Convert powershell/PowerShell-CI-macos to GitHub Actions (#24914)

.github/workflows/codeql-analysis.yml

@@ -1,69 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [master]
-
-defaults:
-  run:
-    shell: pwsh
-
-env:
-  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    permissions:
-      actions: read  # for github/codeql-action/init to get workflow details
-      contents: read  # for actions/checkout to fetch code
-      security-events: write  # for github/codeql-action/analyze to upload SARIF results
-    name: Analyze
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        # Override automatic language detection by changing the below list
-        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
-        language: ['csharp']
-        # Learn more...
-        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        fetch-depth: '0'
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    - run: |
-        Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
-      name: Capture Environment
-
-    - run: |
-        Import-Module .\tools\ci.psm1
-        Invoke-CIInstall -SkipUser
-      name: Bootstrap
-
-    - run: |
-        Import-Module .\tools\ci.psm1
-        Invoke-CIBuild
-      name: Build
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9

.github/workflows/linux-ci.yml

@@ -21,18 +21,12 @@ on:
       - master
       - release*
       - feature*
-    paths:
-      - ".github/actions/**"
-      - ".github/workflows/linux-ci.yml"
-      - "**.props"
-      - build.psm1
-      - src/**
-      - test/**
-      - tools/buildCommon/**
-      - tools/ci.psm1
-      - tools/WindowsCI.psm1
-      - "!test/common/markdown/**"
-      - "!test/perf/**"
+# Path filters for PRs need to go into the changes job
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ contains(github.ref, 'merge')}}
+
 env:
   DOTNET_CLI_TELEMETRY_OPTOUT: 1
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
@@ -44,9 +38,37 @@ env:
   nugetMultiFeedWarnLevel: none
   system_debug: 'false'
 jobs:
+  changes:
+    name: Change Detection
+    runs-on: ubuntu-latest
+    # Required permissions
+    permissions:
+      pull-requests: read
+    # Set job outputs to values from filter step
+    outputs:
+      source: ${{ steps.filter.outputs.source }}
+    steps:
+    # For pull requests it's not necessary to checkout the code
+    - uses: dorny/paths-filter@v3
+      id: filter
+      with:
+        filters: |
+          source:
+            - ".github/actions/**"
+            - ".github/workflows/linux-ci.yml"
+            - "**.props"
+            - build.psm1
+            - src/**
+            - test/**
+            - tools/buildCommon/**
+            - tools/ci.psm1
+            - "!test/common/markdown/**"
+            - "!test/perf/**"
   ci_build:
     name: Build PowerShell
     runs-on: ubuntu-20.04
+    needs: changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     steps:
       - name: checkout
         uses: actions/checkout@v4.1.0
@@ -56,7 +78,10 @@ jobs:
         uses: "./.github/actions/build/ci"
   linux_test_unelevated_ci:
     name: Linux Unelevated CI
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-20.04
     steps:
       - name: checkout
@@ -70,7 +95,10 @@ jobs:
           tagSet: CI
   linux_test_elevated_ci:
     name: Linux Elevated CI
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-20.04
     steps:
       - name: checkout
@@ -84,7 +112,10 @@ jobs:
           tagSet: CI
   linux_test_unelevated_others:
     name: Linux Unelevated Others
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-20.04
     steps:
       - name: checkout
@@ -98,7 +129,10 @@ jobs:
           tagSet: Others
   linux_test_elevated_others:
     name: Linux Elevated Others
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-20.04
     steps:
       - name: checkout
@@ -112,7 +146,10 @@ jobs:
           tagSet: Others
   verify_xunit:
     name: Verify xUnit test results
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-latest
     steps:
       - name: checkout
@@ -122,6 +159,74 @@ jobs:
       - name: Verify xUnit test results
         uses: "./.github/actions/test/verify_xunit"
 
+  analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+    name: Analyze
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Override automatic language detection by changing the below list
+        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
+        language: ['csharp']
+        # Learn more...
+        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        fetch-depth: '0'
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    - run: |
+        Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
+      name: Capture Environment
+      shell: pwsh
+
+    - run: |
+        Import-Module .\tools\ci.psm1
+        Invoke-CIInstall -SkipUser
+      name: Bootstrap
+      shell: pwsh
+
+    - run: |
+        Import-Module .\tools\ci.psm1
+        Invoke-CIBuild
+      name: Build
+      shell: pwsh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+
+  ready_to_merge:
+    name: Linux ready to merge
+    needs:
+      - verify_xunit
+      - linux_test_elevated_ci
+      - linux_test_elevated_others
+      - linux_test_unelevated_ci
+      - linux_test_unelevated_others
+      - analyze
+    if: always()
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    with:
+      needs_context: ${{ toJson(needs) }}
   # TODO: Enable this when we have a Linux packaging workflow
 
   # ERROR:  While executing gem ... (Gem::FilePermissionError)

.github/workflows/macos-ci.yml

@@ -0,0 +1,188 @@
+name: macOS-CI
+
+run-name: "${{ github.ref_name }} - ${{ github.run_number }}"
+
+on:
+  push:
+    branches:
+      - master
+      - release*
+      - feature*
+    paths:
+      - "**"
+      - "!.github/ISSUE_TEMPLATE/**"
+      - "!.dependabot/config.yml"
+      - "!.pipelines/**"
+      - "!test/perf/**"
+  pull_request:
+    branches:
+      - master
+      - release*
+      - feature*
+# Path filters for PRs need to go into the changes job
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ contains(github.ref, 'merge')}}
+
+env:
+  DOTNET_CLI_TELEMETRY_OPTOUT: 1
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
+  FORCE_FEATURE: 'False'
+  FORCE_PACKAGE: 'False'
+  HOMEBREW_NO_ANALYTICS: 1
+  NUGET_KEY: none
+  POWERSHELL_TELEMETRY_OPTOUT: 1
+  __SuppressAnsiEscapeSequences: 1
+  nugetMultiFeedWarnLevel: none
+  system_debug: 'false'
+jobs:
+  changes:
+    name: Change Detection
+    runs-on: ubuntu-latest
+    # Required permissions
+    permissions:
+      pull-requests: read
+    # Set job outputs to values from filter step
+    outputs:
+      source: ${{ steps.filter.outputs.source }}
+    steps:
+    # For pull requests it's not necessary to checkout the code
+    - uses: dorny/paths-filter@v3
+      id: filter
+      with:
+        filters: |
+          source:
+            - ".github/actions/**"
+            - ".github/workflows/macos-ci.yml"
+            - "**.props"
+            - build.psm1
+            - src/**
+            - test/**
+            - tools/buildCommon/**
+            - tools/ci.psm1
+            - "!test/common/markdown/**"
+            - "!test/perf/**"
+  ci_build:
+    name: Build PowerShell
+    runs-on: macos-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4.1.0
+        with:
+          fetch-depth: 1000
+      - name: Build
+        uses: "./.github/actions/build/ci"
+  macos_test_unelevated_ci:
+    name: macos Unelevated CI
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+    runs-on: macos-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4.1.0
+        with:
+          fetch-depth: 1000
+      - name: macOS Unelevated CI
+        uses: "./.github/actions/test/nix"
+        with:
+          purpose: UnelevatedPesterTests
+          tagSet: CI
+  macos_test_elevated_ci:
+    name: macOS Elevated CI
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+    runs-on: macos-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4.1.0
+        with:
+          fetch-depth: 1000
+      - name: macOS Elevated CI
+        uses: "./.github/actions/test/nix"
+        with:
+          purpose: ElevatedPesterTests
+          tagSet: CI
+  macos_test_unelevated_others:
+    name: macOS Unelevated Others
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+    runs-on: macos-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4.1.0
+        with:
+          fetch-depth: 1000
+      - name: macOS Unelevated Others
+        uses: "./.github/actions/test/nix"
+        with:
+          purpose: UnelevatedPesterTests
+          tagSet: Others
+  macos_test_elevated_others:
+    name: macOS Elevated Others
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+    runs-on: macos-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4.1.0
+        with:
+          fetch-depth: 1000
+      - name: macOS Elevated Others
+        uses: "./.github/actions/test/nix"
+        with:
+          purpose: ElevatedPesterTests
+          tagSet: Others
+  verify_xunit:
+    name: Verify xUnit test results
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4.1.0
+        with:
+          fetch-depth: 1000
+      - name: Verify xUnit test results
+        uses: "./.github/actions/test/verify_xunit"
+  PackageMac-macos_packaging:
+    name: macOS packaging (bootstrap only)
+    needs:
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+    runs-on:
+      - macos-latest
+    steps:
+    - name: checkout
+      uses: actions/checkout@v4.1.0
+    - name: Bootstrap packaging
+      if: success() || failure()
+      run: |-
+        import-module ./build.psm1
+        start-psbootstrap -package
+      shell: pwsh
+  ready_to_merge:
+    name: macos ready to merge
+    needs:
+      - verify_xunit
+      - PackageMac-macos_packaging
+      - macos_test_elevated_ci
+      - macos_test_elevated_others
+      - macos_test_unelevated_ci
+      - macos_test_unelevated_others
+    if: always()
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    with:
+      needs_context: ${{ toJson(needs) }}

.github/workflows/windows-ci.yml

@@ -18,18 +18,12 @@ on:
       - master
       - release*
       - feature*
-    paths:
-      - ".github/actions/**"
-      - ".github/workflows/windows-ci.yml"
-      - "**.props"
-      - build.psm1
-      - src/**
-      - test/**
-      - tools/buildCommon/**
-      - tools/ci.psm1
-      - tools/WindowsCI.psm1
-      - "!test/common/markdown/**"
-      - "!test/perf/**"
+# Path filters for PRs need to go into the changes job
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ contains(github.ref, 'merge')}}
+
 permissions:
   contents: read
 
@@ -44,8 +38,37 @@ env:
   __SuppressAnsiEscapeSequences: 1
   nugetMultiFeedWarnLevel: none
 jobs:
+  changes:
+    name: Change Detection
+    runs-on: ubuntu-latest
+    # Required permissions
+    permissions:
+      pull-requests: read
+    # Set job outputs to values from filter step
+    outputs:
+      source: ${{ steps.filter.outputs.source }}
+    steps:
+    # For pull requests it's not necessary to checkout the code
+    - uses: dorny/paths-filter@v3
+      id: filter
+      with:
+        filters: |
+          source:
+            - ".github/actions/**"
+            - ".github/workflows/windows-ci.yml"
+            - "**.props"
+            - build.psm1
+            - src/**
+            - test/**
+            - tools/buildCommon/**
+            - tools/ci.psm1
+            - tools/WindowsCI.psm1
+            - "!test/common/markdown/**"
+            - "!test/perf/**"
   ci_build:
     name: Build PowerShell
+    needs: changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: windows-latest
     steps:
       - name: checkout
@@ -54,9 +77,12 @@ jobs:
           fetch-depth: 1000
       - name: Build
         uses: "./.github/actions/build/ci"
-  windows_test:
+  windows_test_unelevated_ci:
     name: Windows Unelevated CI
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: windows-latest
     steps:
       - name: checkout
@@ -68,9 +94,12 @@ jobs:
         with:
           purpose: UnelevatedPesterTests
           tagSet: CI
-  windows_test_2:
+  windows_test_elevated_ci:
     name: Windows Elevated CI
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: windows-latest
     steps:
       - name: checkout
@@ -82,9 +111,12 @@ jobs:
         with:
           purpose: ElevatedPesterTests
           tagSet: CI
-  windows_test_3:
+  windows_test_unelevated_others:
     name: Windows Unelevated Others
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: windows-latest
     steps:
       - name: checkout
@@ -96,9 +128,12 @@ jobs:
         with:
           purpose: UnelevatedPesterTests
           tagSet: Others
-  windows_test_4:
+  windows_test_elevated_others:
     name: Windows Elevated Others
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: windows-latest
     steps:
       - name: checkout
@@ -112,7 +147,10 @@ jobs:
           tagSet: Others
   verify_xunit:
     name: Verify xUnit test results
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: windows-latest
     steps:
       - name: checkout
@@ -121,3 +159,15 @@ jobs:
           fetch-depth: 1000
       - name: Verify xUnit test results
         uses: "./.github/actions/test/verify_xunit"
+  ready_to_merge:
+    name: windows ready to merge
+    needs:
+      - verify_xunit
+      - windows_test_elevated_ci
+      - windows_test_elevated_others
+      - windows_test_unelevated_ci
+      - windows_test_unelevated_others
+    if: always()
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    with:
+      needs_context: ${{ toJson(needs) }}

.vsts-ci/linux.yml

@@ -79,93 +79,6 @@ stages:
       jobName: linux_build
       displayName: linux Build
 
-- stage: TestUbuntu
-  displayName: Test for Ubuntu
-  dependsOn: [BuildLinuxStage]
-  jobs:
-  - template: templates/nix-test.yml
-    parameters:
-      name: Ubuntu
-      pool: ubuntu-20.04
-      purpose: UnelevatedPesterTests
-      tagSet: CI
-
-  - template: templates/nix-test.yml
-    parameters:
-      name: Ubuntu
-      pool: ubuntu-20.04
-      purpose: ElevatedPesterTests
-      tagSet: CI
-
-  - template: templates/nix-test.yml
-    parameters:
-      name: Ubuntu
-      pool: ubuntu-20.04
-      purpose: UnelevatedPesterTests
-      tagSet: Others
-
-  - template: templates/nix-test.yml
-    parameters:
-      name: Ubuntu
-      pool: ubuntu-20.04
-      purpose: ElevatedPesterTests
-      tagSet: Others
-
-  - template: templates/verify-xunit.yml
-    parameters:
-      pool: ubuntu-20.04
-
-- stage: TestContainer
-  displayName: Test in a container
-  dependsOn: [BuildLinuxStage]
-  jobs:
-  - job: getContainerJob
-    displayName: Choose a container
-    pool:
-      vmImage: ubuntu-20.04
-    steps:
-    - checkout: self
-      clean: true
-
-    - checkout: Docker
-      clean: true
-
-    - pwsh: |
-        # Initialize container test stage
-        Import-Module ./PowerShell/tools/ci.psm1
-        Invoke-InitializeContainerStage -ContainerPattern '${{ parameters.ContainerPattern }}'
-      name: getContainerTask
-      displayName: Initialize Container Stage
-      continueOnError: true
-
-  - template: templates/test/nix-container-test.yml
-    parameters:
-      name: container
-      pool: ubuntu-20.04
-      purpose: UnelevatedPesterTests
-      tagSet: CI
-
-  - template: templates/test/nix-container-test.yml
-    parameters:
-      name: container
-      pool: ubuntu-20.04
-      purpose: ElevatedPesterTests
-      tagSet: CI
-
-  - template: templates/test/nix-container-test.yml
-    parameters:
-      name: container
-      pool: ubuntu-20.04
-      purpose: UnelevatedPesterTests
-      tagSet: Others
-
-  - template: templates/test/nix-container-test.yml
-    parameters:
-      name: container
-      pool: ubuntu-20.04
-      purpose: ElevatedPesterTests
-      tagSet: Others
-
 - stage: PackageLinux
   displayName: Package Linux
   dependsOn: ["BuildLinuxStage"]