseWinML=${{ inputs.useWinML }}
 
       # need to use direct git commands to clone from Azure DevOps instead of actions/checkout
@@ -86,6 +111,7 @@ jobs:
       - name: Run Foundry Local Core tests
         run: |
           # dotnet test sdk/cs/test/FoundryLocal.Tests/Microsoft.AI.Foundry.Local.Tests.csproj --verbosity normal /p:UseWinML=${{ inputs.useWinML }} /p:FoundryLocalCoreVersion="*-*"
+          # Use the temporary config file for test restore as well.
           dotnet test sdk/cs/test/FoundryLocal.Tests/Microsoft.AI.Foundry.Local.Tests.csproj --verbosity normal /p:UseWinML=${{ inputs.useWinML }}
 
       - name: Pack NuGet package

.github/workflows/build-js-steps.yml

@@ -84,22 +84,18 @@ jobs:
           Write-Host "`nDirectory contents:"
           Get-ChildItem -Recurse -Depth 2 | ForEach-Object { Write-Host "  $($_.FullName)" }
 
-
-      - name: npm install (WinML)
-        if: ${{ inputs.useWinML == true }}
+      # The .npmrc points to an Azure Artifacts feed for CFS compliance.
+      # Remove it in CI so npm uses the public registry directly.
+      - name: Remove .npmrc (use public registry)
+        shell: pwsh
         working-directory: sdk/js
-        run: npm install --winml
+        run: |
+          if (Test-Path .npmrc) { Remove-Item .npmrc -Force; Write-Host "Removed .npmrc" }
 
-      - name: npm install (Standard)
-        if: ${{ inputs.useWinML == false }}
+      - name: npm install
         working-directory: sdk/js
         run: npm install
 
-      # Verify that installing new packages doesn't strip custom native binary folders
-      - name: npm install openai (verify persistence)
-        working-directory: sdk/js
-        run: npm install openai
-
       - name: Set package version
         working-directory: sdk/js
         run: npm version ${{ env.ProjectVersion }} --no-git-tag-version --allow-same-version
@@ -112,21 +108,15 @@ jobs:
         working-directory: sdk/js
         run: npm run build
 
-      - name: Pack npm package
+      - name: Pack npm package (WinML)
+        if: ${{ inputs.useWinML == true }}
         working-directory: sdk/js
-        run: npm pack
+        run: npm run pack:winml
 
-      - name: Rename WinML artifact
-        if: ${{ inputs.useWinML == true }}
-        shell: pwsh
+      - name: Pack npm package (Standard)
+        if: ${{ inputs.useWinML == false }}
         working-directory: sdk/js
-        run: |
-          $tgz = Get-ChildItem *.tgz | Select-Object -First 1
-          if ($tgz) {
-              $newName = $tgz.Name -replace '^foundry-local-sdk-', 'foundry-local-sdk-winml-'
-              Rename-Item -Path $tgz.FullName -NewName $newName
-              Write-Host "Renamed $($tgz.Name) to $newName"
-          }
+        run: npm run pack
 
       - name: Upload npm packages
         uses: actions/upload-artifact@v4

.github/workflows/build-python-steps.yml

@@ -0,0 +1,110 @@
+name: Build Python SDK
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      useWinML:
+        required: false
+        type: boolean
+        default: false
+      platform:
+        required: false
+        type: string
+        default: 'windows'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ${{ inputs.platform }}-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          clean: true
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      # Clone test-data-shared from Azure DevOps (models for integration tests)
+      - name: Checkout test-data-shared from Azure DevOps
+        shell: pwsh
+        working-directory: ${{ github.workspace }}/..
+        run: |
+          $pat = "${{ secrets.AZURE_DEVOPS_PAT }}"
+          $encodedPat = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$pat"))
+
+          git config --global http.https://dev.azure.com.extraheader "AUTHORIZATION: Basic $encodedPat"
+
+          git lfs install
+          git clone --depth 1 https://dev.azure.com/microsoft/windows.ai.toolkit/_git/test-data-shared test-data-shared
+
+          Write-Host "Clone completed successfully to ${{ github.workspace }}/../test-data-shared"
+
+      - name: Checkout specific commit in test-data-shared
+        shell: pwsh
+        working-directory: ${{ github.workspace }}/../test-data-shared
+        run: |
+          git checkout 231f820fe285145b7ea4a449b112c1228ce66a41
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "Git checkout failed."
+            exit 1
+          }
+
+      - name: Install build tool
+        run: |
+          python -m pip install build
+
+      - name: Configure pip for Azure Artifacts
+        run: |
+          pip config set global.index-url https://pkgs.dev.azure.com/aiinfra/PublicPackages/_packaging/ORT-Nightly/pypi/simple/
+          pip config set global.extra-index-url https://pypi.org/simple/
+          pip config set global.pre true
+
+      - name: Set package version
+        working-directory: sdk/python
+        run: echo '__version__ = "${{ inputs.version }}"' > src/version.py
+
+      - name: Build wheel (Cross-Platform)
+        if: ${{ inputs.useWinML == false }}
+        working-directory: sdk/python
+        run: python -m build --wheel --outdir dist/
+
+      - name: Build wheel (WinML)
+        if: ${{ inputs.useWinML == true }}
+        working-directory: sdk/python
+        run: python -m build --wheel -C winml=true --outdir dist/
+
+      - name: Install built wheel
+        working-directory: sdk/python
+        shell: pwsh
+        run: |
+          $wheel = (Get-ChildItem dist/*.whl | Select-Object -First 1).FullName
+          pip install $wheel
+
+      - name: Install test dependencies
+        run: pip install coverage pytest>=7.0.0 pytest-timeout>=2.1.0
+
+      - name: Run tests
+        working-directory: sdk/python
+        run: python -m pytest test/ -v
+
+      - name: Upload Python packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-sdk-${{ inputs.platform }}${{ inputs.useWinML == true && '-winml' || '' }}
+          path: sdk/python/dist/*
+
+      - name: Upload flcore logs
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: python-sdk-${{ inputs.platform }}${{ inputs.useWinML == true && '-winml' || '' }}-logs
+          path: sdk/python/logs/**

.github/workflows/build-rust-steps.yml

@@ -28,7 +28,7 @@ jobs:
         working-directory: sdk/rust
 
     env:
-      CARGO_FEATURES: ${{ inputs.useWinML && '--features winml' || '' }}
+      CARGO_FEATURES: ${{ inputs.useWinML && '--features winml,nightly' || '--features nightly' }}
 
     steps:
       - name: Checkout repository
@@ -46,6 +46,18 @@ jobs:
         with:
           workspaces: sdk/rust -> target
 
+      # The .cargo/config.toml redirects crates-io to an Azure Artifacts feed
+      # for CFS compliance. Remove the redirect in CI so cargo can fetch from
+      # crates.io directly without Azure DevOps auth.
+      - name: Use crates.io directly
+        shell: pwsh
+        working-directory: sdk/rust
+        run: |
+          if (Test-Path .cargo/config.toml) {
+            Remove-Item .cargo/config.toml
+            Write-Host "Removed .cargo/config.toml crates-io redirect"
+          }
+
       - name: Checkout test-data-shared from Azure DevOps
         if: ${{ inputs.run-integration-tests }}
         shell: pwsh

.github/workflows/foundry-local-sdk-build.yml

@@ -17,55 +17,22 @@ permissions:
   contents: read
 
 jobs:
-  build-cs-windows:
-    uses: ./.github/workflows/build-cs-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-    secrets: inherit
-  build-js-windows:
-    uses: ./.github/workflows/build-js-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-    secrets: inherit
-  build-rust-windows:
-    uses: ./.github/workflows/build-rust-steps.yml
-    with:
-      platform: 'windows'
-      run-integration-tests: true
-    secrets: inherit
-
-  build-cs-windows-WinML:
+  # Windows build/test moved to .pipelines/foundry-local-packaging.yml and runs in ADO
+  # MacOS ARM64 not supported in ADO, need to use GitHub Actions
+  build-cs-macos:
     uses: ./.github/workflows/build-cs-steps.yml
     with:
       version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-      useWinML: true
+      platform: 'macos'
     secrets: inherit
-  build-js-windows-WinML:
+  build-js-macos:
     uses: ./.github/workflows/build-js-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-      useWinML: true
-    secrets: inherit
-  build-rust-windows-WinML:
-    uses: ./.github/workflows/build-rust-steps.yml
-    with:
-      platform: 'windows'
-      useWinML: true
-      run-integration-tests: true
-    secrets: inherit
-
-  build-cs-macos:
-    uses: ./.github/workflows/build-cs-steps.yml
     with:
       version: '0.9.0.${{ github.run_number }}'
       platform: 'macos'
     secrets: inherit
-  build-js-macos:
-    uses: ./.github/workflows/build-js-steps.yml
+  build-python-macos:
+    uses: ./.github/workflows/build-python-steps.yml
     with:
       version: '0.9.0.${{ github.run_number }}'
       platform: 'macos'