From d1ffe7f75881d5507f808545a315cb8ac2004287 Mon Sep 17 00:00:00 2001
From: eserscor <erscor@microsoft.com>
Date: Tue, 6 Oct 2026 18:52:23 -0400
Subject: [PATCH] Work around certificate regression on Windows (#33142)

This pull request updates the build pipeline to improve Python package
installation and proxy handling, and ensures SSL certificate trust for
Python requests. The most important changes are:

**Build Pipeline Improvements:**

* The pipeline now installs both `requests` and `truststore` Python
packages to improve SSL certificate handling in Python scripts.
* Added steps to inspect and sanitize the `NO_PROXY` environment
variable, ensuring it does not contain invalid entries before running
the Python GitHub Action wrapper.

**Python Script Enhancements:**

* Updated `run_gh_action.py` to import and inject `truststore` into the
Python SSL context, ensuring trusted certificate handling for HTTP
requests.

(cherry picked from commit 38dc99fba3f5bd72e201d1d942235bf4f600a1b3)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3eb3fc9b-6147-4706-b7ad-47bb3476377b
---
 .../templates/setup-build-tools.yml           | 19 +++++++++++++------
 tools/ci_build/run_gh_action.py               |  3 +++
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/tools/ci_build/github/azure-pipelines/templates/setup-build-tools.yml b/tools/ci_build/github/azure-pipelines/templates/setup-build-tools.yml
index 2cd51eb9f5bb2..436b98d3a3191 100644
--- a/tools/ci_build/github/azure-pipelines/templates/setup-build-tools.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/setup-build-tools.yml
@@ -31,11 +31,18 @@ steps:
   displayName: 'Display Node.js Version'
 
 - script: |
-    python3 -m pip install requests
+    python3 -m pip install requests truststore
   displayName: 'Install Python requests package'
 
-- task: PythonScript@0
-  displayName: 'Run GitHub Action via Python Wrapper'
-  inputs:
-    scriptPath: 'tools/ci_build/run_gh_action.py'
-    arguments: '${{ parameters.action_version }}'
+- powershell: |
+    Write-Host "Process: $env:NO_PROXY"
+    Write-Host "User:    $([Environment]::GetEnvironmentVariable('NO_PROXY', 'User'))"
+    Write-Host "Machine: $([Environment]::GetEnvironmentVariable('NO_PROXY', 'Machine'))"
+  displayName: Inspect proxy environment
+
+- powershell: |
+    $env:NO_PROXY = (($env:NO_PROXY -split ',') |
+      Where-Object { $_ -ne '::1' -and $_ -notmatch '/' }) -join ','
+
+    python tools/ci_build/run_gh_action.py ${{ parameters.action_version }}
+  displayName: Run GitHub Action via Python Wrapper
diff --git a/tools/ci_build/run_gh_action.py b/tools/ci_build/run_gh_action.py
index 52c71311f0ec8..37dfe6e3a471c 100644
--- a/tools/ci_build/run_gh_action.py
+++ b/tools/ci_build/run_gh_action.py
@@ -7,6 +7,9 @@
 from pathlib import Path
 
 import requests
+import truststore
+
+truststore.inject_into_ssl()
 
 SCRIPT_DIR = Path(__file__).resolve().parent
 REPO_DIR = (SCRIPT_DIR / ".." / "..").resolve()