Kévin Chalet
2 years ago
126 changed files with 3801 additions and 2144 deletions
@ -0,0 +1,3 @@ |
|||
@echo off |
|||
powershell -ExecutionPolicy ByPass -NoProfile -command "& """%~dp0build.ps1""" %*" |
|||
exit /b %ErrorLevel% |
|||
@ -0,0 +1,247 @@ |
|||
parameters: |
|||
# Job schema parameters - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#job |
|||
cancelTimeoutInMinutes: '' |
|||
condition: '' |
|||
container: '' |
|||
continueOnError: false |
|||
dependsOn: '' |
|||
displayName: '' |
|||
pool: '' |
|||
steps: [] |
|||
strategy: '' |
|||
timeoutInMinutes: '' |
|||
variables: [] |
|||
workspace: '' |
|||
templateContext: {} |
|||
|
|||
# Job base template specific parameters |
|||
# See schema documentation - https://github.com/dotnet/arcade/blob/master/Documentation/AzureDevOps/TemplateSchema.md |
|||
# publishing defaults |
|||
artifacts: '' |
|||
enableMicrobuild: false |
|||
enablePublishBuildArtifacts: false |
|||
enablePublishBuildAssets: false |
|||
enablePublishTestResults: false |
|||
enablePublishUsingPipelines: false |
|||
enableBuildRetry: false |
|||
mergeTestResults: false |
|||
testRunTitle: '' |
|||
testResultsFormat: '' |
|||
name: '' |
|||
componentGovernanceSteps: [] |
|||
preSteps: [] |
|||
artifactPublishSteps: [] |
|||
runAsPublic: false |
|||
|
|||
# 1es specific parameters |
|||
is1ESPipeline: '' |
|||
|
|||
jobs: |
|||
- job: ${{ parameters.name }} |
|||
|
|||
${{ if ne(parameters.cancelTimeoutInMinutes, '') }}: |
|||
cancelTimeoutInMinutes: ${{ parameters.cancelTimeoutInMinutes }} |
|||
|
|||
${{ if ne(parameters.condition, '') }}: |
|||
condition: ${{ parameters.condition }} |
|||
|
|||
${{ if ne(parameters.container, '') }}: |
|||
container: ${{ parameters.container }} |
|||
|
|||
${{ if ne(parameters.continueOnError, '') }}: |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
|
|||
${{ if ne(parameters.dependsOn, '') }}: |
|||
dependsOn: ${{ parameters.dependsOn }} |
|||
|
|||
${{ if ne(parameters.displayName, '') }}: |
|||
displayName: ${{ parameters.displayName }} |
|||
|
|||
${{ if ne(parameters.pool, '') }}: |
|||
pool: ${{ parameters.pool }} |
|||
|
|||
${{ if ne(parameters.strategy, '') }}: |
|||
strategy: ${{ parameters.strategy }} |
|||
|
|||
${{ if ne(parameters.timeoutInMinutes, '') }}: |
|||
timeoutInMinutes: ${{ parameters.timeoutInMinutes }} |
|||
|
|||
${{ if ne(parameters.templateContext, '') }}: |
|||
templateContext: ${{ parameters.templateContext }} |
|||
|
|||
variables: |
|||
- ${{ if ne(parameters.enableTelemetry, 'false') }}: |
|||
- name: DOTNET_CLI_TELEMETRY_PROFILE |
|||
value: '$(Build.Repository.Uri)' |
|||
- ${{ if eq(parameters.enableRichCodeNavigation, 'true') }}: |
|||
- name: EnableRichCodeNavigation |
|||
value: 'true' |
|||
# Retry signature validation up to three times, waiting 2 seconds between attempts. |
|||
# See https://learn.microsoft.com/en-us/nuget/reference/errors-and-warnings/nu3028#retry-untrusted-root-failures |
|||
- name: NUGET_EXPERIMENTAL_CHAIN_BUILD_RETRY_POLICY |
|||
value: 3,2000 |
|||
- ${{ each variable in parameters.variables }}: |
|||
# handle name-value variable syntax |
|||
# example: |
|||
# - name: [key] |
|||
# value: [value] |
|||
- ${{ if ne(variable.name, '') }}: |
|||
- name: ${{ variable.name }} |
|||
value: ${{ variable.value }} |
|||
|
|||
# handle variable groups |
|||
- ${{ if ne(variable.group, '') }}: |
|||
- group: ${{ variable.group }} |
|||
|
|||
# handle template variable syntax |
|||
# example: |
|||
# - template: path/to/template.yml |
|||
# parameters: |
|||
# [key]: [value] |
|||
- ${{ if ne(variable.template, '') }}: |
|||
- template: ${{ variable.template }} |
|||
${{ if ne(variable.parameters, '') }}: |
|||
parameters: ${{ variable.parameters }} |
|||
|
|||
# handle key-value variable syntax. |
|||
# example: |
|||
# - [key]: [value] |
|||
- ${{ if and(eq(variable.name, ''), eq(variable.group, ''), eq(variable.template, '')) }}: |
|||
- ${{ each pair in variable }}: |
|||
- name: ${{ pair.key }} |
|||
value: ${{ pair.value }} |
|||
|
|||
# DotNet-HelixApi-Access provides 'HelixApiAccessToken' for internal builds |
|||
- ${{ if and(eq(parameters.enableTelemetry, 'true'), eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- group: DotNet-HelixApi-Access |
|||
|
|||
${{ if ne(parameters.workspace, '') }}: |
|||
workspace: ${{ parameters.workspace }} |
|||
|
|||
steps: |
|||
- ${{ if eq(parameters.is1ESPipeline, '') }}: |
|||
- 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error |
|||
|
|||
- ${{ if ne(parameters.preSteps, '') }}: |
|||
- ${{ each preStep in parameters.preSteps }}: |
|||
- ${{ preStep }} |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- ${{ if eq(parameters.enableMicrobuild, 'true') }}: |
|||
- task: MicroBuildSigningPlugin@4 |
|||
displayName: Install MicroBuild plugin |
|||
inputs: |
|||
signType: $(_SignType) |
|||
zipSources: false |
|||
feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json |
|||
env: |
|||
TeamName: $(_TeamName) |
|||
MicroBuildOutputFolderOverride: '$(Agent.TempDirectory)' |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
condition: and(succeeded(), in(variables['_SignType'], 'real', 'test'), eq(variables['Agent.Os'], 'Windows_NT')) |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), eq(variables['System.TeamProject'], 'internal')) }}: |
|||
- task: NuGetAuthenticate@1 |
|||
|
|||
- ${{ if and(ne(parameters.artifacts.download, 'false'), ne(parameters.artifacts.download, '')) }}: |
|||
- task: DownloadPipelineArtifact@2 |
|||
inputs: |
|||
buildType: current |
|||
artifactName: ${{ coalesce(parameters.artifacts.download.name, 'Artifacts_$(Agent.OS)_$(_BuildConfig)') }} |
|||
targetPath: ${{ coalesce(parameters.artifacts.download.path, 'artifacts') }} |
|||
itemPattern: ${{ coalesce(parameters.artifacts.download.pattern, '**') }} |
|||
|
|||
- ${{ each step in parameters.steps }}: |
|||
- ${{ step }} |
|||
|
|||
- ${{ if eq(parameters.enableRichCodeNavigation, true) }}: |
|||
- task: RichCodeNavIndexer@0 |
|||
displayName: RichCodeNav Upload |
|||
inputs: |
|||
languages: ${{ coalesce(parameters.richCodeNavigationLanguage, 'csharp') }} |
|||
environment: ${{ coalesce(parameters.richCodeNavigationEnvironment, 'internal') }} |
|||
richNavLogOutputDirectory: $(Build.SourcesDirectory)/artifacts/bin |
|||
uploadRichNavArtifacts: ${{ coalesce(parameters.richCodeNavigationUploadArtifacts, false) }} |
|||
continueOnError: true |
|||
|
|||
- ${{ each step in parameters.componentGovernanceSteps }}: |
|||
- ${{ step }} |
|||
|
|||
- ${{ if eq(parameters.enableMicrobuild, 'true') }}: |
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- task: MicroBuildCleanup@1 |
|||
displayName: Execute Microbuild cleanup tasks |
|||
condition: and(always(), in(variables['_SignType'], 'real', 'test'), eq(variables['Agent.Os'], 'Windows_NT')) |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
env: |
|||
TeamName: $(_TeamName) |
|||
|
|||
# Publish test results |
|||
- ${{ if or(and(eq(parameters.enablePublishTestResults, 'true'), eq(parameters.testResultsFormat, '')), eq(parameters.testResultsFormat, 'xunit')) }}: |
|||
- task: PublishTestResults@2 |
|||
displayName: Publish XUnit Test Results |
|||
inputs: |
|||
testResultsFormat: 'xUnit' |
|||
testResultsFiles: '*.xml' |
|||
searchFolder: '$(Build.SourcesDirectory)/artifacts/TestResults/$(_BuildConfig)' |
|||
testRunTitle: ${{ coalesce(parameters.testRunTitle, parameters.name, '$(System.JobName)') }}-xunit |
|||
mergeTestResults: ${{ parameters.mergeTestResults }} |
|||
continueOnError: true |
|||
condition: always() |
|||
- ${{ if or(and(eq(parameters.enablePublishTestResults, 'true'), eq(parameters.testResultsFormat, '')), eq(parameters.testResultsFormat, 'vstest')) }}: |
|||
- task: PublishTestResults@2 |
|||
displayName: Publish TRX Test Results |
|||
inputs: |
|||
testResultsFormat: 'VSTest' |
|||
testResultsFiles: '*.trx' |
|||
searchFolder: '$(Build.SourcesDirectory)/artifacts/TestResults/$(_BuildConfig)' |
|||
testRunTitle: ${{ coalesce(parameters.testRunTitle, parameters.name, '$(System.JobName)') }}-trx |
|||
mergeTestResults: ${{ parameters.mergeTestResults }} |
|||
continueOnError: true |
|||
condition: always() |
|||
|
|||
# gather artifacts |
|||
- ${{ if ne(parameters.artifacts.publish, '') }}: |
|||
- ${{ if and(ne(parameters.artifacts.publish.artifacts, 'false'), ne(parameters.artifacts.publish.artifacts, '')) }}: |
|||
- task: CopyFiles@2 |
|||
displayName: Gather binaries for publish to artifacts |
|||
inputs: |
|||
SourceFolder: 'artifacts/bin' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/bin' |
|||
- task: CopyFiles@2 |
|||
displayName: Gather packages for publish to artifacts |
|||
inputs: |
|||
SourceFolder: 'artifacts/packages' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/packages' |
|||
- ${{ if and(ne(parameters.artifacts.publish.logs, 'false'), ne(parameters.artifacts.publish.logs, '')) }}: |
|||
- task: CopyFiles@2 |
|||
displayName: Gather logs for publish to artifacts |
|||
inputs: |
|||
SourceFolder: 'artifacts/log' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/log' |
|||
continueOnError: true |
|||
condition: always() |
|||
|
|||
- ${{ if eq(parameters.enablePublishBuildArtifacts, 'true') }}: |
|||
- task: CopyFiles@2 |
|||
displayName: Gather logs for publish to artifacts |
|||
inputs: |
|||
SourceFolder: 'artifacts/log/$(_BuildConfig)' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/log/$(_BuildConfig)' |
|||
continueOnError: true |
|||
condition: always() |
|||
- ${{ if eq(parameters.enableBuildRetry, 'true') }}: |
|||
- task: CopyFiles@2 |
|||
displayName: Gather buildconfiguration for build retry |
|||
inputs: |
|||
SourceFolder: '$(Build.SourcesDirectory)/eng/common/BuildConfiguration' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/eng/common/BuildConfiguration' |
|||
continueOnError: true |
|||
condition: always() |
|||
- ${{ each step in parameters.artifactPublishSteps }}: |
|||
- ${{ step }} |
|||
@ -0,0 +1,121 @@ |
|||
parameters: |
|||
# Optional: dependencies of the job |
|||
dependsOn: '' |
|||
|
|||
# Optional: A defined YAML pool - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#pool |
|||
pool: '' |
|||
|
|||
CeapexPat: $(dn-bot-ceapex-package-r) # PAT for the loc AzDO instance https://dev.azure.com/ceapex |
|||
GithubPat: $(BotAccount-dotnet-bot-repo-PAT) |
|||
|
|||
SourcesDirectory: $(Build.SourcesDirectory) |
|||
CreatePr: true |
|||
AutoCompletePr: false |
|||
ReusePr: true |
|||
UseLfLineEndings: true |
|||
UseCheckedInLocProjectJson: false |
|||
SkipLocProjectJsonGeneration: false |
|||
LanguageSet: VS_Main_Languages |
|||
LclSource: lclFilesInRepo |
|||
LclPackageId: '' |
|||
RepoType: gitHub |
|||
GitHubOrg: dotnet |
|||
MirrorRepo: '' |
|||
MirrorBranch: main |
|||
condition: '' |
|||
JobNameSuffix: '' |
|||
is1ESPipeline: '' |
|||
jobs: |
|||
- job: OneLocBuild${{ parameters.JobNameSuffix }} |
|||
|
|||
dependsOn: ${{ parameters.dependsOn }} |
|||
|
|||
displayName: OneLocBuild${{ parameters.JobNameSuffix }} |
|||
|
|||
variables: |
|||
- group: OneLocBuildVariables # Contains the CeapexPat and GithubPat |
|||
- name: _GenerateLocProjectArguments |
|||
value: -SourcesDirectory ${{ parameters.SourcesDirectory }} |
|||
-LanguageSet "${{ parameters.LanguageSet }}" |
|||
-CreateNeutralXlfs |
|||
- ${{ if eq(parameters.UseCheckedInLocProjectJson, 'true') }}: |
|||
- name: _GenerateLocProjectArguments |
|||
value: ${{ variables._GenerateLocProjectArguments }} -UseCheckedInLocProjectJson |
|||
- template: /eng/common/core-templates/variables/pool-providers.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
|
|||
${{ if ne(parameters.pool, '') }}: |
|||
pool: ${{ parameters.pool }} |
|||
${{ if eq(parameters.pool, '') }}: |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: AzurePipelines-EO |
|||
image: 1ESPT-Windows2022 |
|||
demands: Cmd |
|||
os: windows |
|||
# If it's not devdiv, it's dnceng |
|||
${{ if ne(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
image: 1es-windows-2022 |
|||
os: windows |
|||
|
|||
steps: |
|||
- ${{ if eq(parameters.is1ESPipeline, '') }}: |
|||
- 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error |
|||
|
|||
- ${{ if ne(parameters.SkipLocProjectJsonGeneration, 'true') }}: |
|||
- task: Powershell@2 |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/generate-locproject.ps1 |
|||
arguments: $(_GenerateLocProjectArguments) |
|||
displayName: Generate LocProject.json |
|||
condition: ${{ parameters.condition }} |
|||
|
|||
- task: OneLocBuild@2 |
|||
displayName: OneLocBuild |
|||
env: |
|||
SYSTEM_ACCESSTOKEN: $(System.AccessToken) |
|||
inputs: |
|||
locProj: eng/Localize/LocProject.json |
|||
outDir: $(Build.ArtifactStagingDirectory) |
|||
lclSource: ${{ parameters.LclSource }} |
|||
lclPackageId: ${{ parameters.LclPackageId }} |
|||
isCreatePrSelected: ${{ parameters.CreatePr }} |
|||
isAutoCompletePrSelected: ${{ parameters.AutoCompletePr }} |
|||
${{ if eq(parameters.CreatePr, true) }}: |
|||
isUseLfLineEndingsSelected: ${{ parameters.UseLfLineEndings }} |
|||
${{ if eq(parameters.RepoType, 'gitHub') }}: |
|||
isShouldReusePrSelected: ${{ parameters.ReusePr }} |
|||
packageSourceAuth: patAuth |
|||
patVariable: ${{ parameters.CeapexPat }} |
|||
${{ if eq(parameters.RepoType, 'gitHub') }}: |
|||
repoType: ${{ parameters.RepoType }} |
|||
gitHubPatVariable: "${{ parameters.GithubPat }}" |
|||
${{ if ne(parameters.MirrorRepo, '') }}: |
|||
isMirrorRepoSelected: true |
|||
gitHubOrganization: ${{ parameters.GitHubOrg }} |
|||
mirrorRepo: ${{ parameters.MirrorRepo }} |
|||
mirrorBranch: ${{ parameters.MirrorBranch }} |
|||
condition: ${{ parameters.condition }} |
|||
|
|||
- template: /eng/common/core-templates/steps/publish-build-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
args: |
|||
displayName: Publish Localization Files |
|||
pathToPublish: '$(Build.ArtifactStagingDirectory)/loc' |
|||
publishLocation: Container |
|||
artifactName: Loc |
|||
condition: ${{ parameters.condition }} |
|||
|
|||
- template: /eng/common/core-templates/steps/publish-build-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
args: |
|||
displayName: Publish LocProject.json |
|||
pathToPublish: '$(Build.SourcesDirectory)/eng/Localize/' |
|||
publishLocation: Container |
|||
artifactName: Loc |
|||
condition: ${{ parameters.condition }} |
|||
@ -0,0 +1,158 @@ |
|||
parameters: |
|||
configuration: 'Debug' |
|||
|
|||
# Optional: condition for the job to run |
|||
condition: '' |
|||
|
|||
# Optional: 'true' if future jobs should run even if this job fails |
|||
continueOnError: false |
|||
|
|||
# Optional: dependencies of the job |
|||
dependsOn: '' |
|||
|
|||
# Optional: Include PublishBuildArtifacts task |
|||
enablePublishBuildArtifacts: false |
|||
|
|||
# Optional: A defined YAML pool - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#pool |
|||
pool: {} |
|||
|
|||
# Optional: should run as a public build even in the internal project |
|||
# if 'true', the build won't run any of the internal only steps, even if it is running in non-public projects. |
|||
runAsPublic: false |
|||
|
|||
# Optional: whether the build's artifacts will be published using release pipelines or direct feed publishing |
|||
publishUsingPipelines: false |
|||
|
|||
# Optional: whether the build's artifacts will be published using release pipelines or direct feed publishing |
|||
publishAssetsImmediately: false |
|||
|
|||
artifactsPublishingAdditionalParameters: '' |
|||
|
|||
signingValidationAdditionalParameters: '' |
|||
|
|||
is1ESPipeline: '' |
|||
|
|||
jobs: |
|||
- job: Asset_Registry_Publish |
|||
|
|||
dependsOn: ${{ parameters.dependsOn }} |
|||
timeoutInMinutes: 150 |
|||
|
|||
${{ if eq(parameters.publishAssetsImmediately, 'true') }}: |
|||
displayName: Publish Assets |
|||
${{ else }}: |
|||
displayName: Publish to Build Asset Registry |
|||
|
|||
variables: |
|||
- template: /eng/common/core-templates/variables/pool-providers.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- group: Publish-Build-Assets |
|||
- group: AzureDevOps-Artifact-Feeds-Pats |
|||
- name: runCodesignValidationInjection |
|||
value: false |
|||
# unconditional - needed for logs publishing (redactor tool version) |
|||
- template: /eng/common/core-templates/post-build/common-variables.yml |
|||
|
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: AzurePipelines-EO |
|||
image: 1ESPT-Windows2022 |
|||
demands: Cmd |
|||
os: windows |
|||
# If it's not devdiv, it's dnceng |
|||
${{ if ne(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: NetCore1ESPool-Publishing-Internal |
|||
image: windows.vs2019.amd64 |
|||
os: windows |
|||
steps: |
|||
- ${{ if eq(parameters.is1ESPipeline, '') }}: |
|||
- 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- checkout: self |
|||
fetchDepth: 3 |
|||
clean: true |
|||
|
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download artifact |
|||
inputs: |
|||
artifactName: AssetManifests |
|||
downloadPath: '$(Build.StagingDirectory)/Download' |
|||
checkDownloadedFiles: true |
|||
condition: ${{ parameters.condition }} |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
|
|||
- task: NuGetAuthenticate@1 |
|||
|
|||
- task: AzureCLI@2 |
|||
displayName: Publish Build Assets |
|||
inputs: |
|||
azureSubscription: "Darc: Maestro Production" |
|||
scriptType: ps |
|||
scriptLocation: scriptPath |
|||
scriptPath: $(Build.SourcesDirectory)/eng/common/sdk-task.ps1 |
|||
arguments: -task PublishBuildAssets -restore -msbuildEngine dotnet |
|||
/p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests' |
|||
/p:MaestroApiEndpoint=https://maestro.dot.net |
|||
/p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }} |
|||
/p:OfficialBuildId=$(Build.BuildNumber) |
|||
condition: ${{ parameters.condition }} |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
|
|||
- task: powershell@2 |
|||
displayName: Create ReleaseConfigs Artifact |
|||
inputs: |
|||
targetType: inline |
|||
script: | |
|||
New-Item -Path "$(Build.StagingDirectory)/ReleaseConfigs" -ItemType Directory -Force |
|||
$filePath = "$(Build.StagingDirectory)/ReleaseConfigs/ReleaseConfigs.txt" |
|||
Add-Content -Path $filePath -Value $(BARBuildId) |
|||
Add-Content -Path $filePath -Value "$(DefaultChannels)" |
|||
Add-Content -Path $filePath -Value $(IsStableBuild) |
|||
|
|||
$symbolExclusionfile = "$(Build.SourcesDirectory)/eng/SymbolPublishingExclusionsFile.txt" |
|||
if (Test-Path -Path $symbolExclusionfile) |
|||
{ |
|||
Write-Host "SymbolExclusionFile exists" |
|||
Copy-Item -Path $symbolExclusionfile -Destination "$(Build.StagingDirectory)/ReleaseConfigs" |
|||
} |
|||
|
|||
- template: /eng/common/core-templates/steps/publish-build-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
args: |
|||
displayName: Publish ReleaseConfigs Artifact |
|||
pathToPublish: '$(Build.StagingDirectory)/ReleaseConfigs' |
|||
publishLocation: Container |
|||
artifactName: ReleaseConfigs |
|||
|
|||
- ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: |
|||
- template: /eng/common/core-templates/post-build/setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
|
|||
- task: AzureCLI@2 |
|||
displayName: Publish Using Darc |
|||
inputs: |
|||
azureSubscription: "Darc: Maestro Production" |
|||
scriptType: ps |
|||
scriptLocation: scriptPath |
|||
scriptPath: $(Build.SourcesDirectory)/eng/common/post-build/publish-using-darc.ps1 |
|||
arguments: > |
|||
-BuildId $(BARBuildId) |
|||
-PublishingInfraVersion 3 |
|||
-AzdoToken '$(System.AccessToken)' |
|||
-WaitPublishingFinish true |
|||
-ArtifactsPublishingAdditionalParameters '${{ parameters.artifactsPublishingAdditionalParameters }}' |
|||
-SymbolPublishingAdditionalParameters '${{ parameters.symbolPublishingAdditionalParameters }}' |
|||
|
|||
- ${{ if eq(parameters.enablePublishBuildArtifacts, 'true') }}: |
|||
- template: /eng/common/core-templates/steps/publish-logs.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
JobLabel: 'Publish_Artifacts_Logs' |
|||
@ -0,0 +1,93 @@ |
|||
parameters: |
|||
# This template adds arcade-powered source-build to CI. The template produces a server job with a |
|||
# default ID 'Source_Build_Complete' to put in a dependency list if necessary. |
|||
|
|||
# Specifies the prefix for source-build jobs added to pipeline. Use this if disambiguation needed. |
|||
jobNamePrefix: 'Source_Build' |
|||
|
|||
# Defines the platform on which to run the job. By default, a linux-x64 machine, suitable for |
|||
# managed-only repositories. This is an object with these properties: |
|||
# |
|||
# name: '' |
|||
# The name of the job. This is included in the job ID. |
|||
# targetRID: '' |
|||
# The name of the target RID to use, instead of the one auto-detected by Arcade. |
|||
# nonPortable: false |
|||
# Enables non-portable mode. This means a more specific RID (e.g. fedora.32-x64 rather than |
|||
# linux-x64), and compiling against distro-provided packages rather than portable ones. |
|||
# skipPublishValidation: false |
|||
# Disables publishing validation. By default, a check is performed to ensure no packages are |
|||
# published by source-build. |
|||
# container: '' |
|||
# A container to use. Runs in docker. |
|||
# pool: {} |
|||
# A pool to use. Runs directly on an agent. |
|||
# buildScript: '' |
|||
# Specifies the build script to invoke to perform the build in the repo. The default |
|||
# './build.sh' should work for typical Arcade repositories, but this is customizable for |
|||
# difficult situations. |
|||
# jobProperties: {} |
|||
# A list of job properties to inject at the top level, for potential extensibility beyond |
|||
# container and pool. |
|||
platform: {} |
|||
|
|||
is1ESPipeline: '' |
|||
|
|||
# If set to true and running on a non-public project, |
|||
# Internal nuget and blob storage locations will be enabled. |
|||
# This is not enabled by default because many repositories do not need internal sources |
|||
# and do not need to have the required service connections approved in the pipeline. |
|||
enableInternalSources: false |
|||
|
|||
jobs: |
|||
- job: ${{ parameters.jobNamePrefix }}_${{ parameters.platform.name }} |
|||
displayName: Source-Build (${{ parameters.platform.name }}) |
|||
|
|||
${{ each property in parameters.platform.jobProperties }}: |
|||
${{ property.key }}: ${{ property.value }} |
|||
|
|||
${{ if ne(parameters.platform.container, '') }}: |
|||
container: ${{ parameters.platform.container }} |
|||
|
|||
${{ if eq(parameters.platform.pool, '') }}: |
|||
# The default VM host AzDO pool. This should be capable of running Docker containers: almost all |
|||
# source-build builds run in Docker, including the default managed platform. |
|||
# /eng/common/core-templates/variables/pool-providers.yml can't be used here (some customers declare variables already), so duplicate its logic |
|||
${{ if eq(parameters.is1ESPipeline, 'true') }}: |
|||
pool: |
|||
${{ if eq(variables['System.TeamProject'], 'public') }}: |
|||
name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore-Svc-Public' ), False, 'NetCore-Public')] |
|||
demands: ImageOverride -equals build.ubuntu.2004.amd64 |
|||
${{ if eq(variables['System.TeamProject'], 'internal') }}: |
|||
name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore1ESPool-Svc-Internal'), False, 'NetCore1ESPool-Internal')] |
|||
image: 1es-mariner-2 |
|||
os: linux |
|||
${{ else }}: |
|||
pool: |
|||
${{ if eq(variables['System.TeamProject'], 'public') }}: |
|||
name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore-Svc-Public' ), False, 'NetCore-Public')] |
|||
demands: ImageOverride -equals Build.Ubuntu.2204.Amd64.Open |
|||
${{ if eq(variables['System.TeamProject'], 'internal') }}: |
|||
name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore1ESPool-Svc-Internal'), False, 'NetCore1ESPool-Internal')] |
|||
demands: ImageOverride -equals Build.Ubuntu.2204.Amd64 |
|||
${{ if ne(parameters.platform.pool, '') }}: |
|||
pool: ${{ parameters.platform.pool }} |
|||
|
|||
workspace: |
|||
clean: all |
|||
|
|||
steps: |
|||
- ${{ if eq(parameters.is1ESPipeline, '') }}: |
|||
- 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error |
|||
|
|||
- ${{ if eq(parameters.enableInternalSources, true) }}: |
|||
- template: /eng/common/core-templates/steps/enable-internal-sources.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
- template: /eng/common/core-templates/steps/enable-internal-runtimes.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
- template: /eng/common/core-templates/steps/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
platform: ${{ parameters.platform }} |
|||
@ -0,0 +1,81 @@ |
|||
parameters: |
|||
runAsPublic: false |
|||
sourceIndexUploadPackageVersion: 2.0.0-20240522.1 |
|||
sourceIndexProcessBinlogPackageVersion: 1.0.1-20240522.1 |
|||
sourceIndexPackageSource: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json |
|||
sourceIndexBuildCommand: powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "eng/common/build.ps1 -restore -build -binarylog -ci" |
|||
preSteps: [] |
|||
binlogPath: artifacts/log/Debug/Build.binlog |
|||
condition: '' |
|||
dependsOn: '' |
|||
pool: '' |
|||
is1ESPipeline: '' |
|||
|
|||
jobs: |
|||
- job: SourceIndexStage1 |
|||
dependsOn: ${{ parameters.dependsOn }} |
|||
condition: ${{ parameters.condition }} |
|||
variables: |
|||
- name: SourceIndexUploadPackageVersion |
|||
value: ${{ parameters.sourceIndexUploadPackageVersion }} |
|||
- name: SourceIndexProcessBinlogPackageVersion |
|||
value: ${{ parameters.sourceIndexProcessBinlogPackageVersion }} |
|||
- name: SourceIndexPackageSource |
|||
value: ${{ parameters.sourceIndexPackageSource }} |
|||
- name: BinlogPath |
|||
value: ${{ parameters.binlogPath }} |
|||
- template: /eng/common/core-templates/variables/pool-providers.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
|
|||
${{ if ne(parameters.pool, '') }}: |
|||
pool: ${{ parameters.pool }} |
|||
${{ if eq(parameters.pool, '') }}: |
|||
pool: |
|||
${{ if eq(variables['System.TeamProject'], 'public') }}: |
|||
name: $(DncEngPublicBuildPool) |
|||
image: 1es-windows-2022-open |
|||
os: windows |
|||
${{ if eq(variables['System.TeamProject'], 'internal') }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
image: 1es-windows-2022 |
|||
os: windows |
|||
|
|||
steps: |
|||
- ${{ if eq(parameters.is1ESPipeline, '') }}: |
|||
- 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error |
|||
|
|||
- ${{ each preStep in parameters.preSteps }}: |
|||
- ${{ preStep }} |
|||
|
|||
- task: UseDotNet@2 |
|||
displayName: Use .NET 8 SDK |
|||
inputs: |
|||
packageType: sdk |
|||
version: 8.0.x |
|||
installationPath: $(Agent.TempDirectory)/dotnet |
|||
workingDirectory: $(Agent.TempDirectory) |
|||
|
|||
- script: | |
|||
$(Agent.TempDirectory)/dotnet/dotnet tool install BinLogToSln --version $(sourceIndexProcessBinlogPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools |
|||
$(Agent.TempDirectory)/dotnet/dotnet tool install UploadIndexStage1 --version $(sourceIndexUploadPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools |
|||
displayName: Download Tools |
|||
# Set working directory to temp directory so 'dotnet' doesn't try to use global.json and use the repo's sdk. |
|||
workingDirectory: $(Agent.TempDirectory) |
|||
|
|||
- script: ${{ parameters.sourceIndexBuildCommand }} |
|||
displayName: Build Repository |
|||
|
|||
- script: $(Agent.TempDirectory)/.source-index/tools/BinLogToSln -i $(BinlogPath) -r $(Build.SourcesDirectory) -n $(Build.Repository.Name) -o .source-index/stage1output |
|||
displayName: Process Binlog into indexable sln |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- task: AzureCLI@2 |
|||
displayName: Log in to Azure and upload stage1 artifacts to source index |
|||
inputs: |
|||
azureSubscription: 'SourceDotNet Stage1 Publish' |
|||
addSpnToEnvironment: true |
|||
scriptType: 'ps' |
|||
scriptLocation: 'inlineScript' |
|||
inlineScript: | |
|||
$(Agent.TempDirectory)/.source-index/tools/UploadIndexStage1 -i .source-index/stage1output -n $(Build.Repository.Name) -s netsourceindexstage1 -b stage1 |
|||
@ -0,0 +1,33 @@ |
|||
parameters: |
|||
# See schema documentation in /Documentation/AzureDevOps/TemplateSchema.md |
|||
continueOnError: false |
|||
# Required: A collection of jobs to run - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#job |
|||
jobs: [] |
|||
# Optional: if specified, restore and use this version of Guardian instead of the default. |
|||
overrideGuardianVersion: '' |
|||
is1ESPipeline: '' |
|||
|
|||
jobs: |
|||
- template: /eng/common/core-templates/jobs/jobs.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
enableMicrobuild: false |
|||
enablePublishBuildArtifacts: false |
|||
enablePublishTestResults: false |
|||
enablePublishBuildAssets: false |
|||
enablePublishUsingPipelines: false |
|||
enableTelemetry: true |
|||
|
|||
variables: |
|||
- group: Publish-Build-Assets |
|||
# The Guardian version specified in 'eng/common/sdl/packages.config'. This value must be kept in |
|||
# sync with the packages.config file. |
|||
- name: DefaultGuardianVersion |
|||
value: 0.109.0 |
|||
- name: GuardianPackagesConfigFile |
|||
value: $(Build.SourcesDirectory)\eng\common\sdl\packages.config |
|||
- name: GuardianVersion |
|||
value: ${{ coalesce(parameters.overrideGuardianVersion, '$(DefaultGuardianVersion)') }} |
|||
|
|||
jobs: ${{ parameters.jobs }} |
|||
|
|||
@ -0,0 +1,119 @@ |
|||
parameters: |
|||
# See schema documentation in /Documentation/AzureDevOps/TemplateSchema.md |
|||
continueOnError: false |
|||
|
|||
# Optional: Include PublishBuildArtifacts task |
|||
enablePublishBuildArtifacts: false |
|||
|
|||
# Optional: Enable publishing using release pipelines |
|||
enablePublishUsingPipelines: false |
|||
|
|||
# Optional: Enable running the source-build jobs to build repo from source |
|||
enableSourceBuild: false |
|||
|
|||
# Optional: Parameters for source-build template. |
|||
# See /eng/common/core-templates/jobs/source-build.yml for options |
|||
sourceBuildParameters: [] |
|||
|
|||
graphFileGeneration: |
|||
# Optional: Enable generating the graph files at the end of the build |
|||
enabled: false |
|||
# Optional: Include toolset dependencies in the generated graph files |
|||
includeToolset: false |
|||
|
|||
# Required: A collection of jobs to run - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#job |
|||
jobs: [] |
|||
|
|||
# Optional: Override automatically derived dependsOn value for "publish build assets" job |
|||
publishBuildAssetsDependsOn: '' |
|||
|
|||
# Optional: Publish the assets as soon as the publish to BAR stage is complete, rather doing so in a separate stage. |
|||
publishAssetsImmediately: false |
|||
|
|||
# Optional: If using publishAssetsImmediately and additional parameters are needed, can be used to send along additional parameters (normally sent to post-build.yml) |
|||
artifactsPublishingAdditionalParameters: '' |
|||
signingValidationAdditionalParameters: '' |
|||
|
|||
# Optional: should run as a public build even in the internal project |
|||
# if 'true', the build won't run any of the internal only steps, even if it is running in non-public projects. |
|||
runAsPublic: false |
|||
|
|||
enableSourceIndex: false |
|||
sourceIndexParams: {} |
|||
|
|||
artifacts: {} |
|||
is1ESPipeline: '' |
|||
|
|||
# Internal resources (telemetry, microbuild) can only be accessed from non-public projects, |
|||
# and some (Microbuild) should only be applied to non-PR cases for internal builds. |
|||
|
|||
jobs: |
|||
- ${{ each job in parameters.jobs }}: |
|||
- ${{ if eq(parameters.is1ESPipeline, 'true') }}: |
|||
- template: /eng/common/templates-official/job/job.yml |
|||
parameters: |
|||
# pass along parameters |
|||
${{ each parameter in parameters }}: |
|||
${{ if ne(parameter.key, 'jobs') }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
# pass along job properties |
|||
${{ each property in job }}: |
|||
${{ if ne(property.key, 'job') }}: |
|||
${{ property.key }}: ${{ property.value }} |
|||
|
|||
name: ${{ job.job }} |
|||
|
|||
- ${{ else }}: |
|||
- template: /eng/common/templates/job/job.yml |
|||
parameters: |
|||
# pass along parameters |
|||
${{ each parameter in parameters }}: |
|||
${{ if ne(parameter.key, 'jobs') }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
# pass along job properties |
|||
${{ each property in job }}: |
|||
${{ if ne(property.key, 'job') }}: |
|||
${{ property.key }}: ${{ property.value }} |
|||
|
|||
name: ${{ job.job }} |
|||
|
|||
- ${{ if eq(parameters.enableSourceBuild, true) }}: |
|||
- template: /eng/common/core-templates/jobs/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
allCompletedJobId: Source_Build_Complete |
|||
${{ each parameter in parameters.sourceBuildParameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
- ${{ if eq(parameters.enableSourceIndex, 'true') }}: |
|||
- template: ../job/source-index-stage1.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
runAsPublic: ${{ parameters.runAsPublic }} |
|||
${{ each parameter in parameters.sourceIndexParams }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- ${{ if or(eq(parameters.enablePublishBuildAssets, true), eq(parameters.artifacts.publish.manifests, 'true'), ne(parameters.artifacts.publish.manifests, '')) }}: |
|||
- template: ../job/publish-build-assets.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
dependsOn: |
|||
- ${{ if ne(parameters.publishBuildAssetsDependsOn, '') }}: |
|||
- ${{ each job in parameters.publishBuildAssetsDependsOn }}: |
|||
- ${{ job.job }} |
|||
- ${{ if eq(parameters.publishBuildAssetsDependsOn, '') }}: |
|||
- ${{ each job in parameters.jobs }}: |
|||
- ${{ job.job }} |
|||
- ${{ if eq(parameters.enableSourceBuild, true) }}: |
|||
- Source_Build_Complete |
|||
|
|||
runAsPublic: ${{ parameters.runAsPublic }} |
|||
publishUsingPipelines: ${{ parameters.enablePublishUsingPipelines }} |
|||
publishAssetsImmediately: ${{ parameters.publishAssetsImmediately }} |
|||
enablePublishBuildArtifacts: ${{ parameters.enablePublishBuildArtifacts }} |
|||
artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }} |
|||
signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }} |
|||
@ -0,0 +1,58 @@ |
|||
parameters: |
|||
# This template adds arcade-powered source-build to CI. A job is created for each platform, as |
|||
# well as an optional server job that completes when all platform jobs complete. |
|||
|
|||
# The name of the "join" job for all source-build platforms. If set to empty string, the job is |
|||
# not included. Existing repo pipelines can use this job depend on all source-build jobs |
|||
# completing without maintaining a separate list of every single job ID: just depend on this one |
|||
# server job. By default, not included. Recommended name if used: 'Source_Build_Complete'. |
|||
allCompletedJobId: '' |
|||
|
|||
# See /eng/common/core-templates/job/source-build.yml |
|||
jobNamePrefix: 'Source_Build' |
|||
|
|||
# This is the default platform provided by Arcade, intended for use by a managed-only repo. |
|||
defaultManagedPlatform: |
|||
name: 'Managed' |
|||
container: 'mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream9' |
|||
|
|||
# Defines the platforms on which to run build jobs. One job is created for each platform, and the |
|||
# object in this array is sent to the job template as 'platform'. If no platforms are specified, |
|||
# one job runs on 'defaultManagedPlatform'. |
|||
platforms: [] |
|||
|
|||
is1ESPipeline: '' |
|||
|
|||
# If set to true and running on a non-public project, |
|||
# Internal nuget and blob storage locations will be enabled. |
|||
# This is not enabled by default because many repositories do not need internal sources |
|||
# and do not need to have the required service connections approved in the pipeline. |
|||
enableInternalSources: false |
|||
|
|||
jobs: |
|||
|
|||
- ${{ if ne(parameters.allCompletedJobId, '') }}: |
|||
- job: ${{ parameters.allCompletedJobId }} |
|||
displayName: Source-Build Complete |
|||
pool: server |
|||
dependsOn: |
|||
- ${{ each platform in parameters.platforms }}: |
|||
- ${{ parameters.jobNamePrefix }}_${{ platform.name }} |
|||
- ${{ if eq(length(parameters.platforms), 0) }}: |
|||
- ${{ parameters.jobNamePrefix }}_${{ parameters.defaultManagedPlatform.name }} |
|||
|
|||
- ${{ each platform in parameters.platforms }}: |
|||
- template: /eng/common/core-templates/job/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
jobNamePrefix: ${{ parameters.jobNamePrefix }} |
|||
platform: ${{ platform }} |
|||
enableInternalSources: ${{ parameters.enableInternalSources }} |
|||
|
|||
- ${{ if eq(length(parameters.platforms), 0) }}: |
|||
- template: /eng/common/core-templates/job/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
jobNamePrefix: ${{ parameters.jobNamePrefix }} |
|||
platform: ${{ parameters.defaultManagedPlatform }} |
|||
enableInternalSources: ${{ parameters.enableInternalSources }} |
|||
@ -0,0 +1,22 @@ |
|||
variables: |
|||
- group: Publish-Build-Assets |
|||
|
|||
# Whether the build is internal or not |
|||
- name: IsInternalBuild |
|||
value: ${{ and(ne(variables['System.TeamProject'], 'public'), contains(variables['Build.SourceBranch'], 'internal')) }} |
|||
|
|||
# Default Maestro++ API Endpoint and API Version |
|||
- name: MaestroApiEndPoint |
|||
value: "https://maestro.dot.net" |
|||
- name: MaestroApiVersion |
|||
value: "2020-02-20" |
|||
|
|||
- name: SourceLinkCLIVersion |
|||
value: 3.0.0 |
|||
- name: SymbolToolVersion |
|||
value: 1.0.1 |
|||
- name: BinlogToolVersion |
|||
value: 1.0.11 |
|||
|
|||
- name: runCodesignValidationInjection |
|||
value: false |
|||
@ -0,0 +1,316 @@ |
|||
parameters: |
|||
# Which publishing infra should be used. THIS SHOULD MATCH THE VERSION ON THE BUILD MANIFEST. |
|||
# Publishing V1 is no longer supported |
|||
# Publishing V2 is no longer supported |
|||
# Publishing V3 is the default |
|||
- name: publishingInfraVersion |
|||
displayName: Which version of publishing should be used to promote the build definition? |
|||
type: number |
|||
default: 3 |
|||
values: |
|||
- 3 |
|||
|
|||
- name: BARBuildId |
|||
displayName: BAR Build Id |
|||
type: number |
|||
default: 0 |
|||
|
|||
- name: PromoteToChannelIds |
|||
displayName: Channel to promote BARBuildId to |
|||
type: string |
|||
default: '' |
|||
|
|||
- name: enableSourceLinkValidation |
|||
displayName: Enable SourceLink validation |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: enableSigningValidation |
|||
displayName: Enable signing validation |
|||
type: boolean |
|||
default: true |
|||
|
|||
- name: enableSymbolValidation |
|||
displayName: Enable symbol validation |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: enableNugetValidation |
|||
displayName: Enable NuGet validation |
|||
type: boolean |
|||
default: true |
|||
|
|||
- name: publishInstallersAndChecksums |
|||
displayName: Publish installers and checksums |
|||
type: boolean |
|||
default: true |
|||
|
|||
- name: SDLValidationParameters |
|||
type: object |
|||
default: |
|||
enable: false |
|||
publishGdn: false |
|||
continueOnError: false |
|||
params: '' |
|||
artifactNames: '' |
|||
downloadArtifacts: true |
|||
|
|||
# These parameters let the user customize the call to sdk-task.ps1 for publishing |
|||
# symbols & general artifacts as well as for signing validation |
|||
- name: symbolPublishingAdditionalParameters |
|||
displayName: Symbol publishing additional parameters |
|||
type: string |
|||
default: '' |
|||
|
|||
- name: artifactsPublishingAdditionalParameters |
|||
displayName: Artifact publishing additional parameters |
|||
type: string |
|||
default: '' |
|||
|
|||
- name: signingValidationAdditionalParameters |
|||
displayName: Signing validation additional parameters |
|||
type: string |
|||
default: '' |
|||
|
|||
# Which stages should finish execution before post-build stages start |
|||
- name: validateDependsOn |
|||
type: object |
|||
default: |
|||
- build |
|||
|
|||
- name: publishDependsOn |
|||
type: object |
|||
default: |
|||
- Validate |
|||
|
|||
# Optional: Call asset publishing rather than running in a separate stage |
|||
- name: publishAssetsImmediately |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: false |
|||
|
|||
stages: |
|||
- ${{ if or(eq( parameters.enableNugetValidation, 'true'), eq(parameters.enableSigningValidation, 'true'), eq(parameters.enableSourceLinkValidation, 'true'), eq(parameters.SDLValidationParameters.enable, 'true')) }}: |
|||
- stage: Validate |
|||
dependsOn: ${{ parameters.validateDependsOn }} |
|||
displayName: Validate Build Assets |
|||
variables: |
|||
- template: /eng/common/core-templates/post-build/common-variables.yml |
|||
- template: /eng/common/core-templates/variables/pool-providers.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
jobs: |
|||
- job: |
|||
displayName: NuGet Validation |
|||
condition: and(succeededOrFailed(), eq( ${{ parameters.enableNugetValidation }}, 'true')) |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: AzurePipelines-EO |
|||
image: 1ESPT-Windows2022 |
|||
demands: Cmd |
|||
os: windows |
|||
# If it's not devdiv, it's dnceng |
|||
${{ else }}: |
|||
${{ if eq(parameters.is1ESPipeline, true) }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
image: windows.vs2022.amd64 |
|||
os: windows |
|||
${{ else }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2022.amd64 |
|||
|
|||
steps: |
|||
- template: /eng/common/core-templates/post-build/setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
|
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download Package Artifacts |
|||
inputs: |
|||
buildType: specific |
|||
buildVersionToDownload: specific |
|||
project: $(AzDOProjectName) |
|||
pipeline: $(AzDOPipelineId) |
|||
buildId: $(AzDOBuildId) |
|||
artifactName: PackageArtifacts |
|||
checkDownloadedFiles: true |
|||
|
|||
- task: PowerShell@2 |
|||
displayName: Validate |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/post-build/nuget-validation.ps1 |
|||
arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ |
|||
|
|||
- job: |
|||
displayName: Signing Validation |
|||
condition: and( eq( ${{ parameters.enableSigningValidation }}, 'true'), ne( variables['PostBuildSign'], 'true')) |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: AzurePipelines-EO |
|||
image: 1ESPT-Windows2022 |
|||
demands: Cmd |
|||
os: windows |
|||
# If it's not devdiv, it's dnceng |
|||
${{ else }}: |
|||
${{ if eq(parameters.is1ESPipeline, true) }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
image: 1es-windows-2022 |
|||
os: windows |
|||
${{ else }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2022.amd64 |
|||
steps: |
|||
- template: /eng/common/core-templates/post-build/setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
|
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download Package Artifacts |
|||
inputs: |
|||
buildType: specific |
|||
buildVersionToDownload: specific |
|||
project: $(AzDOProjectName) |
|||
pipeline: $(AzDOPipelineId) |
|||
buildId: $(AzDOBuildId) |
|||
artifactName: PackageArtifacts |
|||
checkDownloadedFiles: true |
|||
itemPattern: | |
|||
** |
|||
!**/Microsoft.SourceBuild.Intermediate.*.nupkg |
|||
|
|||
# This is necessary whenever we want to publish/restore to an AzDO private feed |
|||
# Since sdk-task.ps1 tries to restore packages we need to do this authentication here |
|||
# otherwise it'll complain about accessing a private feed. |
|||
- task: NuGetAuthenticate@1 |
|||
displayName: 'Authenticate to AzDO Feeds' |
|||
|
|||
# Signing validation will optionally work with the buildmanifest file which is downloaded from |
|||
# Azure DevOps above. |
|||
- task: PowerShell@2 |
|||
displayName: Validate |
|||
inputs: |
|||
filePath: eng\common\sdk-task.ps1 |
|||
arguments: -task SigningValidation -restore -msbuildEngine vs |
|||
/p:PackageBasePath='$(Build.ArtifactStagingDirectory)/PackageArtifacts' |
|||
/p:SignCheckExclusionsFile='$(Build.SourcesDirectory)/eng/SignCheckExclusionsFile.txt' |
|||
${{ parameters.signingValidationAdditionalParameters }} |
|||
|
|||
- template: /eng/common/core-templates/steps/publish-logs.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
StageLabel: 'Validation' |
|||
JobLabel: 'Signing' |
|||
BinlogToolVersion: $(BinlogToolVersion) |
|||
|
|||
- job: |
|||
displayName: SourceLink Validation |
|||
condition: eq( ${{ parameters.enableSourceLinkValidation }}, 'true') |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: AzurePipelines-EO |
|||
image: 1ESPT-Windows2022 |
|||
demands: Cmd |
|||
os: windows |
|||
# If it's not devdiv, it's dnceng |
|||
${{ else }}: |
|||
${{ if eq(parameters.is1ESPipeline, true) }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
image: 1es-windows-2022 |
|||
os: windows |
|||
${{ else }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2022.amd64 |
|||
steps: |
|||
- template: /eng/common/core-templates/post-build/setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
|
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download Blob Artifacts |
|||
inputs: |
|||
buildType: specific |
|||
buildVersionToDownload: specific |
|||
project: $(AzDOProjectName) |
|||
pipeline: $(AzDOPipelineId) |
|||
buildId: $(AzDOBuildId) |
|||
artifactName: BlobArtifacts |
|||
checkDownloadedFiles: true |
|||
|
|||
- task: PowerShell@2 |
|||
displayName: Validate |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/post-build/sourcelink-validation.ps1 |
|||
arguments: -InputPath $(Build.ArtifactStagingDirectory)/BlobArtifacts/ |
|||
-ExtractPath $(Agent.BuildDirectory)/Extract/ |
|||
-GHRepoName $(Build.Repository.Name) |
|||
-GHCommit $(Build.SourceVersion) |
|||
-SourcelinkCliVersion $(SourceLinkCLIVersion) |
|||
continueOnError: true |
|||
|
|||
- ${{ if ne(parameters.publishAssetsImmediately, 'true') }}: |
|||
- stage: publish_using_darc |
|||
${{ if or(eq(parameters.enableNugetValidation, 'true'), eq(parameters.enableSigningValidation, 'true'), eq(parameters.enableSourceLinkValidation, 'true'), eq(parameters.SDLValidationParameters.enable, 'true')) }}: |
|||
dependsOn: ${{ parameters.publishDependsOn }} |
|||
${{ else }}: |
|||
dependsOn: ${{ parameters.validateDependsOn }} |
|||
displayName: Publish using Darc |
|||
variables: |
|||
- template: /eng/common/core-templates/post-build/common-variables.yml |
|||
- template: /eng/common/core-templates/variables/pool-providers.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
jobs: |
|||
- job: |
|||
displayName: Publish Using Darc |
|||
timeoutInMinutes: 120 |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: AzurePipelines-EO |
|||
image: 1ESPT-Windows2022 |
|||
demands: Cmd |
|||
os: windows |
|||
# If it's not devdiv, it's dnceng |
|||
${{ else }}: |
|||
${{ if eq(parameters.is1ESPipeline, true) }}: |
|||
name: NetCore1ESPool-Publishing-Internal |
|||
image: windows.vs2019.amd64 |
|||
os: windows |
|||
${{ else }}: |
|||
name: NetCore1ESPool-Publishing-Internal |
|||
demands: ImageOverride -equals windows.vs2019.amd64 |
|||
steps: |
|||
- template: /eng/common/core-templates/post-build/setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
|
|||
- task: NuGetAuthenticate@1 |
|||
|
|||
- task: AzureCLI@2 |
|||
displayName: Publish Using Darc |
|||
inputs: |
|||
azureSubscription: "Darc: Maestro Production" |
|||
scriptType: ps |
|||
scriptLocation: scriptPath |
|||
scriptPath: $(Build.SourcesDirectory)/eng/common/post-build/publish-using-darc.ps1 |
|||
arguments: > |
|||
-BuildId $(BARBuildId) |
|||
-PublishingInfraVersion ${{ parameters.publishingInfraVersion }} |
|||
-AzdoToken '$(System.AccessToken)' |
|||
-WaitPublishingFinish true |
|||
-ArtifactsPublishingAdditionalParameters '${{ parameters.artifactsPublishingAdditionalParameters }}' |
|||
-SymbolPublishingAdditionalParameters '${{ parameters.symbolPublishingAdditionalParameters }}' |
|||
@ -0,0 +1,74 @@ |
|||
parameters: |
|||
BARBuildId: '' |
|||
PromoteToChannelIds: '' |
|||
is1ESPipeline: '' |
|||
|
|||
steps: |
|||
- ${{ if eq(parameters.is1ESPipeline, '') }}: |
|||
- 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error |
|||
|
|||
- ${{ if eq(coalesce(parameters.PromoteToChannelIds, 0), 0) }}: |
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download Release Configs |
|||
inputs: |
|||
buildType: current |
|||
artifactName: ReleaseConfigs |
|||
checkDownloadedFiles: true |
|||
|
|||
- task: AzureCLI@2 |
|||
name: setReleaseVars |
|||
displayName: Set Release Configs Vars |
|||
inputs: |
|||
azureSubscription: "Darc: Maestro Production" |
|||
scriptType: pscore |
|||
scriptLocation: inlineScript |
|||
inlineScript: | |
|||
try { |
|||
if (!$Env:PromoteToMaestroChannels -or $Env:PromoteToMaestroChannels.Trim() -eq '') { |
|||
$Content = Get-Content $(Build.StagingDirectory)/ReleaseConfigs/ReleaseConfigs.txt |
|||
|
|||
$BarId = $Content | Select -Index 0 |
|||
$Channels = $Content | Select -Index 1 |
|||
$IsStableBuild = $Content | Select -Index 2 |
|||
|
|||
$AzureDevOpsProject = $Env:System_TeamProject |
|||
$AzureDevOpsBuildDefinitionId = $Env:System_DefinitionId |
|||
$AzureDevOpsBuildId = $Env:Build_BuildId |
|||
} |
|||
else { |
|||
. $(Build.SourcesDirectory)\eng\common\tools.ps1 |
|||
$darc = Get-Darc |
|||
$buildInfo = & $darc get-build ` |
|||
--id ${{ parameters.BARBuildId }} ` |
|||
--extended ` |
|||
--output-format json ` |
|||
--ci ` |
|||
| convertFrom-Json |
|||
|
|||
$BarId = ${{ parameters.BARBuildId }} |
|||
$Channels = $Env:PromoteToMaestroChannels -split "," |
|||
$Channels = $Channels -join "][" |
|||
$Channels = "[$Channels]" |
|||
|
|||
$IsStableBuild = $buildInfo.stable |
|||
$AzureDevOpsProject = $buildInfo.azureDevOpsProject |
|||
$AzureDevOpsBuildDefinitionId = $buildInfo.azureDevOpsBuildDefinitionId |
|||
$AzureDevOpsBuildId = $buildInfo.azureDevOpsBuildId |
|||
} |
|||
|
|||
Write-Host "##vso[task.setvariable variable=BARBuildId]$BarId" |
|||
Write-Host "##vso[task.setvariable variable=TargetChannels]$Channels" |
|||
Write-Host "##vso[task.setvariable variable=IsStableBuild]$IsStableBuild" |
|||
|
|||
Write-Host "##vso[task.setvariable variable=AzDOProjectName]$AzureDevOpsProject" |
|||
Write-Host "##vso[task.setvariable variable=AzDOPipelineId]$AzureDevOpsBuildDefinitionId" |
|||
Write-Host "##vso[task.setvariable variable=AzDOBuildId]$AzureDevOpsBuildId" |
|||
} |
|||
catch { |
|||
Write-Host $_ |
|||
Write-Host $_.Exception |
|||
Write-Host $_.ScriptStackTrace |
|||
exit 1 |
|||
} |
|||
env: |
|||
PromoteToMaestroChannels: ${{ parameters.PromoteToChannelIds }} |
|||
@ -0,0 +1,16 @@ |
|||
parameters: |
|||
disableComponentGovernance: false |
|||
componentGovernanceIgnoreDirectories: '' |
|||
is1ESPipeline: false |
|||
displayName: 'Component Detection' |
|||
|
|||
steps: |
|||
- ${{ if eq(parameters.disableComponentGovernance, 'true') }}: |
|||
- script: echo "##vso[task.setvariable variable=skipComponentGovernanceDetection]true" |
|||
displayName: Set skipComponentGovernanceDetection variable |
|||
- ${{ if ne(parameters.disableComponentGovernance, 'true') }}: |
|||
- task: ComponentGovernanceComponentDetection@0 |
|||
continueOnError: true |
|||
displayName: ${{ parameters.displayName }} |
|||
inputs: |
|||
ignoreDirectories: ${{ parameters.componentGovernanceIgnoreDirectories }} |
|||
@ -0,0 +1,32 @@ |
|||
# Obtains internal runtime download credentials and populates the 'dotnetbuilds-internal-container-read-token-base64' |
|||
# variable with the base64-encoded SAS token, by default |
|||
|
|||
parameters: |
|||
- name: federatedServiceConnection |
|||
type: string |
|||
default: 'dotnetbuilds-internal-read' |
|||
- name: outputVariableName |
|||
type: string |
|||
default: 'dotnetbuilds-internal-container-read-token-base64' |
|||
- name: expiryInHours |
|||
type: number |
|||
default: 1 |
|||
- name: base64Encode |
|||
type: boolean |
|||
default: true |
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: false |
|||
|
|||
steps: |
|||
- ${{ if ne(variables['System.TeamProject'], 'public') }}: |
|||
- template: /eng/common/core-templates/steps/get-delegation-sas.yml |
|||
parameters: |
|||
federatedServiceConnection: ${{ parameters.federatedServiceConnection }} |
|||
outputVariableName: ${{ parameters.outputVariableName }} |
|||
expiryInHours: ${{ parameters.expiryInHours }} |
|||
base64Encode: ${{ parameters.base64Encode }} |
|||
storageAccount: dotnetbuilds |
|||
container: internal |
|||
permissions: rl |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
@ -0,0 +1,47 @@ |
|||
parameters: |
|||
# This is the Azure federated service connection that we log into to get an access token. |
|||
- name: nugetFederatedServiceConnection |
|||
type: string |
|||
default: 'dnceng-artifacts-feeds-read' |
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: false |
|||
# Legacy parameters to allow for PAT usage |
|||
- name: legacyCredential |
|||
type: string |
|||
default: '' |
|||
|
|||
steps: |
|||
- ${{ if ne(variables['System.TeamProject'], 'public') }}: |
|||
- ${{ if ne(parameters.legacyCredential, '') }}: |
|||
- task: PowerShell@2 |
|||
displayName: Setup Internal Feeds |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1 |
|||
arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token |
|||
env: |
|||
Token: ${{ parameters.legacyCredential }} |
|||
# If running on dnceng (internal project), just use the default behavior for NuGetAuthenticate. |
|||
# If running on DevDiv, NuGetAuthenticate is not really an option. It's scoped to a single feed, and we have many feeds that |
|||
# may be added. Instead, we'll use the traditional approach (add cred to nuget.config), but use an account token. |
|||
- ${{ else }}: |
|||
- ${{ if eq(variables['System.TeamProject'], 'internal') }}: |
|||
- task: PowerShell@2 |
|||
displayName: Setup Internal Feeds |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1 |
|||
arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config |
|||
- ${{ else }}: |
|||
- template: /eng/common/templates/steps/get-federated-access-token.yml |
|||
parameters: |
|||
federatedServiceConnection: ${{ parameters.nugetFederatedServiceConnection }} |
|||
outputVariableName: 'dnceng-artifacts-feeds-read-access-token' |
|||
- task: PowerShell@2 |
|||
displayName: Setup Internal Feeds |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1 |
|||
arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $(dnceng-artifacts-feeds-read-access-token) |
|||
# This is required in certain scenarios to install the ADO credential provider. |
|||
# It installed by default in some msbuild invocations (e.g. VS msbuild), but needs to be installed for others |
|||
# (e.g. dotnet msbuild). |
|||
- task: NuGetAuthenticate@1 |
|||
@ -0,0 +1,54 @@ |
|||
# BuildDropPath - The root folder of the drop directory for which the manifest file will be generated. |
|||
# PackageName - The name of the package this SBOM represents. |
|||
# PackageVersion - The version of the package this SBOM represents. |
|||
# ManifestDirPath - The path of the directory where the generated manifest files will be placed |
|||
# IgnoreDirectories - Directories to ignore for SBOM generation. This will be passed through to the CG component detector. |
|||
|
|||
parameters: |
|||
PackageVersion: 9.0.0 |
|||
BuildDropPath: '$(Build.SourcesDirectory)/artifacts' |
|||
PackageName: '.NET' |
|||
ManifestDirPath: $(Build.ArtifactStagingDirectory)/sbom |
|||
IgnoreDirectories: '' |
|||
sbomContinueOnError: true |
|||
is1ESPipeline: false |
|||
# disable publishArtifacts if some other step is publishing the artifacts (like job.yml). |
|||
publishArtifacts: true |
|||
|
|||
steps: |
|||
- task: PowerShell@2 |
|||
displayName: Prep for SBOM generation in (Non-linux) |
|||
condition: or(eq(variables['Agent.Os'], 'Windows_NT'), eq(variables['Agent.Os'], 'Darwin')) |
|||
inputs: |
|||
filePath: ./eng/common/generate-sbom-prep.ps1 |
|||
arguments: ${{parameters.manifestDirPath}} |
|||
|
|||
# Chmodding is a workaround for https://github.com/dotnet/arcade/issues/8461 |
|||
- script: | |
|||
chmod +x ./eng/common/generate-sbom-prep.sh |
|||
./eng/common/generate-sbom-prep.sh ${{parameters.manifestDirPath}} |
|||
displayName: Prep for SBOM generation in (Linux) |
|||
condition: eq(variables['Agent.Os'], 'Linux') |
|||
continueOnError: ${{ parameters.sbomContinueOnError }} |
|||
|
|||
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0 |
|||
displayName: 'Generate SBOM manifest' |
|||
continueOnError: ${{ parameters.sbomContinueOnError }} |
|||
inputs: |
|||
PackageName: ${{ parameters.packageName }} |
|||
BuildDropPath: ${{ parameters.buildDropPath }} |
|||
PackageVersion: ${{ parameters.packageVersion }} |
|||
ManifestDirPath: ${{ parameters.manifestDirPath }} |
|||
${{ if ne(parameters.IgnoreDirectories, '') }}: |
|||
AdditionalComponentDetectorArgs: '--IgnoreDirectories ${{ parameters.IgnoreDirectories }}' |
|||
|
|||
- ${{ if eq(parameters.publishArtifacts, 'true')}}: |
|||
- template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
args: |
|||
displayName: Publish SBOM manifest |
|||
continueOnError: ${{parameters.sbomContinueOnError}} |
|||
targetPath: '${{ parameters.manifestDirPath }}' |
|||
artifactName: $(ARTIFACT_NAME) |
|||
|
|||
@ -0,0 +1,55 @@ |
|||
parameters: |
|||
- name: federatedServiceConnection |
|||
type: string |
|||
- name: outputVariableName |
|||
type: string |
|||
- name: expiryInHours |
|||
type: number |
|||
default: 1 |
|||
- name: base64Encode |
|||
type: boolean |
|||
default: false |
|||
- name: storageAccount |
|||
type: string |
|||
- name: container |
|||
type: string |
|||
- name: permissions |
|||
type: string |
|||
default: 'rl' |
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: false |
|||
|
|||
steps: |
|||
- task: AzureCLI@2 |
|||
displayName: 'Generate delegation SAS Token for ${{ parameters.storageAccount }}/${{ parameters.container }}' |
|||
inputs: |
|||
azureSubscription: ${{ parameters.federatedServiceConnection }} |
|||
scriptType: 'pscore' |
|||
scriptLocation: 'inlineScript' |
|||
inlineScript: | |
|||
# Calculate the expiration of the SAS token and convert to UTC |
|||
$expiry = (Get-Date).AddHours(${{ parameters.expiryInHours }}).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ") |
|||
|
|||
# Temporarily work around a helix issue where SAS tokens with / in them will cause incorrect downloads |
|||
# of correlation payloads. https://github.com/dotnet/dnceng/issues/3484 |
|||
$sas = "" |
|||
do { |
|||
$sas = az storage container generate-sas --account-name ${{ parameters.storageAccount }} --name ${{ parameters.container }} --permissions ${{ parameters.permissions }} --expiry $expiry --auth-mode login --as-user -o tsv |
|||
if ($LASTEXITCODE -ne 0) { |
|||
Write-Error "Failed to generate SAS token." |
|||
exit 1 |
|||
} |
|||
} while($sas.IndexOf('/') -ne -1) |
|||
|
|||
if ($LASTEXITCODE -ne 0) { |
|||
Write-Error "Failed to generate SAS token." |
|||
exit 1 |
|||
} |
|||
|
|||
if ('${{ parameters.base64Encode }}' -eq 'true') { |
|||
$sas = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($sas)) |
|||
} |
|||
|
|||
Write-Host "Setting '${{ parameters.outputVariableName }}' with the access token value" |
|||
Write-Host "##vso[task.setvariable variable=${{ parameters.outputVariableName }};issecret=true]$sas" |
|||
@ -0,0 +1,42 @@ |
|||
parameters: |
|||
- name: federatedServiceConnection |
|||
type: string |
|||
- name: outputVariableName |
|||
type: string |
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
- name: stepName |
|||
type: string |
|||
default: 'getFederatedAccessToken' |
|||
- name: condition |
|||
type: string |
|||
default: '' |
|||
# Resource to get a token for. Common values include: |
|||
# - '499b84ac-1321-427f-aa17-267ca6975798' for Azure DevOps |
|||
# - 'https://storage.azure.com/' for storage |
|||
# Defaults to Azure DevOps |
|||
- name: resource |
|||
type: string |
|||
default: '499b84ac-1321-427f-aa17-267ca6975798' |
|||
- name: isStepOutputVariable |
|||
type: boolean |
|||
default: false |
|||
|
|||
steps: |
|||
- task: AzureCLI@2 |
|||
displayName: 'Getting federated access token for feeds' |
|||
name: ${{ parameters.stepName }} |
|||
${{ if ne(parameters.condition, '') }}: |
|||
condition: ${{ parameters.condition }} |
|||
inputs: |
|||
azureSubscription: ${{ parameters.federatedServiceConnection }} |
|||
scriptType: 'pscore' |
|||
scriptLocation: 'inlineScript' |
|||
inlineScript: | |
|||
$accessToken = az account get-access-token --query accessToken --resource ${{ parameters.resource }} --output tsv |
|||
if ($LASTEXITCODE -ne 0) { |
|||
Write-Error "Failed to get access token for resource '${{ parameters.resource }}'" |
|||
exit 1 |
|||
} |
|||
Write-Host "Setting '${{ parameters.outputVariableName }}' with the access token value" |
|||
Write-Host "##vso[task.setvariable variable=${{ parameters.outputVariableName }};issecret=true;isOutput=${{ parameters.isStepOutputVariable }}]$accessToken" |
|||
@ -0,0 +1,20 @@ |
|||
parameters: |
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: false |
|||
- name: args |
|||
type: object |
|||
default: {} |
|||
steps: |
|||
- ${{ if ne(parameters.is1ESPipeline, true) }}: |
|||
- template: /eng/common/templates/steps/publish-build-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
${{ each parameter in parameters.args }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
- ${{ else }}: |
|||
- template: /eng/common/templates-official/steps/publish-build-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
${{ each parameter in parameters.args }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,58 @@ |
|||
parameters: |
|||
StageLabel: '' |
|||
JobLabel: '' |
|||
CustomSensitiveDataList: '' |
|||
# A default - in case value from eng/common/core-templates/post-build/common-variables.yml is not passed |
|||
BinlogToolVersion: '1.0.11' |
|||
is1ESPipeline: false |
|||
|
|||
steps: |
|||
- task: Powershell@2 |
|||
displayName: Prepare Binlogs to Upload |
|||
inputs: |
|||
targetType: inline |
|||
script: | |
|||
New-Item -ItemType Directory $(Build.SourcesDirectory)/PostBuildLogs/${{parameters.StageLabel}}/${{parameters.JobLabel}}/ |
|||
Move-Item -Path $(Build.SourcesDirectory)/artifacts/log/Debug/* $(Build.SourcesDirectory)/PostBuildLogs/${{parameters.StageLabel}}/${{parameters.JobLabel}}/ |
|||
continueOnError: true |
|||
condition: always() |
|||
|
|||
- task: PowerShell@2 |
|||
displayName: Redact Logs |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/post-build/redact-logs.ps1 |
|||
# For now this needs to have explicit list of all sensitive data. Taken from eng/publishing/v3/publish.yml |
|||
# Sensitive data can as well be added to $(Build.SourcesDirectory)/eng/BinlogSecretsRedactionFile.txt' |
|||
# If the file exists - sensitive data for redaction will be sourced from it |
|||
# (single entry per line, lines starting with '# ' are considered comments and skipped) |
|||
arguments: -InputPath '$(Build.SourcesDirectory)/PostBuildLogs' |
|||
-BinlogToolVersion ${{parameters.BinlogToolVersion}} |
|||
-TokensFilePath '$(Build.SourcesDirectory)/eng/BinlogSecretsRedactionFile.txt' |
|||
'$(publishing-dnceng-devdiv-code-r-build-re)' |
|||
'$(MaestroAccessToken)' |
|||
'$(dn-bot-all-orgs-artifact-feeds-rw)' |
|||
'$(akams-client-id)' |
|||
'$(microsoft-symbol-server-pat)' |
|||
'$(symweb-symbol-server-pat)' |
|||
'$(dn-bot-all-orgs-build-rw-code-rw)' |
|||
${{parameters.CustomSensitiveDataList}} |
|||
continueOnError: true |
|||
condition: always() |
|||
|
|||
- task: CopyFiles@2 |
|||
displayName: Gather post build logs |
|||
inputs: |
|||
SourceFolder: '$(Build.SourcesDirectory)/PostBuildLogs' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/PostBuildLogs' |
|||
|
|||
- template: /eng/common/core-templates/steps/publish-build-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
args: |
|||
displayName: Publish Logs |
|||
pathToPublish: '$(Build.ArtifactStagingDirectory)/PostBuildLogs' |
|||
publishLocation: Container |
|||
artifactName: PostBuildLogs |
|||
continueOnError: true |
|||
condition: always() |
|||
@ -0,0 +1,20 @@ |
|||
parameters: |
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: args |
|||
type: object |
|||
default: {} |
|||
|
|||
steps: |
|||
- ${{ if ne(parameters.is1ESPipeline, true) }}: |
|||
- template: /eng/common/templates/steps/publish-pipeline-artifacts.yml |
|||
parameters: |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
- ${{ else }}: |
|||
- template: /eng/common/templates-official/steps/publish-pipeline-artifacts.yml |
|||
parameters: |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,28 @@ |
|||
parameters: |
|||
# Optional azure devops PAT with build execute permissions for the build's organization, |
|||
# only needed if the build that should be retained ran on a different organization than |
|||
# the pipeline where this template is executing from |
|||
Token: '' |
|||
# Optional BuildId to retain, defaults to the current running build |
|||
BuildId: '' |
|||
# Azure devops Organization URI for the build in the https://dev.azure.com/<organization> format. |
|||
# Defaults to the organization the current pipeline is running on |
|||
AzdoOrgUri: '$(System.CollectionUri)' |
|||
# Azure devops project for the build. Defaults to the project the current pipeline is running on |
|||
AzdoProject: '$(System.TeamProject)' |
|||
|
|||
steps: |
|||
- task: powershell@2 |
|||
inputs: |
|||
targetType: 'filePath' |
|||
filePath: eng/common/retain-build.ps1 |
|||
pwsh: true |
|||
arguments: > |
|||
-AzdoOrgUri: ${{parameters.AzdoOrgUri}} |
|||
-AzdoProject ${{parameters.AzdoProject}} |
|||
-Token ${{coalesce(parameters.Token, '$env:SYSTEM_ACCESSTOKEN') }} |
|||
-BuildId ${{coalesce(parameters.BuildId, '$env:BUILD_ID')}} |
|||
displayName: Enable permanent build retention |
|||
env: |
|||
SYSTEM_ACCESSTOKEN: $(System.AccessToken) |
|||
BUILD_ID: $(Build.BuildId) |
|||
@ -0,0 +1,93 @@ |
|||
# Please remember to update the documentation if you make changes to these parameters! |
|||
parameters: |
|||
HelixSource: 'pr/default' # required -- sources must start with pr/, official/, prodcon/, or agent/ |
|||
HelixType: 'tests/default/' # required -- Helix telemetry which identifies what type of data this is; should include "test" for clarity and must end in '/' |
|||
HelixBuild: $(Build.BuildNumber) # required -- the build number Helix will use to identify this -- automatically set to the AzDO build number |
|||
HelixTargetQueues: '' # required -- semicolon-delimited list of Helix queues to test on; see https://helix.dot.net/ for a list of queues |
|||
HelixAccessToken: '' # required -- access token to make Helix API requests; should be provided by the appropriate variable group |
|||
HelixProjectPath: 'eng/common/helixpublish.proj' # optional -- path to the project file to build relative to BUILD_SOURCESDIRECTORY |
|||
HelixProjectArguments: '' # optional -- arguments passed to the build command |
|||
HelixConfiguration: '' # optional -- additional property attached to a job |
|||
HelixPreCommands: '' # optional -- commands to run before Helix work item execution |
|||
HelixPostCommands: '' # optional -- commands to run after Helix work item execution |
|||
WorkItemDirectory: '' # optional -- a payload directory to zip up and send to Helix; requires WorkItemCommand; incompatible with XUnitProjects |
|||
WorkItemCommand: '' # optional -- a command to execute on the payload; requires WorkItemDirectory; incompatible with XUnitProjects |
|||
WorkItemTimeout: '' # optional -- a timeout in TimeSpan.Parse-ready value (e.g. 00:02:00) for the work item command; requires WorkItemDirectory; incompatible with XUnitProjects |
|||
CorrelationPayloadDirectory: '' # optional -- a directory to zip up and send to Helix as a correlation payload |
|||
XUnitProjects: '' # optional -- semicolon-delimited list of XUnitProjects to parse and send to Helix; requires XUnitRuntimeTargetFramework, XUnitPublishTargetFramework, XUnitRunnerVersion, and IncludeDotNetCli=true |
|||
XUnitWorkItemTimeout: '' # optional -- the workitem timeout in seconds for all workitems created from the xUnit projects specified by XUnitProjects |
|||
XUnitPublishTargetFramework: '' # optional -- framework to use to publish your xUnit projects |
|||
XUnitRuntimeTargetFramework: '' # optional -- framework to use for the xUnit console runner |
|||
XUnitRunnerVersion: '' # optional -- version of the xUnit nuget package you wish to use on Helix; required for XUnitProjects |
|||
IncludeDotNetCli: false # optional -- true will download a version of the .NET CLI onto the Helix machine as a correlation payload; requires DotNetCliPackageType and DotNetCliVersion |
|||
DotNetCliPackageType: '' # optional -- either 'sdk', 'runtime' or 'aspnetcore-runtime'; determines whether the sdk or runtime will be sent to Helix; see https://raw.githubusercontent.com/dotnet/core/main/release-notes/releases-index.json |
|||
DotNetCliVersion: '' # optional -- version of the CLI to send to Helix; based on this: https://raw.githubusercontent.com/dotnet/core/main/release-notes/releases-index.json |
|||
WaitForWorkItemCompletion: true # optional -- true will make the task wait until work items have been completed and fail the build if work items fail. False is "fire and forget." |
|||
IsExternal: false # [DEPRECATED] -- doesn't do anything, jobs are external if HelixAccessToken is empty and Creator is set |
|||
HelixBaseUri: 'https://helix.dot.net/' # optional -- sets the Helix API base URI (allows targeting https://helix.int-dot.net ) |
|||
Creator: '' # optional -- if the build is external, use this to specify who is sending the job |
|||
DisplayNamePrefix: 'Run Tests' # optional -- rename the beginning of the displayName of the steps in AzDO |
|||
condition: succeeded() # optional -- condition for step to execute; defaults to succeeded() |
|||
continueOnError: false # optional -- determines whether to continue the build if the step errors; defaults to false |
|||
|
|||
steps: |
|||
- powershell: 'powershell "$env:BUILD_SOURCESDIRECTORY\eng\common\msbuild.ps1 $env:BUILD_SOURCESDIRECTORY/${{ parameters.HelixProjectPath }} /restore /p:TreatWarningsAsErrors=false ${{ parameters.HelixProjectArguments }} /t:Test /bl:$env:BUILD_SOURCESDIRECTORY\artifacts\log\$env:BuildConfig\SendToHelix.binlog"' |
|||
displayName: ${{ parameters.DisplayNamePrefix }} (Windows) |
|||
env: |
|||
BuildConfig: $(_BuildConfig) |
|||
HelixSource: ${{ parameters.HelixSource }} |
|||
HelixType: ${{ parameters.HelixType }} |
|||
HelixBuild: ${{ parameters.HelixBuild }} |
|||
HelixConfiguration: ${{ parameters.HelixConfiguration }} |
|||
HelixTargetQueues: ${{ parameters.HelixTargetQueues }} |
|||
HelixAccessToken: ${{ parameters.HelixAccessToken }} |
|||
HelixPreCommands: ${{ parameters.HelixPreCommands }} |
|||
HelixPostCommands: ${{ parameters.HelixPostCommands }} |
|||
WorkItemDirectory: ${{ parameters.WorkItemDirectory }} |
|||
WorkItemCommand: ${{ parameters.WorkItemCommand }} |
|||
WorkItemTimeout: ${{ parameters.WorkItemTimeout }} |
|||
CorrelationPayloadDirectory: ${{ parameters.CorrelationPayloadDirectory }} |
|||
XUnitProjects: ${{ parameters.XUnitProjects }} |
|||
XUnitWorkItemTimeout: ${{ parameters.XUnitWorkItemTimeout }} |
|||
XUnitPublishTargetFramework: ${{ parameters.XUnitPublishTargetFramework }} |
|||
XUnitRuntimeTargetFramework: ${{ parameters.XUnitRuntimeTargetFramework }} |
|||
XUnitRunnerVersion: ${{ parameters.XUnitRunnerVersion }} |
|||
IncludeDotNetCli: ${{ parameters.IncludeDotNetCli }} |
|||
DotNetCliPackageType: ${{ parameters.DotNetCliPackageType }} |
|||
DotNetCliVersion: ${{ parameters.DotNetCliVersion }} |
|||
WaitForWorkItemCompletion: ${{ parameters.WaitForWorkItemCompletion }} |
|||
HelixBaseUri: ${{ parameters.HelixBaseUri }} |
|||
Creator: ${{ parameters.Creator }} |
|||
SYSTEM_ACCESSTOKEN: $(System.AccessToken) |
|||
condition: and(${{ parameters.condition }}, eq(variables['Agent.Os'], 'Windows_NT')) |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
- script: $BUILD_SOURCESDIRECTORY/eng/common/msbuild.sh $BUILD_SOURCESDIRECTORY/${{ parameters.HelixProjectPath }} /restore /p:TreatWarningsAsErrors=false ${{ parameters.HelixProjectArguments }} /t:Test /bl:$BUILD_SOURCESDIRECTORY/artifacts/log/$BuildConfig/SendToHelix.binlog |
|||
displayName: ${{ parameters.DisplayNamePrefix }} (Unix) |
|||
env: |
|||
BuildConfig: $(_BuildConfig) |
|||
HelixSource: ${{ parameters.HelixSource }} |
|||
HelixType: ${{ parameters.HelixType }} |
|||
HelixBuild: ${{ parameters.HelixBuild }} |
|||
HelixConfiguration: ${{ parameters.HelixConfiguration }} |
|||
HelixTargetQueues: ${{ parameters.HelixTargetQueues }} |
|||
HelixAccessToken: ${{ parameters.HelixAccessToken }} |
|||
HelixPreCommands: ${{ parameters.HelixPreCommands }} |
|||
HelixPostCommands: ${{ parameters.HelixPostCommands }} |
|||
WorkItemDirectory: ${{ parameters.WorkItemDirectory }} |
|||
WorkItemCommand: ${{ parameters.WorkItemCommand }} |
|||
WorkItemTimeout: ${{ parameters.WorkItemTimeout }} |
|||
CorrelationPayloadDirectory: ${{ parameters.CorrelationPayloadDirectory }} |
|||
XUnitProjects: ${{ parameters.XUnitProjects }} |
|||
XUnitWorkItemTimeout: ${{ parameters.XUnitWorkItemTimeout }} |
|||
XUnitPublishTargetFramework: ${{ parameters.XUnitPublishTargetFramework }} |
|||
XUnitRuntimeTargetFramework: ${{ parameters.XUnitRuntimeTargetFramework }} |
|||
XUnitRunnerVersion: ${{ parameters.XUnitRunnerVersion }} |
|||
IncludeDotNetCli: ${{ parameters.IncludeDotNetCli }} |
|||
DotNetCliPackageType: ${{ parameters.DotNetCliPackageType }} |
|||
DotNetCliVersion: ${{ parameters.DotNetCliVersion }} |
|||
WaitForWorkItemCompletion: ${{ parameters.WaitForWorkItemCompletion }} |
|||
HelixBaseUri: ${{ parameters.HelixBaseUri }} |
|||
Creator: ${{ parameters.Creator }} |
|||
SYSTEM_ACCESSTOKEN: $(System.AccessToken) |
|||
condition: and(${{ parameters.condition }}, ne(variables['Agent.Os'], 'Windows_NT')) |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
@ -0,0 +1,129 @@ |
|||
parameters: |
|||
# This template adds arcade-powered source-build to CI. |
|||
|
|||
# This is a 'steps' template, and is intended for advanced scenarios where the existing build |
|||
# infra has a careful build methodology that must be followed. For example, a repo |
|||
# (dotnet/runtime) might choose to clone the GitHub repo only once and store it as a pipeline |
|||
# artifact for all subsequent jobs to use, to reduce dependence on a strong network connection to |
|||
# GitHub. Using this steps template leaves room for that infra to be included. |
|||
|
|||
# Defines the platform on which to run the steps. See 'eng/common/core-templates/job/source-build.yml' |
|||
# for details. The entire object is described in the 'job' template for simplicity, even though |
|||
# the usage of the properties on this object is split between the 'job' and 'steps' templates. |
|||
platform: {} |
|||
is1ESPipeline: false |
|||
|
|||
steps: |
|||
# Build. Keep it self-contained for simple reusability. (No source-build-specific job variables.) |
|||
- script: | |
|||
set -x |
|||
df -h |
|||
|
|||
# If file changes are detected, set CopyWipIntoInnerSourceBuildRepo to copy the WIP changes into the inner source build repo. |
|||
internalRestoreArgs= |
|||
if ! git diff --quiet; then |
|||
internalRestoreArgs='/p:CopyWipIntoInnerSourceBuildRepo=true' |
|||
# The 'Copy WIP' feature of source build uses git stash to apply changes from the original repo. |
|||
# This only works if there is a username/email configured, which won't be the case in most CI runs. |
|||
git config --get user.email |
|||
if [ $? -ne 0 ]; then |
|||
git config user.email dn-bot@microsoft.com |
|||
git config user.name dn-bot |
|||
fi |
|||
fi |
|||
|
|||
# If building on the internal project, the internal storage variable may be available (usually only if needed) |
|||
# In that case, add variables to allow the download of internal runtimes if the specified versions are not found |
|||
# in the default public locations. |
|||
internalRuntimeDownloadArgs= |
|||
if [ '$(dotnetbuilds-internal-container-read-token-base64)' != '$''(dotnetbuilds-internal-container-read-token-base64)' ]; then |
|||
internalRuntimeDownloadArgs='/p:DotNetRuntimeSourceFeed=https://dotnetbuilds.blob.core.windows.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64) --runtimesourcefeed https://dotnetbuilds.blob.core.windows.net/internal --runtimesourcefeedkey $(dotnetbuilds-internal-container-read-token-base64)' |
|||
fi |
|||
|
|||
buildConfig=Release |
|||
# Check if AzDO substitutes in a build config from a variable, and use it if so. |
|||
if [ '$(_BuildConfig)' != '$''(_BuildConfig)' ]; then |
|||
buildConfig='$(_BuildConfig)' |
|||
fi |
|||
|
|||
officialBuildArgs= |
|||
if [ '${{ and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}' = 'True' ]; then |
|||
officialBuildArgs='/p:DotNetPublishUsingPipelines=true /p:OfficialBuildId=$(BUILD.BUILDNUMBER)' |
|||
fi |
|||
|
|||
targetRidArgs= |
|||
if [ '${{ parameters.platform.targetRID }}' != '' ]; then |
|||
targetRidArgs='/p:TargetRid=${{ parameters.platform.targetRID }}' |
|||
fi |
|||
|
|||
runtimeOsArgs= |
|||
if [ '${{ parameters.platform.runtimeOS }}' != '' ]; then |
|||
runtimeOsArgs='/p:RuntimeOS=${{ parameters.platform.runtimeOS }}' |
|||
fi |
|||
|
|||
baseOsArgs= |
|||
if [ '${{ parameters.platform.baseOS }}' != '' ]; then |
|||
baseOsArgs='/p:BaseOS=${{ parameters.platform.baseOS }}' |
|||
fi |
|||
|
|||
publishArgs= |
|||
if [ '${{ parameters.platform.skipPublishValidation }}' != 'true' ]; then |
|||
publishArgs='--publish' |
|||
fi |
|||
|
|||
assetManifestFileName=SourceBuild_RidSpecific.xml |
|||
if [ '${{ parameters.platform.name }}' != '' ]; then |
|||
assetManifestFileName=SourceBuild_${{ parameters.platform.name }}.xml |
|||
fi |
|||
|
|||
${{ coalesce(parameters.platform.buildScript, './build.sh') }} --ci \ |
|||
--configuration $buildConfig \ |
|||
--restore --build --pack $publishArgs -bl \ |
|||
$officialBuildArgs \ |
|||
$internalRuntimeDownloadArgs \ |
|||
$internalRestoreArgs \ |
|||
$targetRidArgs \ |
|||
$runtimeOsArgs \ |
|||
$baseOsArgs \ |
|||
/p:SourceBuildNonPortable=${{ parameters.platform.nonPortable }} \ |
|||
/p:ArcadeBuildFromSource=true \ |
|||
/p:DotNetBuildSourceOnly=true \ |
|||
/p:DotNetBuildRepo=true \ |
|||
/p:AssetManifestFileName=$assetManifestFileName |
|||
displayName: Build |
|||
|
|||
# Upload build logs for diagnosis. |
|||
- task: CopyFiles@2 |
|||
displayName: Prepare BuildLogs staging directory |
|||
inputs: |
|||
SourceFolder: '$(Build.SourcesDirectory)' |
|||
Contents: | |
|||
**/*.log |
|||
**/*.binlog |
|||
artifacts/sb/prebuilt-report/** |
|||
TargetFolder: '$(Build.StagingDirectory)/BuildLogs' |
|||
CleanTargetFolder: true |
|||
continueOnError: true |
|||
condition: succeededOrFailed() |
|||
|
|||
- template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
args: |
|||
displayName: Publish BuildLogs |
|||
targetPath: '$(Build.StagingDirectory)/BuildLogs' |
|||
artifactName: BuildLogs_SourceBuild_${{ parameters.platform.name }}_Attempt$(System.JobAttempt) |
|||
continueOnError: true |
|||
condition: succeededOrFailed() |
|||
sbomEnabled: false # we don't need SBOM for logs |
|||
|
|||
# Manually inject component detection so that we can ignore the source build upstream cache, which contains |
|||
# a nupkg cache of input packages (a local feed). |
|||
# This path must match the upstream cache path in property 'CurrentRepoSourceBuiltNupkgCacheDir' |
|||
# in src\Microsoft.DotNet.Arcade.Sdk\tools\SourceBuild\SourceBuildArcade.targets |
|||
- template: /eng/common/core-templates/steps/component-governance.yml |
|||
parameters: |
|||
displayName: Component Detection (Exclude upstream cache) |
|||
is1ESPipeline: ${{ parameters.is1ESPipeline }} |
|||
componentGovernanceIgnoreDirectories: '$(Build.SourcesDirectory)/artifacts/sb/src/artifacts/obj/source-built-upstream-cache' |
|||
disableComponentGovernance: ${{ eq(variables['System.TeamProject'], 'public') }} |
|||
@ -0,0 +1,8 @@ |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
variables: |
|||
- ${{ if eq(parameters.is1ESPipeline, 'true') }}: |
|||
- template: /eng/common/templates-official/variables/pool-providers.yml |
|||
- ${{ else }}: |
|||
- template: /eng/common/templates/variables/pool-providers.yml |
|||
@ -0,0 +1,9 @@ |
|||
diff -u -r a/usr/lib/libc.so b/usr/lib/libc.so
|
|||
--- a/usr/lib64/libc.so 2016-12-30 23:00:08.284951863 +0900
|
|||
+++ b/usr/lib64/libc.so 2016-12-30 23:00:32.140951815 +0900
|
|||
@@ -2,4 +2,4 @@
|
|||
Use the shared library, but some functions are only in |
|||
the static library, so try that secondarily. */ |
|||
OUTPUT_FORMAT(elf64-littleriscv) |
|||
-GROUP ( /lib64/libc.so.6 /usr/lib64/libc_nonshared.a AS_NEEDED ( /lib64/ld-linux-riscv64-lp64d.so.1 ) )
|
|||
+GROUP ( libc.so.6 libc_nonshared.a AS_NEEDED ( ld-linux-riscv64-lp64d.so.1 ) )
|
|||
@ -1,4 +1,11 @@ |
|||
<!-- Licensed to the .NET Foundation under one or more agreements. The .NET Foundation licenses this file to you under the MIT license. --> |
|||
<Project> |
|||
|
|||
<PropertyGroup> |
|||
<ImportDirectoryBuildTargets>false</ImportDirectoryBuildTargets> |
|||
<ImportDirectoryPackagesProps>false</ImportDirectoryPackagesProps> |
|||
</PropertyGroup> |
|||
|
|||
<Import Project="Sdk.props" Sdk="Microsoft.DotNet.Arcade.Sdk" /> |
|||
|
|||
</Project> |
|||
|
|||
@ -0,0 +1,121 @@ |
|||
<# |
|||
.SYNOPSIS |
|||
Verifies that Microsoft NuGet packages have proper metadata. |
|||
.DESCRIPTION |
|||
Downloads a verification tool and runs metadata validation on the provided NuGet packages. This script writes an |
|||
error if any of the provided packages fail validation. All arguments provided to this PowerShell script that do not |
|||
match PowerShell parameters are passed on to the verification tool downloaded during the execution of this script. |
|||
.PARAMETER NuGetExePath |
|||
The path to the nuget.exe binary to use. If not provided, nuget.exe will be downloaded into the -DownloadPath |
|||
directory. |
|||
.PARAMETER PackageSource |
|||
The package source to use to download the verification tool. If not provided, nuget.org will be used. |
|||
.PARAMETER DownloadPath |
|||
The directory path to download the verification tool and nuget.exe to. If not provided, |
|||
%TEMP%\NuGet.VerifyNuGetPackage will be used. |
|||
.PARAMETER args |
|||
Arguments that will be passed to the verification tool. |
|||
.EXAMPLE |
|||
PS> .\verify.ps1 *.nupkg |
|||
Verifies the metadata of all .nupkg files in the currect working directory. |
|||
.EXAMPLE |
|||
PS> .\verify.ps1 --help |
|||
Displays the help text of the downloaded verifiction tool. |
|||
.LINK |
|||
https://github.com/NuGet/NuGetGallery/blob/master/src/VerifyMicrosoftPackage/README.md |
|||
#> |
|||
|
|||
# This script was copied from https://github.com/NuGet/NuGetGallery/blob/3e25ad135146676bcab0050a516939d9958bfa5d/src/VerifyMicrosoftPackage/verify.ps1 |
|||
|
|||
[CmdletBinding(PositionalBinding = $false)] |
|||
param( |
|||
[string]$NuGetExePath, |
|||
[string]$PackageSource = "https://api.nuget.org/v3/index.json", |
|||
[string]$DownloadPath, |
|||
[Parameter(ValueFromRemainingArguments = $true)] |
|||
[string[]]$args |
|||
) |
|||
|
|||
# The URL to download nuget.exe. |
|||
$nugetExeUrl = "https://dist.nuget.org/win-x86-commandline/v4.9.4/nuget.exe" |
|||
|
|||
# The package ID of the verification tool. |
|||
$packageId = "NuGet.VerifyMicrosoftPackage" |
|||
|
|||
# The location that nuget.exe and the verification tool will be downloaded to. |
|||
if (!$DownloadPath) { |
|||
$DownloadPath = (Join-Path $env:TEMP "NuGet.VerifyMicrosoftPackage") |
|||
} |
|||
|
|||
$fence = New-Object -TypeName string -ArgumentList '=', 80 |
|||
|
|||
# Create the download directory, if it doesn't already exist. |
|||
if (!(Test-Path $DownloadPath)) { |
|||
New-Item -ItemType Directory $DownloadPath | Out-Null |
|||
} |
|||
Write-Host "Using download path: $DownloadPath" |
|||
|
|||
if ($NuGetExePath) { |
|||
$nuget = $NuGetExePath |
|||
} else { |
|||
$downloadedNuGetExe = Join-Path $DownloadPath "nuget.exe" |
|||
|
|||
# Download nuget.exe, if it doesn't already exist. |
|||
if (!(Test-Path $downloadedNuGetExe)) { |
|||
Write-Host "Downloading nuget.exe from $nugetExeUrl..." |
|||
$ProgressPreference = 'SilentlyContinue' |
|||
try { |
|||
Invoke-WebRequest $nugetExeUrl -OutFile $downloadedNuGetExe |
|||
$ProgressPreference = 'Continue' |
|||
} catch { |
|||
$ProgressPreference = 'Continue' |
|||
Write-Error $_ |
|||
Write-Error "nuget.exe failed to download." |
|||
exit |
|||
} |
|||
} |
|||
|
|||
$nuget = $downloadedNuGetExe |
|||
} |
|||
|
|||
Write-Host "Using nuget.exe path: $nuget" |
|||
Write-Host " " |
|||
|
|||
# Download the latest version of the verification tool. |
|||
Write-Host "Downloading the latest version of $packageId from $packageSource..." |
|||
Write-Host $fence |
|||
& $nuget install $packageId ` |
|||
-Prerelease ` |
|||
-OutputDirectory $DownloadPath ` |
|||
-Source $PackageSource |
|||
Write-Host $fence |
|||
Write-Host " " |
|||
|
|||
if ($LASTEXITCODE -ne 0) { |
|||
Write-Error "nuget.exe failed to fetch the verify tool." |
|||
exit |
|||
} |
|||
|
|||
# Find the most recently downloaded tool |
|||
Write-Host "Finding the most recently downloaded verification tool." |
|||
$verifyProbePath = Join-Path $DownloadPath "$packageId.*" |
|||
$verifyPath = Get-ChildItem -Path $verifyProbePath -Directory ` |
|||
| Sort-Object -Property LastWriteTime -Descending ` |
|||
| Select-Object -First 1 |
|||
$verify = Join-Path $verifyPath "tools\NuGet.VerifyMicrosoftPackage.exe" |
|||
Write-Host "Using verification tool: $verify" |
|||
Write-Host " " |
|||
|
|||
# Execute the verification tool. |
|||
Write-Host "Executing the verify tool..." |
|||
Write-Host $fence |
|||
& $verify $args |
|||
Write-Host $fence |
|||
Write-Host " " |
|||
|
|||
# Respond to the exit code. |
|||
if ($LASTEXITCODE -ne 0) { |
|||
Write-Error "The verify tool found some problems." |
|||
} else { |
|||
Write-Output "The verify tool succeeded." |
|||
} |
|||
@ -0,0 +1,89 @@ |
|||
[CmdletBinding(PositionalBinding=$False)] |
|||
param( |
|||
[Parameter(Mandatory=$true, Position=0)][string] $InputPath, |
|||
[Parameter(Mandatory=$true)][string] $BinlogToolVersion, |
|||
[Parameter(Mandatory=$false)][string] $DotnetPath, |
|||
[Parameter(Mandatory=$false)][string] $PackageFeed = 'https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json', |
|||
# File with strings to redact - separated by newlines. |
|||
# For comments start the line with '# ' - such lines are ignored |
|||
[Parameter(Mandatory=$false)][string] $TokensFilePath, |
|||
[Parameter(ValueFromRemainingArguments=$true)][String[]]$TokensToRedact |
|||
) |
|||
|
|||
try { |
|||
$ErrorActionPreference = 'Stop' |
|||
Set-StrictMode -Version 2.0 |
|||
|
|||
# `tools.ps1` checks $ci to perform some actions. Since the post-build |
|||
# scripts don't necessarily execute in the same agent that run the |
|||
# build.ps1/sh script this variable isn't automatically set. |
|||
$ci = $true |
|||
$disableConfigureToolsetImport = $true |
|||
. $PSScriptRoot\..\tools.ps1 |
|||
|
|||
$packageName = 'binlogtool' |
|||
|
|||
$dotnet = $DotnetPath |
|||
|
|||
if (!$dotnet) { |
|||
$dotnetRoot = InitializeDotNetCli -install:$true |
|||
$dotnet = "$dotnetRoot\dotnet.exe" |
|||
} |
|||
|
|||
$toolList = & "$dotnet" tool list -g |
|||
|
|||
if ($toolList -like "*$packageName*") { |
|||
& "$dotnet" tool uninstall $packageName -g |
|||
} |
|||
|
|||
$toolPath = "$PSScriptRoot\..\..\..\.tools" |
|||
$verbosity = 'minimal' |
|||
|
|||
New-Item -ItemType Directory -Force -Path $toolPath |
|||
|
|||
Push-Location -Path $toolPath |
|||
|
|||
try { |
|||
Write-Host "Installing Binlog redactor CLI..." |
|||
Write-Host "'$dotnet' new tool-manifest" |
|||
& "$dotnet" new tool-manifest |
|||
Write-Host "'$dotnet' tool install $packageName --local --add-source '$PackageFeed' -v $verbosity --version $BinlogToolVersion" |
|||
& "$dotnet" tool install $packageName --local --add-source "$PackageFeed" -v $verbosity --version $BinlogToolVersion |
|||
|
|||
if (Test-Path $TokensFilePath) { |
|||
Write-Host "Adding additional sensitive data for redaction from file: " $TokensFilePath |
|||
$TokensToRedact += Get-Content -Path $TokensFilePath | Foreach {$_.Trim()} | Where { $_ -notmatch "^# " } |
|||
} |
|||
|
|||
$optionalParams = [System.Collections.ArrayList]::new() |
|||
|
|||
Foreach ($p in $TokensToRedact) |
|||
{ |
|||
if($p -match '^\$\(.*\)$') |
|||
{ |
|||
Write-Host ("Ignoring token {0} as it is probably unexpanded AzDO variable" -f $p) |
|||
} |
|||
elseif($p) |
|||
{ |
|||
$optionalParams.Add("-p:" + $p) | Out-Null |
|||
} |
|||
} |
|||
|
|||
& $dotnet binlogtool redact --input:$InputPath --recurse --in-place ` |
|||
@optionalParams |
|||
|
|||
if ($LastExitCode -ne 0) { |
|||
Write-PipelineTelemetryError -Category 'Redactor' -Type 'warning' -Message "Problems using Redactor tool (exit code: $LastExitCode). But ignoring them now." |
|||
} |
|||
} |
|||
finally { |
|||
Pop-Location |
|||
} |
|||
|
|||
Write-Host 'done.' |
|||
} |
|||
catch { |
|||
Write-Host $_ |
|||
Write-PipelineTelemetryError -Category 'Redactor' -Message "There was an error while trying to redact logs. Error: $_" |
|||
ExitWithExitCode 1 |
|||
} |
|||
@ -0,0 +1,133 @@ |
|||
# Overview |
|||
|
|||
Arcade provides templates for public (`/templates`) and 1ES pipeline templates (`/templates-official`) scenarios. Pipelines which are required to be managed by 1ES pipeline templates should reference `/templates-offical`, all other pipelines may reference `/templates`. |
|||
|
|||
## How to use |
|||
|
|||
Basic guidance is: |
|||
|
|||
- 1ES Pipeline Template or 1ES Microbuild template runs should reference `eng/common/templates-official`. Any internal production-graded pipeline should use these templates. |
|||
|
|||
- All other runs should reference `eng/common/templates`. |
|||
|
|||
See [azure-pipelines.yml](../../azure-pipelines.yml) (templates-official example) or [azure-pipelines-pr.yml](../../azure-pipelines-pr.yml) (templates example) for examples. |
|||
|
|||
#### The `templateIs1ESManaged` parameter |
|||
|
|||
The `templateIs1ESManaged` is available on most templates and affects which of the variants is used for nested templates. See [Development Notes](#development-notes) below for more information on the `templateIs1ESManaged1 parameter. |
|||
|
|||
- For templates under `job/`, `jobs/`, `steps`, or `post-build/`, this parameter must be explicitly set. |
|||
|
|||
## Multiple outputs |
|||
|
|||
1ES pipeline templates impose a policy where every publish artifact execution results in additional security scans being injected into your pipeline. When using `templates-official/jobs/jobs.yml`, Arcade reduces the number of additional security injections by gathering all publishing outputs into the [Build.ArtifactStagingDirectory](https://learn.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml#build-variables-devops-services), and utilizing the [outputParentDirectory](https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/outputs#multiple-outputs) feature of 1ES pipeline templates. When implementing your pipeline, if you ensure publish artifacts are located in the `$(Build.ArtifactStagingDirectory)`, and utilize the 1ES provided template context, then you can reduce the number of security scans for your pipeline. |
|||
|
|||
Example: |
|||
``` yaml |
|||
# azure-pipelines.yml |
|||
extends: |
|||
template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate |
|||
parameters: |
|||
stages: |
|||
- stage: build |
|||
jobs: |
|||
- template: /eng/common/templates-official/jobs/jobs.yml@self |
|||
parameters: |
|||
# 1ES makes use of outputs to reduce security task injection overhead |
|||
templateContext: |
|||
outputs: |
|||
- output: pipelineArtifact |
|||
displayName: 'Publish logs from source' |
|||
continueOnError: true |
|||
condition: always() |
|||
targetPath: $(Build.ArtifactStagingDirectory)/artifacts/log |
|||
artifactName: Logs |
|||
jobs: |
|||
- job: Windows |
|||
steps: |
|||
- script: echo "friendly neighborhood" > artifacts/marvel/spiderman.txt |
|||
# copy build outputs to artifact staging directory for publishing |
|||
- task: CopyFiles@2 |
|||
displayName: Gather build output |
|||
inputs: |
|||
SourceFolder: '$(Build.SourcesDirectory)/artifacts/marvel' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/marvel' |
|||
``` |
|||
|
|||
Note: Multiple outputs are ONLY applicable to 1ES PT publishing (only usable when referencing `templates-official`). |
|||
|
|||
# Development notes |
|||
|
|||
**Folder / file structure** |
|||
|
|||
``` text |
|||
eng\common\ |
|||
[templates || templates-official]\ |
|||
job\ |
|||
job.yml (shim + artifact publishing logic) |
|||
onelocbuild.yml (shim) |
|||
publish-build-assets.yml (shim) |
|||
source-build.yml (shim) |
|||
source-index-stage1.yml (shim) |
|||
jobs\ |
|||
codeql-build.yml (shim) |
|||
jobs.yml (shim) |
|||
source-build.yml (shim) |
|||
post-build\ |
|||
post-build.yml (shim) |
|||
common-variabls.yml (shim) |
|||
setup-maestro-vars.yml (shim) |
|||
steps\ |
|||
publish-build-artifacts.yml (logic) |
|||
publish-pipeline-artifacts.yml (logic) |
|||
component-governance.yml (shim) |
|||
generate-sbom.yml (shim) |
|||
publish-logs.yml (shim) |
|||
retain-build.yml (shim) |
|||
send-to-helix.yml (shim) |
|||
source-build.yml (shim) |
|||
variables\ |
|||
pool-providers.yml (logic + redirect) # templates/variables/pool-providers.yml will redirect to templates-official/variables/pool-providers.yml if you are running in the internal project |
|||
sdl-variables.yml (logic) |
|||
core-templates\ |
|||
job\ |
|||
job.yml (logic) |
|||
onelocbuild.yml (logic) |
|||
publish-build-assets.yml (logic) |
|||
source-build.yml (logic) |
|||
source-index-stage1.yml (logic) |
|||
jobs\ |
|||
codeql-build.yml (logic) |
|||
jobs.yml (logic) |
|||
source-build.yml (logic) |
|||
post-build\ |
|||
common-variabls.yml (logic) |
|||
post-build.yml (logic) |
|||
setup-maestro-vars.yml (logic) |
|||
steps\ |
|||
component-governance.yml (logic) |
|||
generate-sbom.yml (logic) |
|||
publish-build-artifacts.yml (redirect) |
|||
publish-logs.yml (logic) |
|||
publish-pipeline-artifacts.yml (redirect) |
|||
retain-build.yml (logic) |
|||
send-to-helix.yml (logic) |
|||
source-build.yml (logic) |
|||
variables\ |
|||
pool-providers.yml (redirect) |
|||
``` |
|||
|
|||
In the table above, a file is designated as "shim", "logic", or "redirect". |
|||
|
|||
- shim - represents a yaml file which is an intermediate step between pipeline logic and .Net Core Engineering's templates (`core-templates`) and defines the `is1ESPipeline` parameter value. |
|||
|
|||
- logic - represents actual base template logic. |
|||
|
|||
- redirect- represents a file in `core-templates` which redirects to the "logic" file in either `templates` or `templates-official`. |
|||
|
|||
Logic for Arcade's templates live **primarily** in the `core-templates` folder. The exceptions to the location of the logic files are around artifact publishing, which is handled differently between 1es pipeline templates and standard templates. `templates` and `templates-official` provide shim entry points which redirect to `core-templates` while also defining the `is1ESPipeline` parameter. If a shim is referenced in `templates`, then `is1ESPipeline` is set to `false`. If a shim is referenced in `templates-official`, then `is1ESPipeline` is set to `true`. |
|||
|
|||
Within `templates` and `templates-official`, the templates at the "stages", and "jobs" / "job" level have been replaced with shims. Templates at the "steps" and "variables" level are typically too granular to be replaced with shims and instead persist logic which is directly applicable to either scenario. |
|||
|
|||
Within `core-templates`, there are a handful of places where logic is dependent on which shim entry point was used. In those places, we redirect back to the respective logic file in `templates` or `templates-official`. |
|||
@ -0,0 +1,80 @@ |
|||
parameters: |
|||
# Sbom related params |
|||
enableSbom: true |
|||
runAsPublic: false |
|||
PackageVersion: 9.0.0 |
|||
BuildDropPath: '$(Build.SourcesDirectory)/artifacts' |
|||
|
|||
jobs: |
|||
- template: /eng/common/core-templates/job/job.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
componentGovernanceSteps: |
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.enableSbom, 'true')) }}: |
|||
- template: /eng/common/templates/steps/generate-sbom.yml |
|||
parameters: |
|||
PackageVersion: ${{ parameters.packageVersion }} |
|||
BuildDropPath: ${{ parameters.buildDropPath }} |
|||
publishArtifacts: false |
|||
|
|||
# publish artifacts |
|||
# for 1ES managed templates, use the templateContext.output to handle multiple outputs. |
|||
templateContext: |
|||
outputParentDirectory: $(Build.ArtifactStagingDirectory) |
|||
outputs: |
|||
- ${{ if ne(parameters.artifacts.publish, '') }}: |
|||
- ${{ if and(ne(parameters.artifacts.publish.artifacts, 'false'), ne(parameters.artifacts.publish.artifacts, '')) }}: |
|||
- output: buildArtifacts |
|||
displayName: Publish pipeline artifacts |
|||
PathtoPublish: '$(Build.ArtifactStagingDirectory)/artifacts' |
|||
ArtifactName: ${{ coalesce(parameters.artifacts.publish.artifacts.name , 'Artifacts_$(Agent.Os)_$(_BuildConfig)') }} |
|||
condition: always() |
|||
continueOnError: true |
|||
- ${{ if and(ne(parameters.artifacts.publish.logs, 'false'), ne(parameters.artifacts.publish.logs, '')) }}: |
|||
- output: pipelineArtifact |
|||
targetPath: '$(Build.ArtifactStagingDirectory)/artifacts/log' |
|||
artifactName: ${{ coalesce(parameters.artifacts.publish.logs.name, 'Logs_Build_$(Agent.Os)_$(_BuildConfig)_Attempt$(System.JobAttempt)') }} |
|||
displayName: 'Publish logs' |
|||
continueOnError: true |
|||
condition: always() |
|||
sbomEnabled: false # we don't need SBOM for logs |
|||
|
|||
- ${{ if eq(parameters.enablePublishBuildArtifacts, true) }}: |
|||
- output: buildArtifacts |
|||
displayName: Publish Logs |
|||
PathtoPublish: '$(Build.ArtifactStagingDirectory)/artifacts/log/$(_BuildConfig)' |
|||
publishLocation: Container |
|||
ArtifactName: ${{ coalesce(parameters.enablePublishBuildArtifacts.artifactName, '$(Agent.Os)_$(Agent.JobName)' ) }} |
|||
continueOnError: true |
|||
condition: always() |
|||
sbomEnabled: false # we don't need SBOM for logs |
|||
|
|||
- ${{ if eq(parameters.enableBuildRetry, 'true') }}: |
|||
- output: pipelineArtifact |
|||
targetPath: '$(Build.ArtifactStagingDirectory)/artifacts/eng/common/BuildConfiguration' |
|||
artifactName: 'BuildConfiguration' |
|||
displayName: 'Publish build retry configuration' |
|||
continueOnError: true |
|||
sbomEnabled: false # we don't need SBOM for BuildConfiguration |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.enableSbom, 'true')) }}: |
|||
- output: pipelineArtifact |
|||
displayName: Publish SBOM manifest |
|||
continueOnError: true |
|||
targetPath: $(Build.ArtifactStagingDirectory)/sbom |
|||
artifactName: $(ARTIFACT_NAME) |
|||
|
|||
# add any outputs provided via root yaml |
|||
- ${{ if ne(parameters.templateContext.outputs, '') }}: |
|||
- ${{ each output in parameters.templateContext.outputs }}: |
|||
- ${{ output }} |
|||
|
|||
# add any remaining templateContext properties |
|||
${{ each context in parameters.templateContext }}: |
|||
${{ if and(ne(context.key, 'outputParentDirectory'), ne(context.key, 'outputs')) }}: |
|||
${{ context.key }}: ${{ context.value }} |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ if and(ne(parameter.key, 'templateContext'), ne(parameter.key, 'is1ESPipeline')) }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
jobs: |
|||
- template: /eng/common/core-templates/job/onelocbuild.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
jobs: |
|||
- template: /eng/common/core-templates/job/publish-build-assets.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
jobs: |
|||
- template: /eng/common/core-templates/job/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
jobs: |
|||
- template: /eng/common/core-templates/job/source-index-stage1.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
jobs: |
|||
- template: /eng/common/core-templates/jobs/codeql-build.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
jobs: |
|||
- template: /eng/common/core-templates/jobs/jobs.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
jobs: |
|||
- template: /eng/common/core-templates/jobs/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,8 @@ |
|||
variables: |
|||
- template: /eng/common/core-templates/post-build/common-variables.yml |
|||
parameters: |
|||
# Specifies whether to use 1ES |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,8 @@ |
|||
stages: |
|||
- template: /eng/common/core-templates/post-build/post-build.yml |
|||
parameters: |
|||
# Specifies whether to use 1ES |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,8 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/post-build/setup-maestro-vars.yml |
|||
parameters: |
|||
# Specifies whether to use 1ES |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/component-governance.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,9 @@ |
|||
# Obtains internal runtime download credentials and populates the 'dotnetbuilds-internal-container-read-token-base64' |
|||
# variable with the base64-encoded SAS token, by default |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/enable-internal-runtimes.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/enable-internal-sources.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/generate-sbom.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/get-delegation-sas.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/get-federated-access-token.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,41 @@ |
|||
parameters: |
|||
- name: displayName |
|||
type: string |
|||
default: 'Publish to Build Artifact' |
|||
|
|||
- name: condition |
|||
type: string |
|||
default: succeeded() |
|||
|
|||
- name: artifactName |
|||
type: string |
|||
|
|||
- name: pathToPublish |
|||
type: string |
|||
|
|||
- name: continueOnError |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: publishLocation |
|||
type: string |
|||
default: 'Container' |
|||
|
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: true |
|||
|
|||
steps: |
|||
- ${{ if ne(parameters.is1ESPipeline, true) }}: |
|||
- 'eng/common/templates-official cannot be referenced from a non-1ES managed template': error |
|||
- task: 1ES.PublishBuildArtifacts@1 |
|||
displayName: ${{ parameters.displayName }} |
|||
condition: ${{ parameters.condition }} |
|||
${{ if parameters.continueOnError }}: |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
inputs: |
|||
PublishLocation: ${{ parameters.publishLocation }} |
|||
PathtoPublish: ${{ parameters.pathToPublish }} |
|||
${{ if parameters.artifactName }}: |
|||
ArtifactName: ${{ parameters.artifactName }} |
|||
|
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/publish-logs.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,28 @@ |
|||
parameters: |
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: true |
|||
|
|||
- name: args |
|||
type: object |
|||
default: {} |
|||
|
|||
steps: |
|||
- ${{ if ne(parameters.is1ESPipeline, true) }}: |
|||
- 'eng/common/templates-official cannot be referenced from a non-1ES managed template': error |
|||
- task: 1ES.PublishPipelineArtifact@1 |
|||
displayName: ${{ coalesce(parameters.args.displayName, 'Publish to Build Artifact') }} |
|||
${{ if parameters.args.condition }}: |
|||
condition: ${{ parameters.args.condition }} |
|||
${{ else }}: |
|||
condition: succeeded() |
|||
${{ if parameters.args.continueOnError }}: |
|||
continueOnError: ${{ parameters.args.continueOnError }} |
|||
inputs: |
|||
targetPath: ${{ parameters.args.targetPath }} |
|||
${{ if parameters.args.artifactName }}: |
|||
artifactName: ${{ parameters.args.artifactName }} |
|||
${{ if parameters.args.properties }}: |
|||
properties: ${{ parameters.args.properties }} |
|||
${{ if parameters.args.sbomEnabled }}: |
|||
sbomEnabled: ${{ parameters.args.sbomEnabled }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/retain-build.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/send-to-helix.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: true |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,45 @@ |
|||
# Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool, |
|||
# otherwise it should go into the "normal" pools. This separates out the queueing and billing of released branches. |
|||
|
|||
# Motivation: |
|||
# Once a given branch of a repository's output has been officially "shipped" once, it is then considered to be COGS |
|||
# (Cost of goods sold) and should be moved to a servicing pool provider. This allows both separation of queueing |
|||
# (allowing release builds and main PR builds to not intefere with each other) and billing (required for COGS. |
|||
# Additionally, the pool provider name itself may be subject to change when the .NET Core Engineering Services |
|||
# team needs to move resources around and create new and potentially differently-named pools. Using this template |
|||
# file from an Arcade-ified repo helps guard against both having to update one's release/* branches and renaming. |
|||
|
|||
# How to use: |
|||
# This yaml assumes your shipped product branches use the naming convention "release/..." (which many do). |
|||
# If we find alternate naming conventions in broad usage it can be added to the condition below. |
|||
# |
|||
# First, import the template in an arcade-ified repo to pick up the variables, e.g.: |
|||
# |
|||
# variables: |
|||
# - template: /eng/common/templates-official/variables/pool-providers.yml |
|||
# |
|||
# ... then anywhere specifying the pool provider use the runtime variables, |
|||
# $(DncEngInternalBuildPool) |
|||
# |
|||
# pool: |
|||
# name: $(DncEngInternalBuildPool) |
|||
# image: 1es-windows-2022 |
|||
|
|||
variables: |
|||
# Coalesce the target and source branches so we know when a PR targets a release branch |
|||
# If these variables are somehow missing, fall back to main (tends to have more capacity) |
|||
|
|||
# Any new -Svc alternative pools should have variables added here to allow for splitting work |
|||
|
|||
- name: DncEngInternalBuildPool |
|||
value: $[ |
|||
replace( |
|||
replace( |
|||
eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), |
|||
True, |
|||
'NetCore1ESPool-Svc-Internal' |
|||
), |
|||
False, |
|||
'NetCore1ESPool-Internal' |
|||
) |
|||
] |
|||
@ -0,0 +1,7 @@ |
|||
variables: |
|||
# The Guardian version specified in 'eng/common/sdl/packages.config'. This value must be kept in |
|||
# sync with the packages.config file. |
|||
- name: DefaultGuardianVersion |
|||
value: 0.109.0 |
|||
- name: GuardianPackagesConfigFile |
|||
value: $(Build.SourcesDirectory)\eng\common\sdl\packages.config |
|||
@ -1,255 +1,82 @@ |
|||
# Internal resources (telemetry, microbuild) can only be accessed from non-public projects, |
|||
# and some (Microbuild) should only be applied to non-PR cases for internal builds. |
|||
|
|||
parameters: |
|||
# Job schema parameters - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#job |
|||
cancelTimeoutInMinutes: '' |
|||
condition: '' |
|||
container: '' |
|||
continueOnError: false |
|||
dependsOn: '' |
|||
displayName: '' |
|||
pool: '' |
|||
steps: [] |
|||
strategy: '' |
|||
timeoutInMinutes: '' |
|||
variables: [] |
|||
workspace: '' |
|||
|
|||
# Job base template specific parameters |
|||
# See schema documentation - https://github.com/dotnet/arcade/blob/master/Documentation/AzureDevOps/TemplateSchema.md |
|||
artifacts: '' |
|||
enableMicrobuild: false |
|||
parameters: |
|||
enablePublishBuildArtifacts: false |
|||
enablePublishBuildAssets: false |
|||
enablePublishTestResults: false |
|||
enablePublishUsingPipelines: false |
|||
enableBuildRetry: false |
|||
disableComponentGovernance: '' |
|||
componentGovernanceIgnoreDirectories: '' |
|||
mergeTestResults: false |
|||
testRunTitle: '' |
|||
testResultsFormat: '' |
|||
name: '' |
|||
preSteps: [] |
|||
runAsPublic: false |
|||
# Sbom related params |
|||
enableSbom: true |
|||
PackageVersion: 7.0.0 |
|||
runAsPublic: false |
|||
PackageVersion: 9.0.0 |
|||
BuildDropPath: '$(Build.SourcesDirectory)/artifacts' |
|||
|
|||
jobs: |
|||
- job: ${{ parameters.name }} |
|||
|
|||
${{ if ne(parameters.cancelTimeoutInMinutes, '') }}: |
|||
cancelTimeoutInMinutes: ${{ parameters.cancelTimeoutInMinutes }} |
|||
|
|||
${{ if ne(parameters.condition, '') }}: |
|||
condition: ${{ parameters.condition }} |
|||
|
|||
${{ if ne(parameters.container, '') }}: |
|||
container: ${{ parameters.container }} |
|||
|
|||
${{ if ne(parameters.continueOnError, '') }}: |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
|
|||
${{ if ne(parameters.dependsOn, '') }}: |
|||
dependsOn: ${{ parameters.dependsOn }} |
|||
|
|||
${{ if ne(parameters.displayName, '') }}: |
|||
displayName: ${{ parameters.displayName }} |
|||
|
|||
${{ if ne(parameters.pool, '') }}: |
|||
pool: ${{ parameters.pool }} |
|||
|
|||
${{ if ne(parameters.strategy, '') }}: |
|||
strategy: ${{ parameters.strategy }} |
|||
|
|||
${{ if ne(parameters.timeoutInMinutes, '') }}: |
|||
timeoutInMinutes: ${{ parameters.timeoutInMinutes }} |
|||
|
|||
variables: |
|||
- ${{ if ne(parameters.enableTelemetry, 'false') }}: |
|||
- name: DOTNET_CLI_TELEMETRY_PROFILE |
|||
value: '$(Build.Repository.Uri)' |
|||
- ${{ if eq(parameters.enableRichCodeNavigation, 'true') }}: |
|||
- name: EnableRichCodeNavigation |
|||
value: 'true' |
|||
# Retry signature validation up to three times, waiting 2 seconds between attempts. |
|||
# See https://learn.microsoft.com/en-us/nuget/reference/errors-and-warnings/nu3028#retry-untrusted-root-failures |
|||
- name: NUGET_EXPERIMENTAL_CHAIN_BUILD_RETRY_POLICY |
|||
value: 3,2000 |
|||
- ${{ each variable in parameters.variables }}: |
|||
# handle name-value variable syntax |
|||
# example: |
|||
# - name: [key] |
|||
# value: [value] |
|||
- ${{ if ne(variable.name, '') }}: |
|||
- name: ${{ variable.name }} |
|||
value: ${{ variable.value }} |
|||
|
|||
# handle variable groups |
|||
- ${{ if ne(variable.group, '') }}: |
|||
- group: ${{ variable.group }} |
|||
|
|||
# handle template variable syntax |
|||
# example: |
|||
# - template: path/to/template.yml |
|||
# parameters: |
|||
# [key]: [value] |
|||
- ${{ if ne(variable.template, '') }}: |
|||
- template: ${{ variable.template }} |
|||
${{ if ne(variable.parameters, '') }}: |
|||
parameters: ${{ variable.parameters }} |
|||
- template: /eng/common/core-templates/job/job.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
# handle key-value variable syntax. |
|||
# example: |
|||
# - [key]: [value] |
|||
- ${{ if and(eq(variable.name, ''), eq(variable.group, ''), eq(variable.template, '')) }}: |
|||
- ${{ each pair in variable }}: |
|||
- name: ${{ pair.key }} |
|||
value: ${{ pair.value }} |
|||
${{ each parameter in parameters }}: |
|||
${{ if and(ne(parameter.key, 'steps'), ne(parameter.key, 'is1ESPipeline')) }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
# DotNet-HelixApi-Access provides 'HelixApiAccessToken' for internal builds |
|||
- ${{ if and(eq(parameters.enableTelemetry, 'true'), eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- group: DotNet-HelixApi-Access |
|||
steps: |
|||
- ${{ each step in parameters.steps }}: |
|||
- ${{ step }} |
|||
|
|||
${{ if ne(parameters.workspace, '') }}: |
|||
workspace: ${{ parameters.workspace }} |
|||
|
|||
steps: |
|||
- ${{ if ne(parameters.preSteps, '') }}: |
|||
- ${{ each preStep in parameters.preSteps }}: |
|||
- ${{ preStep }} |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- ${{ if eq(parameters.enableMicrobuild, 'true') }}: |
|||
- task: MicroBuildSigningPlugin@3 |
|||
displayName: Install MicroBuild plugin |
|||
inputs: |
|||
signType: $(_SignType) |
|||
zipSources: false |
|||
feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json |
|||
env: |
|||
TeamName: $(_TeamName) |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
condition: and(succeeded(), in(variables['_SignType'], 'real', 'test'), eq(variables['Agent.Os'], 'Windows_NT')) |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), eq(variables['System.TeamProject'], 'internal')) }}: |
|||
- task: NuGetAuthenticate@0 |
|||
|
|||
- ${{ if and(ne(parameters.artifacts.download, 'false'), ne(parameters.artifacts.download, '')) }}: |
|||
- task: DownloadPipelineArtifact@2 |
|||
inputs: |
|||
buildType: current |
|||
artifactName: ${{ coalesce(parameters.artifacts.download.name, 'Artifacts_$(Agent.OS)_$(_BuildConfig)') }} |
|||
targetPath: ${{ coalesce(parameters.artifacts.download.path, 'artifacts') }} |
|||
itemPattern: ${{ coalesce(parameters.artifacts.download.pattern, '**') }} |
|||
|
|||
- ${{ each step in parameters.steps }}: |
|||
- ${{ step }} |
|||
|
|||
- ${{ if eq(parameters.enableRichCodeNavigation, true) }}: |
|||
- task: RichCodeNavIndexer@0 |
|||
displayName: RichCodeNav Upload |
|||
inputs: |
|||
languages: ${{ coalesce(parameters.richCodeNavigationLanguage, 'csharp') }} |
|||
environment: ${{ coalesce(parameters.richCodeNavigationEnvironment, 'production') }} |
|||
richNavLogOutputDirectory: $(Build.SourcesDirectory)/artifacts/bin |
|||
uploadRichNavArtifacts: ${{ coalesce(parameters.richCodeNavigationUploadArtifacts, false) }} |
|||
continueOnError: true |
|||
|
|||
- template: /eng/common/templates/steps/component-governance.yml |
|||
parameters: |
|||
${{ if eq(parameters.disableComponentGovernance, '') }}: |
|||
${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.runAsPublic, 'false'), or(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/dotnet/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/microsoft/'), eq(variables['Build.SourceBranch'], 'refs/heads/main'))) }}: |
|||
disableComponentGovernance: false |
|||
${{ else }}: |
|||
disableComponentGovernance: true |
|||
${{ else }}: |
|||
disableComponentGovernance: ${{ parameters.disableComponentGovernance }} |
|||
componentGovernanceIgnoreDirectories: ${{ parameters.componentGovernanceIgnoreDirectories }} |
|||
|
|||
- ${{ if eq(parameters.enableMicrobuild, 'true') }}: |
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- task: MicroBuildCleanup@1 |
|||
displayName: Execute Microbuild cleanup tasks |
|||
condition: and(always(), in(variables['_SignType'], 'real', 'test'), eq(variables['Agent.Os'], 'Windows_NT')) |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
env: |
|||
TeamName: $(_TeamName) |
|||
|
|||
- ${{ if ne(parameters.artifacts.publish, '') }}: |
|||
- ${{ if and(ne(parameters.artifacts.publish.artifacts, 'false'), ne(parameters.artifacts.publish.artifacts, '')) }}: |
|||
- task: CopyFiles@2 |
|||
displayName: Gather binaries for publish to artifacts |
|||
inputs: |
|||
SourceFolder: 'artifacts/bin' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/bin' |
|||
- task: CopyFiles@2 |
|||
displayName: Gather packages for publish to artifacts |
|||
inputs: |
|||
SourceFolder: 'artifacts/packages' |
|||
Contents: '**' |
|||
TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/packages' |
|||
- task: PublishBuildArtifacts@1 |
|||
displayName: Publish pipeline artifacts |
|||
inputs: |
|||
PathtoPublish: '$(Build.ArtifactStagingDirectory)/artifacts' |
|||
PublishLocation: Container |
|||
ArtifactName: ${{ coalesce(parameters.artifacts.publish.artifacts.name , 'Artifacts_$(Agent.Os)_$(_BuildConfig)') }} |
|||
continueOnError: true |
|||
condition: always() |
|||
- ${{ if and(ne(parameters.artifacts.publish.logs, 'false'), ne(parameters.artifacts.publish.logs, '')) }}: |
|||
- publish: artifacts/log |
|||
artifact: ${{ coalesce(parameters.artifacts.publish.logs.name, 'Logs_Build_$(Agent.Os)_$(_BuildConfig)') }} |
|||
displayName: Publish logs |
|||
continueOnError: true |
|||
condition: always() |
|||
|
|||
- ${{ if ne(parameters.enablePublishBuildArtifacts, 'false') }}: |
|||
- task: PublishBuildArtifacts@1 |
|||
displayName: Publish Logs |
|||
inputs: |
|||
PathtoPublish: '$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)' |
|||
PublishLocation: Container |
|||
ArtifactName: ${{ coalesce(parameters.enablePublishBuildArtifacts.artifactName, '$(Agent.Os)_$(Agent.JobName)' ) }} |
|||
continueOnError: true |
|||
condition: always() |
|||
|
|||
- ${{ if or(and(eq(parameters.enablePublishTestResults, 'true'), eq(parameters.testResultsFormat, '')), eq(parameters.testResultsFormat, 'xunit')) }}: |
|||
- task: PublishTestResults@2 |
|||
displayName: Publish XUnit Test Results |
|||
inputs: |
|||
testResultsFormat: 'xUnit' |
|||
testResultsFiles: '*.xml' |
|||
searchFolder: '$(Build.SourcesDirectory)/artifacts/TestResults/$(_BuildConfig)' |
|||
testRunTitle: ${{ coalesce(parameters.testRunTitle, parameters.name, '$(System.JobName)') }}-xunit |
|||
mergeTestResults: ${{ parameters.mergeTestResults }} |
|||
continueOnError: true |
|||
condition: always() |
|||
- ${{ if or(and(eq(parameters.enablePublishTestResults, 'true'), eq(parameters.testResultsFormat, '')), eq(parameters.testResultsFormat, 'vstest')) }}: |
|||
- task: PublishTestResults@2 |
|||
displayName: Publish TRX Test Results |
|||
inputs: |
|||
testResultsFormat: 'VSTest' |
|||
testResultsFiles: '*.trx' |
|||
searchFolder: '$(Build.SourcesDirectory)/artifacts/TestResults/$(_BuildConfig)' |
|||
testRunTitle: ${{ coalesce(parameters.testRunTitle, parameters.name, '$(System.JobName)') }}-trx |
|||
mergeTestResults: ${{ parameters.mergeTestResults }} |
|||
continueOnError: true |
|||
condition: always() |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.enableSbom, 'true')) }}: |
|||
- template: /eng/common/templates/steps/generate-sbom.yml |
|||
componentGovernanceSteps: |
|||
- template: /eng/common/templates/steps/component-governance.yml |
|||
parameters: |
|||
PackageVersion: ${{ parameters.packageVersion}} |
|||
BuildDropPath: ${{ parameters.buildDropPath }} |
|||
IgnoreDirectories: ${{ parameters.componentGovernanceIgnoreDirectories }} |
|||
|
|||
- ${{ if eq(parameters.enableBuildRetry, 'true') }}: |
|||
- publish: $(Build.SourcesDirectory)\eng\common\BuildConfiguration |
|||
artifact: BuildConfiguration |
|||
displayName: Publish build retry configuration |
|||
continueOnError: true |
|||
${{ if eq(parameters.disableComponentGovernance, '') }}: |
|||
${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.runAsPublic, 'false'), or(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/dotnet/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/microsoft/'), eq(variables['Build.SourceBranch'], 'refs/heads/main'))) }}: |
|||
disableComponentGovernance: false |
|||
${{ else }}: |
|||
disableComponentGovernance: true |
|||
${{ else }}: |
|||
disableComponentGovernance: ${{ parameters.disableComponentGovernance }} |
|||
componentGovernanceIgnoreDirectories: ${{ parameters.componentGovernanceIgnoreDirectories }} |
|||
|
|||
artifactPublishSteps: |
|||
- ${{ if ne(parameters.artifacts.publish, '') }}: |
|||
- ${{ if and(ne(parameters.artifacts.publish.artifacts, 'false'), ne(parameters.artifacts.publish.artifacts, '')) }}: |
|||
- template: /eng/common/core-templates/steps/publish-build-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
args: |
|||
displayName: Publish pipeline artifacts |
|||
pathToPublish: '$(Build.ArtifactStagingDirectory)/artifacts' |
|||
publishLocation: Container |
|||
artifactName: ${{ coalesce(parameters.artifacts.publish.artifacts.name , 'Artifacts_$(Agent.Os)_$(_BuildConfig)') }} |
|||
continueOnError: true |
|||
condition: always() |
|||
- ${{ if and(ne(parameters.artifacts.publish.logs, 'false'), ne(parameters.artifacts.publish.logs, '')) }}: |
|||
- template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
args: |
|||
targetPath: '$(Build.ArtifactStagingDirectory)/artifacts/log' |
|||
artifactName: ${{ coalesce(parameters.artifacts.publish.logs.name, 'Logs_Build_$(Agent.Os)_$(_BuildConfig)') }} |
|||
displayName: 'Publish logs' |
|||
continueOnError: true |
|||
condition: always() |
|||
sbomEnabled: false # we don't need SBOM for logs |
|||
|
|||
- ${{ if ne(parameters.enablePublishBuildArtifacts, 'false') }}: |
|||
- template: /eng/common/core-templates/steps/publish-build-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
args: |
|||
displayName: Publish Logs |
|||
pathToPublish: '$(Build.ArtifactStagingDirectory)/artifacts/log/$(_BuildConfig)' |
|||
publishLocation: Container |
|||
artifactName: ${{ coalesce(parameters.enablePublishBuildArtifacts.artifactName, '$(Agent.Os)_$(Agent.JobName)' ) }} |
|||
continueOnError: true |
|||
condition: always() |
|||
|
|||
- ${{ if eq(parameters.enableBuildRetry, 'true') }}: |
|||
- template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
args: |
|||
targetPath: '$(Build.SourcesDirectory)\eng\common\BuildConfiguration' |
|||
artifactName: 'BuildConfiguration' |
|||
displayName: 'Publish build retry configuration' |
|||
continueOnError: true |
|||
sbomEnabled: false # we don't need SBOM for BuildConfiguration |
|||
|
|||
@ -1,109 +1,7 @@ |
|||
parameters: |
|||
# Optional: dependencies of the job |
|||
dependsOn: '' |
|||
|
|||
# Optional: A defined YAML pool - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#pool |
|||
pool: '' |
|||
|
|||
CeapexPat: $(dn-bot-ceapex-package-r) # PAT for the loc AzDO instance https://dev.azure.com/ceapex |
|||
GithubPat: $(BotAccount-dotnet-bot-repo-PAT) |
|||
|
|||
SourcesDirectory: $(Build.SourcesDirectory) |
|||
CreatePr: true |
|||
AutoCompletePr: false |
|||
ReusePr: true |
|||
UseLfLineEndings: true |
|||
UseCheckedInLocProjectJson: false |
|||
SkipLocProjectJsonGeneration: false |
|||
LanguageSet: VS_Main_Languages |
|||
LclSource: lclFilesInRepo |
|||
LclPackageId: '' |
|||
RepoType: gitHub |
|||
GitHubOrg: dotnet |
|||
MirrorRepo: '' |
|||
MirrorBranch: main |
|||
condition: '' |
|||
JobNameSuffix: '' |
|||
|
|||
jobs: |
|||
- job: OneLocBuild${{ parameters.JobNameSuffix }} |
|||
|
|||
dependsOn: ${{ parameters.dependsOn }} |
|||
|
|||
displayName: OneLocBuild${{ parameters.JobNameSuffix }} |
|||
|
|||
variables: |
|||
- group: OneLocBuildVariables # Contains the CeapexPat and GithubPat |
|||
- name: _GenerateLocProjectArguments |
|||
value: -SourcesDirectory ${{ parameters.SourcesDirectory }} |
|||
-LanguageSet "${{ parameters.LanguageSet }}" |
|||
-CreateNeutralXlfs |
|||
- ${{ if eq(parameters.UseCheckedInLocProjectJson, 'true') }}: |
|||
- name: _GenerateLocProjectArguments |
|||
value: ${{ variables._GenerateLocProjectArguments }} -UseCheckedInLocProjectJson |
|||
- template: /eng/common/templates/variables/pool-providers.yml |
|||
|
|||
${{ if ne(parameters.pool, '') }}: |
|||
pool: ${{ parameters.pool }} |
|||
${{ if eq(parameters.pool, '') }}: |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: VSEngSS-MicroBuild2022-1ES |
|||
demands: Cmd |
|||
# If it's not devdiv, it's dnceng |
|||
${{ if ne(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2019.amd64 |
|||
|
|||
steps: |
|||
- ${{ if ne(parameters.SkipLocProjectJsonGeneration, 'true') }}: |
|||
- task: Powershell@2 |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/generate-locproject.ps1 |
|||
arguments: $(_GenerateLocProjectArguments) |
|||
displayName: Generate LocProject.json |
|||
condition: ${{ parameters.condition }} |
|||
|
|||
- task: OneLocBuild@2 |
|||
displayName: OneLocBuild |
|||
env: |
|||
SYSTEM_ACCESSTOKEN: $(System.AccessToken) |
|||
inputs: |
|||
locProj: eng/Localize/LocProject.json |
|||
outDir: $(Build.ArtifactStagingDirectory) |
|||
lclSource: ${{ parameters.LclSource }} |
|||
lclPackageId: ${{ parameters.LclPackageId }} |
|||
isCreatePrSelected: ${{ parameters.CreatePr }} |
|||
isAutoCompletePrSelected: ${{ parameters.AutoCompletePr }} |
|||
${{ if eq(parameters.CreatePr, true) }}: |
|||
isUseLfLineEndingsSelected: ${{ parameters.UseLfLineEndings }} |
|||
${{ if eq(parameters.RepoType, 'gitHub') }}: |
|||
isShouldReusePrSelected: ${{ parameters.ReusePr }} |
|||
packageSourceAuth: patAuth |
|||
patVariable: ${{ parameters.CeapexPat }} |
|||
${{ if eq(parameters.RepoType, 'gitHub') }}: |
|||
repoType: ${{ parameters.RepoType }} |
|||
gitHubPatVariable: "${{ parameters.GithubPat }}" |
|||
${{ if ne(parameters.MirrorRepo, '') }}: |
|||
isMirrorRepoSelected: true |
|||
gitHubOrganization: ${{ parameters.GitHubOrg }} |
|||
mirrorRepo: ${{ parameters.MirrorRepo }} |
|||
mirrorBranch: ${{ parameters.MirrorBranch }} |
|||
condition: ${{ parameters.condition }} |
|||
|
|||
- task: PublishBuildArtifacts@1 |
|||
displayName: Publish Localization Files |
|||
inputs: |
|||
PathtoPublish: '$(Build.ArtifactStagingDirectory)/loc' |
|||
PublishLocation: Container |
|||
ArtifactName: Loc |
|||
condition: ${{ parameters.condition }} |
|||
- template: /eng/common/core-templates/job/onelocbuild.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
- task: PublishBuildArtifacts@1 |
|||
displayName: Publish LocProject.json |
|||
inputs: |
|||
PathtoPublish: '$(Build.SourcesDirectory)/eng/Localize/' |
|||
PublishLocation: Container |
|||
ArtifactName: Loc |
|||
condition: ${{ parameters.condition }} |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
@ -1,151 +1,7 @@ |
|||
parameters: |
|||
configuration: 'Debug' |
|||
|
|||
# Optional: condition for the job to run |
|||
condition: '' |
|||
|
|||
# Optional: 'true' if future jobs should run even if this job fails |
|||
continueOnError: false |
|||
|
|||
# Optional: dependencies of the job |
|||
dependsOn: '' |
|||
|
|||
# Optional: Include PublishBuildArtifacts task |
|||
enablePublishBuildArtifacts: false |
|||
|
|||
# Optional: A defined YAML pool - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#pool |
|||
pool: {} |
|||
|
|||
# Optional: should run as a public build even in the internal project |
|||
# if 'true', the build won't run any of the internal only steps, even if it is running in non-public projects. |
|||
runAsPublic: false |
|||
|
|||
# Optional: whether the build's artifacts will be published using release pipelines or direct feed publishing |
|||
publishUsingPipelines: false |
|||
|
|||
# Optional: whether the build's artifacts will be published using release pipelines or direct feed publishing |
|||
publishAssetsImmediately: false |
|||
|
|||
artifactsPublishingAdditionalParameters: '' |
|||
|
|||
signingValidationAdditionalParameters: '' |
|||
|
|||
jobs: |
|||
- job: Asset_Registry_Publish |
|||
|
|||
dependsOn: ${{ parameters.dependsOn }} |
|||
timeoutInMinutes: 150 |
|||
|
|||
${{ if eq(parameters.publishAssetsImmediately, 'true') }}: |
|||
displayName: Publish Assets |
|||
${{ else }}: |
|||
displayName: Publish to Build Asset Registry |
|||
|
|||
variables: |
|||
- template: /eng/common/templates/variables/pool-providers.yml |
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- group: Publish-Build-Assets |
|||
- group: AzureDevOps-Artifact-Feeds-Pats |
|||
- name: runCodesignValidationInjection |
|||
value: false |
|||
- ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: |
|||
- template: /eng/common/templates/post-build/common-variables.yml |
|||
|
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: VSEngSS-MicroBuild2022-1ES |
|||
demands: Cmd |
|||
# If it's not devdiv, it's dnceng |
|||
${{ if ne(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2019.amd64 |
|||
|
|||
steps: |
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download artifact |
|||
inputs: |
|||
artifactName: AssetManifests |
|||
downloadPath: '$(Build.StagingDirectory)/Download' |
|||
checkDownloadedFiles: true |
|||
condition: ${{ parameters.condition }} |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
|
|||
- task: NuGetAuthenticate@0 |
|||
|
|||
- task: PowerShell@2 |
|||
displayName: Publish Build Assets |
|||
inputs: |
|||
filePath: eng\common\sdk-task.ps1 |
|||
arguments: -task PublishBuildAssets -restore -msbuildEngine dotnet |
|||
/p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests' |
|||
/p:BuildAssetRegistryToken=$(MaestroAccessToken) |
|||
/p:MaestroApiEndpoint=https://maestro-prod.westus2.cloudapp.azure.com |
|||
/p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }} |
|||
/p:OfficialBuildId=$(Build.BuildNumber) |
|||
condition: ${{ parameters.condition }} |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
|
|||
- task: powershell@2 |
|||
displayName: Create ReleaseConfigs Artifact |
|||
inputs: |
|||
targetType: inline |
|||
script: | |
|||
Add-Content -Path "$(Build.StagingDirectory)/ReleaseConfigs.txt" -Value $(BARBuildId) |
|||
Add-Content -Path "$(Build.StagingDirectory)/ReleaseConfigs.txt" -Value "$(DefaultChannels)" |
|||
Add-Content -Path "$(Build.StagingDirectory)/ReleaseConfigs.txt" -Value $(IsStableBuild) |
|||
|
|||
- task: PublishBuildArtifacts@1 |
|||
displayName: Publish ReleaseConfigs Artifact |
|||
inputs: |
|||
PathtoPublish: '$(Build.StagingDirectory)/ReleaseConfigs.txt' |
|||
PublishLocation: Container |
|||
ArtifactName: ReleaseConfigs |
|||
|
|||
- task: powershell@2 |
|||
displayName: Check if SymbolPublishingExclusionsFile.txt exists |
|||
inputs: |
|||
targetType: inline |
|||
script: | |
|||
$symbolExclusionfile = "$(Build.SourcesDirectory)/eng/SymbolPublishingExclusionsFile.txt" |
|||
if(Test-Path -Path $symbolExclusionfile) |
|||
{ |
|||
Write-Host "SymbolExclusionFile exists" |
|||
Write-Host "##vso[task.setvariable variable=SymbolExclusionFile]true" |
|||
} |
|||
else{ |
|||
Write-Host "Symbols Exclusion file does not exists" |
|||
Write-Host "##vso[task.setvariable variable=SymbolExclusionFile]false" |
|||
} |
|||
|
|||
- task: PublishBuildArtifacts@1 |
|||
displayName: Publish SymbolPublishingExclusionsFile Artifact |
|||
condition: eq(variables['SymbolExclusionFile'], 'true') |
|||
inputs: |
|||
PathtoPublish: '$(Build.SourcesDirectory)/eng/SymbolPublishingExclusionsFile.txt' |
|||
PublishLocation: Container |
|||
ArtifactName: ReleaseConfigs |
|||
|
|||
- ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: |
|||
- template: /eng/common/templates/post-build/setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
|
|||
- task: PowerShell@2 |
|||
displayName: Publish Using Darc |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/post-build/publish-using-darc.ps1 |
|||
arguments: -BuildId $(BARBuildId) |
|||
-PublishingInfraVersion 3 |
|||
-AzdoToken '$(publishing-dnceng-devdiv-code-r-build-re)' |
|||
-MaestroToken '$(MaestroApiAccessToken)' |
|||
-WaitPublishingFinish true |
|||
-ArtifactsPublishingAdditionalParameters '${{ parameters.artifactsPublishingAdditionalParameters }}' |
|||
-SymbolPublishingAdditionalParameters '${{ parameters.symbolPublishingAdditionalParameters }}' |
|||
- template: /eng/common/core-templates/job/publish-build-assets.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
- ${{ if eq(parameters.enablePublishBuildArtifacts, 'true') }}: |
|||
- template: /eng/common/templates/steps/publish-logs.yml |
|||
parameters: |
|||
JobLabel: 'Publish_Artifacts_Logs' |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
@ -1,66 +1,7 @@ |
|||
parameters: |
|||
# This template adds arcade-powered source-build to CI. The template produces a server job with a |
|||
# default ID 'Source_Build_Complete' to put in a dependency list if necessary. |
|||
|
|||
# Specifies the prefix for source-build jobs added to pipeline. Use this if disambiguation needed. |
|||
jobNamePrefix: 'Source_Build' |
|||
|
|||
# Defines the platform on which to run the job. By default, a linux-x64 machine, suitable for |
|||
# managed-only repositories. This is an object with these properties: |
|||
# |
|||
# name: '' |
|||
# The name of the job. This is included in the job ID. |
|||
# targetRID: '' |
|||
# The name of the target RID to use, instead of the one auto-detected by Arcade. |
|||
# nonPortable: false |
|||
# Enables non-portable mode. This means a more specific RID (e.g. fedora.32-x64 rather than |
|||
# linux-x64), and compiling against distro-provided packages rather than portable ones. |
|||
# skipPublishValidation: false |
|||
# Disables publishing validation. By default, a check is performed to ensure no packages are |
|||
# published by source-build. |
|||
# container: '' |
|||
# A container to use. Runs in docker. |
|||
# pool: {} |
|||
# A pool to use. Runs directly on an agent. |
|||
# buildScript: '' |
|||
# Specifies the build script to invoke to perform the build in the repo. The default |
|||
# './build.sh' should work for typical Arcade repositories, but this is customizable for |
|||
# difficult situations. |
|||
# jobProperties: {} |
|||
# A list of job properties to inject at the top level, for potential extensibility beyond |
|||
# container and pool. |
|||
platform: {} |
|||
|
|||
jobs: |
|||
- job: ${{ parameters.jobNamePrefix }}_${{ parameters.platform.name }} |
|||
displayName: Source-Build (${{ parameters.platform.name }}) |
|||
|
|||
${{ each property in parameters.platform.jobProperties }}: |
|||
${{ property.key }}: ${{ property.value }} |
|||
|
|||
${{ if ne(parameters.platform.container, '') }}: |
|||
container: ${{ parameters.platform.container }} |
|||
|
|||
${{ if eq(parameters.platform.pool, '') }}: |
|||
# The default VM host AzDO pool. This should be capable of running Docker containers: almost all |
|||
# source-build builds run in Docker, including the default managed platform. |
|||
# /eng/common/templates/variables/pool-providers.yml can't be used here (some customers declare variables already), so duplicate its logic |
|||
pool: |
|||
${{ if eq(variables['System.TeamProject'], 'public') }}: |
|||
name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore-Svc-Public' ), False, 'NetCore-Public')] |
|||
demands: ImageOverride -equals Build.Ubuntu.1804.Amd64.Open |
|||
|
|||
${{ if eq(variables['System.TeamProject'], 'internal') }}: |
|||
name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore1ESPool-Svc-Internal'), False, 'NetCore1ESPool-Internal')] |
|||
demands: ImageOverride -equals Build.Ubuntu.1804.Amd64 |
|||
|
|||
${{ if ne(parameters.platform.pool, '') }}: |
|||
pool: ${{ parameters.platform.pool }} |
|||
|
|||
workspace: |
|||
clean: all |
|||
- template: /eng/common/core-templates/job/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
steps: |
|||
- template: /eng/common/templates/steps/source-build.yml |
|||
parameters: |
|||
platform: ${{ parameters.platform }} |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
@ -1,67 +1,7 @@ |
|||
parameters: |
|||
runAsPublic: false |
|||
sourceIndexPackageVersion: 1.0.1-20230228.2 |
|||
sourceIndexPackageSource: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json |
|||
sourceIndexBuildCommand: powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "eng/common/build.ps1 -restore -build -binarylog -ci" |
|||
preSteps: [] |
|||
binlogPath: artifacts/log/Debug/Build.binlog |
|||
condition: '' |
|||
dependsOn: '' |
|||
pool: '' |
|||
|
|||
jobs: |
|||
- job: SourceIndexStage1 |
|||
dependsOn: ${{ parameters.dependsOn }} |
|||
condition: ${{ parameters.condition }} |
|||
variables: |
|||
- name: SourceIndexPackageVersion |
|||
value: ${{ parameters.sourceIndexPackageVersion }} |
|||
- name: SourceIndexPackageSource |
|||
value: ${{ parameters.sourceIndexPackageSource }} |
|||
- name: BinlogPath |
|||
value: ${{ parameters.binlogPath }} |
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- group: source-dot-net stage1 variables |
|||
- template: /eng/common/templates/variables/pool-providers.yml |
|||
|
|||
${{ if ne(parameters.pool, '') }}: |
|||
pool: ${{ parameters.pool }} |
|||
${{ if eq(parameters.pool, '') }}: |
|||
pool: |
|||
${{ if eq(variables['System.TeamProject'], 'public') }}: |
|||
name: $(DncEngPublicBuildPool) |
|||
demands: ImageOverride -equals windows.vs2019.amd64.open |
|||
${{ if eq(variables['System.TeamProject'], 'internal') }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2019.amd64 |
|||
|
|||
steps: |
|||
- ${{ each preStep in parameters.preSteps }}: |
|||
- ${{ preStep }} |
|||
|
|||
- task: UseDotNet@2 |
|||
displayName: Use .NET Core SDK 6 |
|||
inputs: |
|||
packageType: sdk |
|||
version: 6.0.x |
|||
installationPath: $(Agent.TempDirectory)/dotnet |
|||
workingDirectory: $(Agent.TempDirectory) |
|||
|
|||
- script: | |
|||
$(Agent.TempDirectory)/dotnet/dotnet tool install BinLogToSln --version $(SourceIndexPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools |
|||
$(Agent.TempDirectory)/dotnet/dotnet tool install UploadIndexStage1 --version $(SourceIndexPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools |
|||
displayName: Download Tools |
|||
# Set working directory to temp directory so 'dotnet' doesn't try to use global.json and use the repo's sdk. |
|||
workingDirectory: $(Agent.TempDirectory) |
|||
|
|||
- script: ${{ parameters.sourceIndexBuildCommand }} |
|||
displayName: Build Repository |
|||
|
|||
- script: $(Agent.TempDirectory)/.source-index/tools/BinLogToSln -i $(BinlogPath) -r $(Build.SourcesDirectory) -n $(Build.Repository.Name) -o .source-index/stage1output |
|||
displayName: Process Binlog into indexable sln |
|||
- template: /eng/common/core-templates/job/source-index-stage1.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- script: $(Agent.TempDirectory)/.source-index/tools/UploadIndexStage1 -i .source-index/stage1output -n $(Build.Repository.Name) |
|||
displayName: Upload stage1 artifacts to source index |
|||
env: |
|||
BLOB_CONTAINER_URL: $(source-dot-net-stage1-blob-container-url) |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
@ -1,31 +1,7 @@ |
|||
parameters: |
|||
# See schema documentation in /Documentation/AzureDevOps/TemplateSchema.md |
|||
continueOnError: false |
|||
# Required: A collection of jobs to run - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#job |
|||
jobs: [] |
|||
# Optional: if specified, restore and use this version of Guardian instead of the default. |
|||
overrideGuardianVersion: '' |
|||
|
|||
jobs: |
|||
- template: /eng/common/templates/jobs/jobs.yml |
|||
- template: /eng/common/core-templates/jobs/codeql-build.yml |
|||
parameters: |
|||
enableMicrobuild: false |
|||
enablePublishBuildArtifacts: false |
|||
enablePublishTestResults: false |
|||
enablePublishBuildAssets: false |
|||
enablePublishUsingPipelines: false |
|||
enableTelemetry: true |
|||
is1ESPipeline: false |
|||
|
|||
variables: |
|||
- group: Publish-Build-Assets |
|||
# The Guardian version specified in 'eng/common/sdl/packages.config'. This value must be kept in |
|||
# sync with the packages.config file. |
|||
- name: DefaultGuardianVersion |
|||
value: 0.109.0 |
|||
- name: GuardianPackagesConfigFile |
|||
value: $(Build.SourcesDirectory)\eng\common\sdl\packages.config |
|||
- name: GuardianVersion |
|||
value: ${{ coalesce(parameters.overrideGuardianVersion, '$(DefaultGuardianVersion)') }} |
|||
|
|||
jobs: ${{ parameters.jobs }} |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
@ -1,97 +1,7 @@ |
|||
parameters: |
|||
# See schema documentation in /Documentation/AzureDevOps/TemplateSchema.md |
|||
continueOnError: false |
|||
|
|||
# Optional: Include PublishBuildArtifacts task |
|||
enablePublishBuildArtifacts: false |
|||
|
|||
# Optional: Enable publishing using release pipelines |
|||
enablePublishUsingPipelines: false |
|||
|
|||
# Optional: Enable running the source-build jobs to build repo from source |
|||
enableSourceBuild: false |
|||
|
|||
# Optional: Parameters for source-build template. |
|||
# See /eng/common/templates/jobs/source-build.yml for options |
|||
sourceBuildParameters: [] |
|||
|
|||
graphFileGeneration: |
|||
# Optional: Enable generating the graph files at the end of the build |
|||
enabled: false |
|||
# Optional: Include toolset dependencies in the generated graph files |
|||
includeToolset: false |
|||
|
|||
# Required: A collection of jobs to run - https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=vsts&tabs=schema#job |
|||
jobs: [] |
|||
|
|||
# Optional: Override automatically derived dependsOn value for "publish build assets" job |
|||
publishBuildAssetsDependsOn: '' |
|||
|
|||
# Optional: Publish the assets as soon as the publish to BAR stage is complete, rather doing so in a separate stage. |
|||
publishAssetsImmediately: false |
|||
|
|||
# Optional: If using publishAssetsImmediately and additional parameters are needed, can be used to send along additional parameters (normally sent to post-build.yml) |
|||
artifactsPublishingAdditionalParameters: '' |
|||
signingValidationAdditionalParameters: '' |
|||
|
|||
# Optional: should run as a public build even in the internal project |
|||
# if 'true', the build won't run any of the internal only steps, even if it is running in non-public projects. |
|||
runAsPublic: false |
|||
|
|||
enableSourceIndex: false |
|||
sourceIndexParams: {} |
|||
|
|||
# Internal resources (telemetry, microbuild) can only be accessed from non-public projects, |
|||
# and some (Microbuild) should only be applied to non-PR cases for internal builds. |
|||
|
|||
jobs: |
|||
- ${{ each job in parameters.jobs }}: |
|||
- template: ../job/job.yml |
|||
parameters: |
|||
# pass along parameters |
|||
${{ each parameter in parameters }}: |
|||
${{ if ne(parameter.key, 'jobs') }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
# pass along job properties |
|||
${{ each property in job }}: |
|||
${{ if ne(property.key, 'job') }}: |
|||
${{ property.key }}: ${{ property.value }} |
|||
|
|||
name: ${{ job.job }} |
|||
|
|||
- ${{ if eq(parameters.enableSourceBuild, true) }}: |
|||
- template: /eng/common/templates/jobs/source-build.yml |
|||
parameters: |
|||
allCompletedJobId: Source_Build_Complete |
|||
${{ each parameter in parameters.sourceBuildParameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
- ${{ if eq(parameters.enableSourceIndex, 'true') }}: |
|||
- template: ../job/source-index-stage1.yml |
|||
parameters: |
|||
runAsPublic: ${{ parameters.runAsPublic }} |
|||
${{ each parameter in parameters.sourceIndexParams }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: |
|||
- ${{ if or(eq(parameters.enablePublishBuildAssets, true), eq(parameters.artifacts.publish.manifests, 'true'), ne(parameters.artifacts.publish.manifests, '')) }}: |
|||
- template: ../job/publish-build-assets.yml |
|||
parameters: |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
dependsOn: |
|||
- ${{ if ne(parameters.publishBuildAssetsDependsOn, '') }}: |
|||
- ${{ each job in parameters.publishBuildAssetsDependsOn }}: |
|||
- ${{ job.job }} |
|||
- ${{ if eq(parameters.publishBuildAssetsDependsOn, '') }}: |
|||
- ${{ each job in parameters.jobs }}: |
|||
- ${{ job.job }} |
|||
- ${{ if eq(parameters.enableSourceBuild, true) }}: |
|||
- Source_Build_Complete |
|||
- template: /eng/common/core-templates/jobs/jobs.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
runAsPublic: ${{ parameters.runAsPublic }} |
|||
publishUsingPipelines: ${{ parameters.enablePublishUsingPipelines }} |
|||
publishAssetsImmediately: ${{ parameters.publishAssetsImmediately }} |
|||
enablePublishBuildArtifacts: ${{ parameters.enablePublishBuildArtifacts }} |
|||
artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }} |
|||
signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }} |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
@ -1,46 +1,7 @@ |
|||
parameters: |
|||
# This template adds arcade-powered source-build to CI. A job is created for each platform, as |
|||
# well as an optional server job that completes when all platform jobs complete. |
|||
|
|||
# The name of the "join" job for all source-build platforms. If set to empty string, the job is |
|||
# not included. Existing repo pipelines can use this job depend on all source-build jobs |
|||
# completing without maintaining a separate list of every single job ID: just depend on this one |
|||
# server job. By default, not included. Recommended name if used: 'Source_Build_Complete'. |
|||
allCompletedJobId: '' |
|||
|
|||
# See /eng/common/templates/job/source-build.yml |
|||
jobNamePrefix: 'Source_Build' |
|||
|
|||
# This is the default platform provided by Arcade, intended for use by a managed-only repo. |
|||
defaultManagedPlatform: |
|||
name: 'Managed' |
|||
container: 'mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream8' |
|||
|
|||
# Defines the platforms on which to run build jobs. One job is created for each platform, and the |
|||
# object in this array is sent to the job template as 'platform'. If no platforms are specified, |
|||
# one job runs on 'defaultManagedPlatform'. |
|||
platforms: [] |
|||
|
|||
jobs: |
|||
- template: /eng/common/core-templates/jobs/source-build.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
- ${{ if ne(parameters.allCompletedJobId, '') }}: |
|||
- job: ${{ parameters.allCompletedJobId }} |
|||
displayName: Source-Build Complete |
|||
pool: server |
|||
dependsOn: |
|||
- ${{ each platform in parameters.platforms }}: |
|||
- ${{ parameters.jobNamePrefix }}_${{ platform.name }} |
|||
- ${{ if eq(length(parameters.platforms), 0) }}: |
|||
- ${{ parameters.jobNamePrefix }}_${{ parameters.defaultManagedPlatform.name }} |
|||
|
|||
- ${{ each platform in parameters.platforms }}: |
|||
- template: /eng/common/templates/job/source-build.yml |
|||
parameters: |
|||
jobNamePrefix: ${{ parameters.jobNamePrefix }} |
|||
platform: ${{ platform }} |
|||
|
|||
- ${{ if eq(length(parameters.platforms), 0) }}: |
|||
- template: /eng/common/templates/job/source-build.yml |
|||
parameters: |
|||
jobNamePrefix: ${{ parameters.jobNamePrefix }} |
|||
platform: ${{ parameters.defaultManagedPlatform }} |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -1,22 +1,8 @@ |
|||
variables: |
|||
- group: Publish-Build-Assets |
|||
- template: /eng/common/core-templates/post-build/common-variables.yml |
|||
parameters: |
|||
# Specifies whether to use 1ES |
|||
is1ESPipeline: false |
|||
|
|||
# Whether the build is internal or not |
|||
- name: IsInternalBuild |
|||
value: ${{ and(ne(variables['System.TeamProject'], 'public'), contains(variables['Build.SourceBranch'], 'internal')) }} |
|||
|
|||
# Default Maestro++ API Endpoint and API Version |
|||
- name: MaestroApiEndPoint |
|||
value: "https://maestro-prod.westus2.cloudapp.azure.com" |
|||
- name: MaestroApiAccessToken |
|||
value: $(MaestroAccessToken) |
|||
- name: MaestroApiVersion |
|||
value: "2020-02-20" |
|||
|
|||
- name: SourceLinkCLIVersion |
|||
value: 3.0.0 |
|||
- name: SymbolToolVersion |
|||
value: 1.0.1 |
|||
|
|||
- name: runCodesignValidationInjection |
|||
value: false |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -1,281 +1,8 @@ |
|||
parameters: |
|||
# Which publishing infra should be used. THIS SHOULD MATCH THE VERSION ON THE BUILD MANIFEST. |
|||
# Publishing V1 is no longer supported |
|||
# Publishing V2 is no longer supported |
|||
# Publishing V3 is the default |
|||
- name: publishingInfraVersion |
|||
displayName: Which version of publishing should be used to promote the build definition? |
|||
type: number |
|||
default: 3 |
|||
values: |
|||
- 3 |
|||
|
|||
- name: BARBuildId |
|||
displayName: BAR Build Id |
|||
type: number |
|||
default: 0 |
|||
|
|||
- name: PromoteToChannelIds |
|||
displayName: Channel to promote BARBuildId to |
|||
type: string |
|||
default: '' |
|||
|
|||
- name: enableSourceLinkValidation |
|||
displayName: Enable SourceLink validation |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: enableSigningValidation |
|||
displayName: Enable signing validation |
|||
type: boolean |
|||
default: true |
|||
|
|||
- name: enableSymbolValidation |
|||
displayName: Enable symbol validation |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: enableNugetValidation |
|||
displayName: Enable NuGet validation |
|||
type: boolean |
|||
default: true |
|||
|
|||
- name: publishInstallersAndChecksums |
|||
displayName: Publish installers and checksums |
|||
type: boolean |
|||
default: true |
|||
|
|||
- name: SDLValidationParameters |
|||
type: object |
|||
default: |
|||
enable: false |
|||
publishGdn: false |
|||
continueOnError: false |
|||
params: '' |
|||
artifactNames: '' |
|||
downloadArtifacts: true |
|||
|
|||
# These parameters let the user customize the call to sdk-task.ps1 for publishing |
|||
# symbols & general artifacts as well as for signing validation |
|||
- name: symbolPublishingAdditionalParameters |
|||
displayName: Symbol publishing additional parameters |
|||
type: string |
|||
default: '' |
|||
|
|||
- name: artifactsPublishingAdditionalParameters |
|||
displayName: Artifact publishing additional parameters |
|||
type: string |
|||
default: '' |
|||
|
|||
- name: signingValidationAdditionalParameters |
|||
displayName: Signing validation additional parameters |
|||
type: string |
|||
default: '' |
|||
|
|||
# Which stages should finish execution before post-build stages start |
|||
- name: validateDependsOn |
|||
type: object |
|||
default: |
|||
- build |
|||
|
|||
- name: publishDependsOn |
|||
type: object |
|||
default: |
|||
- Validate |
|||
|
|||
# Optional: Call asset publishing rather than running in a separate stage |
|||
- name: publishAssetsImmediately |
|||
type: boolean |
|||
default: false |
|||
|
|||
stages: |
|||
- ${{ if or(eq( parameters.enableNugetValidation, 'true'), eq(parameters.enableSigningValidation, 'true'), eq(parameters.enableSourceLinkValidation, 'true'), eq(parameters.SDLValidationParameters.enable, 'true')) }}: |
|||
- stage: Validate |
|||
dependsOn: ${{ parameters.validateDependsOn }} |
|||
displayName: Validate Build Assets |
|||
variables: |
|||
- template: common-variables.yml |
|||
- template: /eng/common/templates/variables/pool-providers.yml |
|||
jobs: |
|||
- job: |
|||
displayName: NuGet Validation |
|||
condition: and(succeededOrFailed(), eq( ${{ parameters.enableNugetValidation }}, 'true')) |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: VSEngSS-MicroBuild2022-1ES |
|||
demands: Cmd |
|||
# If it's not devdiv, it's dnceng |
|||
${{ else }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2019.amd64 |
|||
|
|||
steps: |
|||
- template: setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
|
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download Package Artifacts |
|||
inputs: |
|||
buildType: specific |
|||
buildVersionToDownload: specific |
|||
project: $(AzDOProjectName) |
|||
pipeline: $(AzDOPipelineId) |
|||
buildId: $(AzDOBuildId) |
|||
artifactName: PackageArtifacts |
|||
checkDownloadedFiles: true |
|||
|
|||
- task: PowerShell@2 |
|||
displayName: Validate |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/post-build/nuget-validation.ps1 |
|||
arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ |
|||
-ToolDestinationPath $(Agent.BuildDirectory)/Extract/ |
|||
|
|||
- job: |
|||
displayName: Signing Validation |
|||
condition: and( eq( ${{ parameters.enableSigningValidation }}, 'true'), ne( variables['PostBuildSign'], 'true')) |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: VSEngSS-MicroBuild2022-1ES |
|||
demands: Cmd |
|||
# If it's not devdiv, it's dnceng |
|||
${{ else }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2019.amd64 |
|||
steps: |
|||
- template: setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
|
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download Package Artifacts |
|||
inputs: |
|||
buildType: specific |
|||
buildVersionToDownload: specific |
|||
project: $(AzDOProjectName) |
|||
pipeline: $(AzDOPipelineId) |
|||
buildId: $(AzDOBuildId) |
|||
artifactName: PackageArtifacts |
|||
checkDownloadedFiles: true |
|||
itemPattern: | |
|||
** |
|||
!**/Microsoft.SourceBuild.Intermediate.*.nupkg |
|||
|
|||
# This is necessary whenever we want to publish/restore to an AzDO private feed |
|||
# Since sdk-task.ps1 tries to restore packages we need to do this authentication here |
|||
# otherwise it'll complain about accessing a private feed. |
|||
- task: NuGetAuthenticate@0 |
|||
displayName: 'Authenticate to AzDO Feeds' |
|||
|
|||
# Signing validation will optionally work with the buildmanifest file which is downloaded from |
|||
# Azure DevOps above. |
|||
- task: PowerShell@2 |
|||
displayName: Validate |
|||
inputs: |
|||
filePath: eng\common\sdk-task.ps1 |
|||
arguments: -task SigningValidation -restore -msbuildEngine vs |
|||
/p:PackageBasePath='$(Build.ArtifactStagingDirectory)/PackageArtifacts' |
|||
/p:SignCheckExclusionsFile='$(Build.SourcesDirectory)/eng/SignCheckExclusionsFile.txt' |
|||
${{ parameters.signingValidationAdditionalParameters }} |
|||
|
|||
- template: ../steps/publish-logs.yml |
|||
parameters: |
|||
StageLabel: 'Validation' |
|||
JobLabel: 'Signing' |
|||
|
|||
- job: |
|||
displayName: SourceLink Validation |
|||
condition: eq( ${{ parameters.enableSourceLinkValidation }}, 'true') |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: VSEngSS-MicroBuild2022-1ES |
|||
demands: Cmd |
|||
# If it's not devdiv, it's dnceng |
|||
${{ else }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2019.amd64 |
|||
steps: |
|||
- template: setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
|
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download Blob Artifacts |
|||
inputs: |
|||
buildType: specific |
|||
buildVersionToDownload: specific |
|||
project: $(AzDOProjectName) |
|||
pipeline: $(AzDOPipelineId) |
|||
buildId: $(AzDOBuildId) |
|||
artifactName: BlobArtifacts |
|||
checkDownloadedFiles: true |
|||
|
|||
- task: PowerShell@2 |
|||
displayName: Validate |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/post-build/sourcelink-validation.ps1 |
|||
arguments: -InputPath $(Build.ArtifactStagingDirectory)/BlobArtifacts/ |
|||
-ExtractPath $(Agent.BuildDirectory)/Extract/ |
|||
-GHRepoName $(Build.Repository.Name) |
|||
-GHCommit $(Build.SourceVersion) |
|||
-SourcelinkCliVersion $(SourceLinkCLIVersion) |
|||
continueOnError: true |
|||
|
|||
- template: /eng/common/templates/job/execute-sdl.yml |
|||
parameters: |
|||
enable: ${{ parameters.SDLValidationParameters.enable }} |
|||
publishGuardianDirectoryToPipeline: ${{ parameters.SDLValidationParameters.publishGdn }} |
|||
additionalParameters: ${{ parameters.SDLValidationParameters.params }} |
|||
continueOnError: ${{ parameters.SDLValidationParameters.continueOnError }} |
|||
artifactNames: ${{ parameters.SDLValidationParameters.artifactNames }} |
|||
downloadArtifacts: ${{ parameters.SDLValidationParameters.downloadArtifacts }} |
|||
|
|||
- ${{ if ne(parameters.publishAssetsImmediately, 'true') }}: |
|||
- stage: publish_using_darc |
|||
${{ if or(eq(parameters.enableNugetValidation, 'true'), eq(parameters.enableSigningValidation, 'true'), eq(parameters.enableSourceLinkValidation, 'true'), eq(parameters.SDLValidationParameters.enable, 'true')) }}: |
|||
dependsOn: ${{ parameters.publishDependsOn }} |
|||
${{ else }}: |
|||
dependsOn: ${{ parameters.validateDependsOn }} |
|||
displayName: Publish using Darc |
|||
variables: |
|||
- template: common-variables.yml |
|||
- template: /eng/common/templates/variables/pool-providers.yml |
|||
jobs: |
|||
- job: |
|||
displayName: Publish Using Darc |
|||
timeoutInMinutes: 120 |
|||
pool: |
|||
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) |
|||
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: |
|||
name: VSEngSS-MicroBuild2022-1ES |
|||
demands: Cmd |
|||
# If it's not devdiv, it's dnceng |
|||
${{ else }}: |
|||
name: $(DncEngInternalBuildPool) |
|||
demands: ImageOverride -equals windows.vs2019.amd64 |
|||
steps: |
|||
- template: setup-maestro-vars.yml |
|||
parameters: |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }} |
|||
|
|||
- task: NuGetAuthenticate@0 |
|||
- template: /eng/common/core-templates/post-build/post-build.yml |
|||
parameters: |
|||
# Specifies whether to use 1ES |
|||
is1ESPipeline: false |
|||
|
|||
- task: PowerShell@2 |
|||
displayName: Publish Using Darc |
|||
inputs: |
|||
filePath: $(Build.SourcesDirectory)/eng/common/post-build/publish-using-darc.ps1 |
|||
arguments: -BuildId $(BARBuildId) |
|||
-PublishingInfraVersion ${{ parameters.publishingInfraVersion }} |
|||
-AzdoToken '$(publishing-dnceng-devdiv-code-r-build-re)' |
|||
-MaestroToken '$(MaestroApiAccessToken)' |
|||
-WaitPublishingFinish true |
|||
-ArtifactsPublishingAdditionalParameters '${{ parameters.artifactsPublishingAdditionalParameters }}' |
|||
-SymbolPublishingAdditionalParameters '${{ parameters.symbolPublishingAdditionalParameters }}' |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -1,70 +1,8 @@ |
|||
parameters: |
|||
BARBuildId: '' |
|||
PromoteToChannelIds: '' |
|||
|
|||
steps: |
|||
- ${{ if eq(coalesce(parameters.PromoteToChannelIds, 0), 0) }}: |
|||
- task: DownloadBuildArtifacts@0 |
|||
displayName: Download Release Configs |
|||
inputs: |
|||
buildType: current |
|||
artifactName: ReleaseConfigs |
|||
checkDownloadedFiles: true |
|||
|
|||
- task: PowerShell@2 |
|||
name: setReleaseVars |
|||
displayName: Set Release Configs Vars |
|||
inputs: |
|||
targetType: inline |
|||
pwsh: true |
|||
script: | |
|||
try { |
|||
if (!$Env:PromoteToMaestroChannels -or $Env:PromoteToMaestroChannels.Trim() -eq '') { |
|||
$Content = Get-Content $(Build.StagingDirectory)/ReleaseConfigs/ReleaseConfigs.txt |
|||
|
|||
$BarId = $Content | Select -Index 0 |
|||
$Channels = $Content | Select -Index 1 |
|||
$IsStableBuild = $Content | Select -Index 2 |
|||
|
|||
$AzureDevOpsProject = $Env:System_TeamProject |
|||
$AzureDevOpsBuildDefinitionId = $Env:System_DefinitionId |
|||
$AzureDevOpsBuildId = $Env:Build_BuildId |
|||
} |
|||
else { |
|||
$buildApiEndpoint = "${Env:MaestroApiEndPoint}/api/builds/${Env:BARBuildId}?api-version=${Env:MaestroApiVersion}" |
|||
|
|||
$apiHeaders = New-Object 'System.Collections.Generic.Dictionary[[String],[String]]' |
|||
$apiHeaders.Add('Accept', 'application/json') |
|||
$apiHeaders.Add('Authorization',"Bearer ${Env:MAESTRO_API_TOKEN}") |
|||
|
|||
$buildInfo = try { Invoke-WebRequest -Method Get -Uri $buildApiEndpoint -Headers $apiHeaders | ConvertFrom-Json } catch { Write-Host "Error: $_" } |
|||
|
|||
$BarId = $Env:BARBuildId |
|||
$Channels = $Env:PromoteToMaestroChannels -split "," |
|||
$Channels = $Channels -join "][" |
|||
$Channels = "[$Channels]" |
|||
|
|||
$IsStableBuild = $buildInfo.stable |
|||
$AzureDevOpsProject = $buildInfo.azureDevOpsProject |
|||
$AzureDevOpsBuildDefinitionId = $buildInfo.azureDevOpsBuildDefinitionId |
|||
$AzureDevOpsBuildId = $buildInfo.azureDevOpsBuildId |
|||
} |
|||
|
|||
Write-Host "##vso[task.setvariable variable=BARBuildId]$BarId" |
|||
Write-Host "##vso[task.setvariable variable=TargetChannels]$Channels" |
|||
Write-Host "##vso[task.setvariable variable=IsStableBuild]$IsStableBuild" |
|||
- template: /eng/common/core-templates/post-build/setup-maestro-vars.yml |
|||
parameters: |
|||
# Specifies whether to use 1ES |
|||
is1ESPipeline: false |
|||
|
|||
Write-Host "##vso[task.setvariable variable=AzDOProjectName]$AzureDevOpsProject" |
|||
Write-Host "##vso[task.setvariable variable=AzDOPipelineId]$AzureDevOpsBuildDefinitionId" |
|||
Write-Host "##vso[task.setvariable variable=AzDOBuildId]$AzureDevOpsBuildId" |
|||
} |
|||
catch { |
|||
Write-Host $_ |
|||
Write-Host $_.Exception |
|||
Write-Host $_.ScriptStackTrace |
|||
exit 1 |
|||
} |
|||
env: |
|||
MAESTRO_API_TOKEN: $(MaestroApiAccessToken) |
|||
BARBuildId: ${{ parameters.BARBuildId }} |
|||
PromoteToMaestroChannels: ${{ parameters.PromoteToChannelIds }} |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -1,13 +1,7 @@ |
|||
parameters: |
|||
disableComponentGovernance: false |
|||
componentGovernanceIgnoreDirectories: '' |
|||
|
|||
steps: |
|||
- ${{ if eq(parameters.disableComponentGovernance, 'true') }}: |
|||
- script: "echo ##vso[task.setvariable variable=skipComponentGovernanceDetection]true" |
|||
displayName: Set skipComponentGovernanceDetection variable |
|||
- ${{ if ne(parameters.disableComponentGovernance, 'true') }}: |
|||
- task: ComponentGovernanceComponentDetection@0 |
|||
continueOnError: true |
|||
inputs: |
|||
ignoreDirectories: ${{ parameters.componentGovernanceIgnoreDirectories }} |
|||
- template: /eng/common/core-templates/steps/component-governance.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
@ -0,0 +1,10 @@ |
|||
# Obtains internal runtime download credentials and populates the 'dotnetbuilds-internal-container-read-token-base64' |
|||
# variable with the base64-encoded SAS token, by default |
|||
|
|||
steps: |
|||
- template: /eng/common/core-templates/steps/enable-internal-runtimes.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/enable-internal-sources.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -1,48 +1,7 @@ |
|||
# BuildDropPath - The root folder of the drop directory for which the manifest file will be generated. |
|||
# PackageName - The name of the package this SBOM represents. |
|||
# PackageVersion - The version of the package this SBOM represents. |
|||
# ManifestDirPath - The path of the directory where the generated manifest files will be placed |
|||
# IgnoreDirectories - Directories to ignore for SBOM generation. This will be passed through to the CG component detector. |
|||
|
|||
parameters: |
|||
PackageVersion: 7.0.0 |
|||
BuildDropPath: '$(Build.SourcesDirectory)/artifacts' |
|||
PackageName: '.NET' |
|||
ManifestDirPath: $(Build.ArtifactStagingDirectory)/sbom |
|||
IgnoreDirectories: '' |
|||
sbomContinueOnError: true |
|||
|
|||
steps: |
|||
- task: PowerShell@2 |
|||
displayName: Prep for SBOM generation in (Non-linux) |
|||
condition: or(eq(variables['Agent.Os'], 'Windows_NT'), eq(variables['Agent.Os'], 'Darwin')) |
|||
inputs: |
|||
filePath: ./eng/common/generate-sbom-prep.ps1 |
|||
arguments: ${{parameters.manifestDirPath}} |
|||
|
|||
# Chmodding is a workaround for https://github.com/dotnet/arcade/issues/8461 |
|||
- script: | |
|||
chmod +x ./eng/common/generate-sbom-prep.sh |
|||
./eng/common/generate-sbom-prep.sh ${{parameters.manifestDirPath}} |
|||
displayName: Prep for SBOM generation in (Linux) |
|||
condition: eq(variables['Agent.Os'], 'Linux') |
|||
continueOnError: ${{ parameters.sbomContinueOnError }} |
|||
|
|||
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0 |
|||
displayName: 'Generate SBOM manifest' |
|||
continueOnError: ${{ parameters.sbomContinueOnError }} |
|||
inputs: |
|||
PackageName: ${{ parameters.packageName }} |
|||
BuildDropPath: ${{ parameters.buildDropPath }} |
|||
PackageVersion: ${{ parameters.packageVersion }} |
|||
ManifestDirPath: ${{ parameters.manifestDirPath }} |
|||
${{ if ne(parameters.IgnoreDirectories, '') }}: |
|||
AdditionalComponentDetectorArgs: '--IgnoreDirectories ${{ parameters.IgnoreDirectories }}' |
|||
|
|||
- task: PublishPipelineArtifact@1 |
|||
displayName: Publish SBOM manifest |
|||
continueOnError: ${{parameters.sbomContinueOnError}} |
|||
inputs: |
|||
targetPath: '${{parameters.manifestDirPath}}' |
|||
artifactName: $(ARTIFACT_NAME) |
|||
- template: /eng/common/core-templates/steps/generate-sbom.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/get-delegation-sas.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,7 @@ |
|||
steps: |
|||
- template: /eng/common/core-templates/steps/get-federated-access-token.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
@ -0,0 +1,40 @@ |
|||
parameters: |
|||
- name: is1ESPipeline |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: displayName |
|||
type: string |
|||
default: 'Publish to Build Artifact' |
|||
|
|||
- name: condition |
|||
type: string |
|||
default: succeeded() |
|||
|
|||
- name: artifactName |
|||
type: string |
|||
|
|||
- name: pathToPublish |
|||
type: string |
|||
|
|||
- name: continueOnError |
|||
type: boolean |
|||
default: false |
|||
|
|||
- name: publishLocation |
|||
type: string |
|||
default: 'Container' |
|||
|
|||
steps: |
|||
- ${{ if eq(parameters.is1ESPipeline, true) }}: |
|||
- 'eng/common/templates cannot be referenced from a 1ES managed template': error |
|||
- task: PublishBuildArtifacts@1 |
|||
displayName: ${{ parameters.displayName }} |
|||
condition: ${{ parameters.condition }} |
|||
${{ if parameters.continueOnError }}: |
|||
continueOnError: ${{ parameters.continueOnError }} |
|||
inputs: |
|||
PublishLocation: ${{ parameters.publishLocation }} |
|||
PathtoPublish: ${{ parameters.pathToPublish }} |
|||
${{ if parameters.artifactName }}: |
|||
ArtifactName: ${{ parameters.artifactName }} |
|||
@ -1,23 +1,7 @@ |
|||
parameters: |
|||
StageLabel: '' |
|||
JobLabel: '' |
|||
|
|||
steps: |
|||
- task: Powershell@2 |
|||
displayName: Prepare Binlogs to Upload |
|||
inputs: |
|||
targetType: inline |
|||
script: | |
|||
New-Item -ItemType Directory $(Build.SourcesDirectory)/PostBuildLogs/${{parameters.StageLabel}}/${{parameters.JobLabel}}/ |
|||
Move-Item -Path $(Build.SourcesDirectory)/artifacts/log/Debug/* $(Build.SourcesDirectory)/PostBuildLogs/${{parameters.StageLabel}}/${{parameters.JobLabel}}/ |
|||
continueOnError: true |
|||
condition: always() |
|||
- template: /eng/common/core-templates/steps/publish-logs.yml |
|||
parameters: |
|||
is1ESPipeline: false |
|||
|
|||
- task: PublishBuildArtifacts@1 |
|||
displayName: Publish Logs |
|||
inputs: |
|||
PathtoPublish: '$(Build.SourcesDirectory)/PostBuildLogs' |
|||
PublishLocation: Container |
|||
ArtifactName: PostBuildLogs |
|||
continueOnError: true |
|||
condition: always() |
|||
${{ each parameter in parameters }}: |
|||
${{ parameter.key }}: ${{ parameter.value }} |
|||
|
|||
Some files were not shown because too many files changed in this diff
Loading…
Reference in new issue