{Packaging} Add Linux standalone tarball and Cask validation

[Naga Nandyala (naga-nandyala)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

Related command
N/A - packaging and release-pipeline infrastructure only.

Description
Extend standalone Azure CLI release validation to Linux ARM64 and x86_64 tarballs, alongside the existing macOS flow and Azure-managed Homebrew Cask.

• Generalize standalone build and release templates while preserving macOS signing and notarization.
• Build and smoke-test Linux ARM64 and x86_64 standalone tarballs.
• Generate a four-platform Cask and validate platform-specific archive selection on macOS and Linux.
• Publish standalone assets and update the Azure-managed Homebrew tap on main.
• Remove the temporary recovery publishing pipeline after publication validation.
• Omit Homebrew’s deprecated verified: Cask parameter.

Testing Guide

1. Run the mac-and-linux-standalone-release pipeline in the release project.
2. Install and verify the published Cask:

   brew tap Azure/homebrew-azure-cli
   brew install --cask --yes Azure/homebrew-azure-cli/azure-cli
   az version --output json

3. Uninstall and confirm cleanup:

   brew uninstall --cask Azure/homebrew-azure-cli/azure-cli
   command -v az

Validated on Linux with Azure CLI 2.89.0: Cask installation and az version --output json succeeded, and uninstall removed the Cask and az link.

History Notes
None. This is not a customer-facing command change.

---

• The PR title and description follow the Submitting Pull Requests guidance.
• N/A - this PR does not add or modify an az command; the Command Guidelines do not apply.
• N/A - this PR does not change command error handling; the Error Handling Guidelines do not apply.

[azure-client-tools-bot-prd]

Hi Naga Nandyala (@naga-nandyala),
Since the current milestone time is less than 7 days, this pr may not catch up with this release.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Pull request overview

This PR extends the standalone release/validation pipeline to cover both macOS and Linux artifacts and produces a single cross-platform Homebrew Cask that can install from GitHub releases or local file:// paths for validation.

Changes:

• Add Linux standalone tarball builds (arm64 + x86_64) alongside the existing macOS flow.
• Generate/test a four-platform Homebrew Cask (temp tap + offline install checks) and update publishing to include Linux artifacts.
• Introduce supporting pipeline templates and resources (Linuxbrew setup, PAT retrieval template, third-party notices packaging).

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
scripts/release/standalone/templates/azure-cli.rb.in	Update cask template to support macOS+Linux artifacts (multi-platform URL/SHA handling).
scripts/release/standalone/templates/az_launcher.sh.in	Detect Linuxbrew Cask installs and locate Homebrew Python on Linux.
scripts/release/standalone/resources/ThirdPartyNotices.txt	Add third-party notice bundle for inclusion in standalone installs.
scripts/release/standalone/cask_generate.py	Expand cask generation inputs to include macOS+Linux SHA256 values and updated template path.
scripts/release/standalone/build_binary_tar_gz.py	Add Linux platform support, requirements selection by OS, and architecture validation.
azure-pipelines.yml	Wire Linux build jobs into the main pipeline and switch to standalone templates/parameters.
.azure-pipelines/templates/standalone/publish-jobs.yml	Publish GitHub release assets for macOS+Linux and add Linux published-cask install test.
.azure-pipelines/templates/standalone/get-github-pat-token.yml	Add reusable Key Vault PAT retrieval step for GitHub operations.
.azure-pipelines/templates/standalone/cask-generation-and-tests.yml	Generate/test cross-platform cask and add Linux temp-tap + offline-install jobs.
.azure-pipelines/templates/macos/macos-sign-notarize-jobs.yml	Parameterize ESRP Apple KeyCode and rename final tarball job for macOS.
.azure-pipelines/templates/macos/macos-build-jobs.yml	Switch macOS build step to the standalone tarball builder.
.azure-pipelines/templates/linux/setup-homebrew.yml	Add Linuxbrew installation/setup helper for pipeline jobs.
.azure-pipelines/templates/linux/linux-build-jobs.yml	Add Linux standalone tarball build + smoke test + SBOM publishing jobs.
.azure-pipelines/mac-and-linux-standalone-release.yml	Add an ad hoc macOS+Linux validation pipeline wiring build/test/publish templates.

Suppressed comments (2)

scripts/release/standalone/templates/azure-cli.rb.in:6

• Homebrew Cask DSL doesn’t support os macos: ..., linux: ..., and sha256 can’t be keyed by custom symbols like arm64_linux/x86_64_linux. This will likely break cask evaluation on both platforms. Use on_macos/on_linux blocks, each with an arch-keyed sha256 and platform-specific url.
  .azure-pipelines/templates/standalone/publish-jobs.yml:373
• The publish summary still claims only macOS architectures (Apple Silicon + Intel), but this template now consumes and publishes Linux artifacts too. This makes the printed summary misleading for operators.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[azure-client-tools-agent]

Live test skipped

⏭️ Skipping the live test for this revision because no new test file was added (tests/**/test_*.py).

The live-test pipeline runs only the test files a PR changes, so there is nothing to execute for this commit. This is informational — a regression test is encouraged where it makes sense, but not required. If a test file is added in a later commit, the live test will run automatically.