Add daily CFS feed warm-up and make azpysdk tool pins scannable

[jenny (JennyPng)]

Add daily CFS feed warm-up and make azpysdk tool pins scannable

Problem

This repo installs everything from the CFS pull-through feed instead of PyPI. CFS only serves versions it has already cached, and unauthenticated pipelines (fork PR CI) cannot trigger an upstream pull-through — they can only read what is already cached.

The static-analysis tools that azpysdk installs at runtime (mypy, pylint, pyright, sphinx, black, bandit, breaking) had their versions hardcoded in Python (e.g. MYPY_VERSION = "1.19.1"), invisible to any dependency scanner. When a tool's unpinned transitive dependency (e.g. one of mypy's deps) publishes a new release, an unauthenticated CI job resolves to that brand-new, uncached version and fails.

Fix

Part A — Make azpysdk tool deps scannable (single source of truth)

• Move the tool version pins out of the Python check modules into eng/tool_requirements/*.txt (mypy, mypy_next, pylint, pylint_next, pyright, pyright_next, sphinx, sphinx_next, black, bandit, breaking, + README).
• New loader azpysdk/_tool_reqs.py (load_requirements, pin, pinned_version) reads them from REPO_ROOT/eng/tool_requirements/ — the same pattern Check.py already uses for eng/test_tools.txt/pylintrc, so no packaging changes.
• Refactored all 8 check modules to install from these files. The module-level *_VERSION constants are kept but derived from the files for backwards compatibility (nothing else imports them). verifytypes now reuses pyright.txt, removing a duplicate pin.

Part B — Daily CFS warm-up

• eng/scripts/warm_cfs_feed.py: scans every declared dependency in the repo — all dev_requirements.txt, every pyproject.toml (deps + optional-deps), the shared eng/*.txt requirement files, and the new tool-requirement files — then runs pip download with transitive dependencies against the CFS feed. Continue-on-error, JSON report, --dry-run / --index-url / --dest / --fail-on-error.
• eng/pipelines/warm-cfs-feed.yml: runs the script daily, authenticated (via auth-dev-feed.yml, required for pull-through), and publishes the report artifact.

Because the daily authenticated job downloads each tool's full closure at latest, the unpinned transitive dep gets cached before unauthenticated PR pipelines resolve it.

Validation

• New tests/test_tool_reqs.py (6 tests) + existing test_pylint.py / test_breaking.py pass.
• Full azpysdk CLI parser builds; all refactored modules import.
• Scanner --dry-run confirmed it discovers the tool pins (mypy==1.19.1/2.1.0, pyright==1.1.407/1.1.411, black==24.4.0, sphinx==8.2.0) alongside pyproject.toml deps (275 unique third-party specs; 416 first-party skipped).

Notes / open questions

• Daily cadence leaves a small window if a transitive dep releases between runs (inherent to pull-through warming). Happy to add a lighter --only-tool-requirements fast path for a more frequent tools-only job if desired.
• Draft for review — please sanity-check the pipeline schedule/pool and the 1ES artifact output block.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.