From 2018c16df04af03a8f1805849820b65f41eb7e29 Mon Sep 17 00:00:00 2001 From: Tess Gauthier Date: Thu, 6 Jun 2024 13:02:35 -0400 Subject: [PATCH] Add vPack release (#23898) --- .pipelines/PowerShell-vPack-Official.yml | 220 +++++++++++++++++++++++ 1 file changed, 220 insertions(+) create mode 100644 .pipelines/PowerShell-vPack-Official.yml diff --git a/.pipelines/PowerShell-vPack-Official.yml b/.pipelines/PowerShell-vPack-Official.yml new file mode 100644 index 0000000000..afb5124e0e --- /dev/null +++ b/.pipelines/PowerShell-vPack-Official.yml @@ -0,0 +1,220 @@ +name: $(BuildDefinitionName)_$(date:yyMM).$(date:dd)$(rev:rrr) + +trigger: none + +parameters: # parameters are shown up in ADO UI in a build queue time +- name: 'createVPack' + displayName: 'Create and Submit VPack' + type: boolean + default: false +- name: 'debug' + displayName: 'Enable debug output' + type: boolean + default: false +- name: 'architecture' + type: string + displayName: 'Select the vpack architecture:' + values: + - x64 + - x86 + - arm64 + default: x64 +- name: 'VPackPublishOverride' + type: string + displayName: 'VPack Publish Override Version (can leave blank):' + default: '' +- name: 'ReleaseTagVar' + type: string + displayName: 'Release Tag Var:' + default: 'fromBranch' + +variables: + - name: CDP_DEFINITION_BUILD_COUNT + value: $[counter('', 0)] + - name: system.debug + value: ${{ parameters.debug }} + - name: BuildSolution + value: $(Build.SourcesDirectory)\dirs.proj + - name: BuildConfiguration + value: Release + - name: WindowsContainerImage + value: 'onebranch.azurecr.io/windows/ltsc2019/vse2022:latest' + - name: Codeql.Enabled + value: false # pipeline is not building artifacts; it repackages existing artifacts into a vpack + - name: DOTNET_CLI_TELEMETRY_OPTOUT + value: 1 + - name: POWERSHELL_TELEMETRY_OPTOUT + value: 1 + - name: nugetMultiFeedWarnLevel + value: none + - name: VPackPublishOverride + value: ${{ parameters.VPackPublishOverride }} + - name: ReleaseTagVar + value: ${{ parameters.ReleaseTagVar }} + - group: Azure Blob variable group + - group: certificate_logical_to_actual # used within signing task + +resources: + repositories: + - repository: templates + type: git + name: OneBranch.Pipelines/GovernedTemplates + ref: refs/heads/main + +extends: + template: v2/Microsoft.Official.yml@templates + parameters: + platform: + name: 'windows_undocked' # windows undocked + + cloudvault: + enabled: false + + globalSdl: + useCustomPolicy: true # for signing code + disableLegacyManifest: true + # disabled Armory as we dont have any ARM templates to scan. It fails on some sample ARM templates. + armory: + enabled: false + sbom: + enabled: true + compiled: + enabled: false + credscan: + enabled: true + scanFolder: $(Build.SourcesDirectory) + suppressionsFile: $(Build.SourcesDirectory)\.config\suppress.json + asyncSdl: + enabled: true + forStages: ['main'] + credscan: + enabled: true + scanFolder: $(Build.SourcesDirectory) + suppressionsFile: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json + binskim: + enabled: false + # APIScan requires a non-Ready-To-Run build + apiscan: + enabled: false + tsaOptionsFile: .config/tsaoptions.json + stages: + - stage: main + jobs: + - job: main + pool: + type: windows + + variables: + ob_outputDirectory: '$(BUILD.SOURCESDIRECTORY)\out' + ob_createvpack_enabled: ${{ parameters.createVPack }} + ob_createvpack_packagename: 'PowerShell.${{ parameters.architecture }}' + ob_createvpack_description: PowerShell ${{ parameters.architecture }} $(version) + ob_createvpack_owneralias: tplunk + ob_createvpack_versionAs: string + ob_createvpack_version: '$(version)' + ob_createvpack_propsFile: true + ob_createvpack_verbose: true + + steps: + - template: tools/releaseBuild/azureDevOps/templates/SetVersionVariables.yml@self + parameters: + ReleaseTagVar: $(ReleaseTagVar) + CreateJson: yes + UseJson: no + + - pwsh: | + if($env:RELEASETAGVAR -match '-') { + throw "Don't release a preview build without coordinating with Windows Engineering Build Tools Team" + } + displayName: Stop any preview release + + - pwsh: + Write-Host "##vso[build.updatebuildnumber]$env:BUILD_SOURCEBRANCHNAME-$env:BUILD_SOURCEVERSION-$((get-date).ToString("yyyyMMddhhss"))" + displayName: Set Build Name for Non-PR + condition: ne(variables['Build.Reason'], 'PullRequest') + + - task: UseDotNet@2 + displayName: 'Use .NET Core sdk' + inputs: + packageType: sdk + version: 3.1.x + installationPath: $(Agent.ToolsDirectory)/dotnet + + - pwsh: | + Import-module '$(BUILD.SOURCESDIRECTORY)/build.psm1' + Install-AzCopy + displayName: Install AzCopy + retryCountOnTaskFailure: 2 + + - pwsh: | + Import-module '$(BUILD.SOURCESDIRECTORY)/build.psm1' + $azcopy = Find-AzCopy + Write-Verbose -Verbose "Found AzCopy: $azcopy" + Write-Host "running: $azcopy cp https://$(StorageAccount).blob.core.windows.net/$(AzureVersion)/PowerShell-$(Version)-win-${{ parameters.architecture }}.zip $(System.ArtifactsDirectory)" + & $azcopy cp https://$(StorageAccount).blob.core.windows.net/$(AzureVersion)/PowerShell-$(Version)-win-${{ parameters.architecture }}.zip $(System.ArtifactsDirectory) + displayName: 'Download Azure Artifacts' + retryCountOnTaskFailure: 2 + env: + AZCOPY_AUTO_LOGIN_TYPE: MSI + + - pwsh: 'Get-ChildItem $(System.ArtifactsDirectory)\* -recurse | Select-Object -ExpandProperty Name' + displayName: 'Capture Artifact Listing' + + - pwsh: | + $message = @() + Get-ChildItem $(System.ArtifactsDirectory)\* -recurse -include *.zip, *.msi | ForEach-Object { + if($_.Name -notmatch 'PowerShell-\d+\.\d+\.\d+\-([a-z]*.\d+\-)?win\-(fxdependent|x64|arm64|x86|fxdependentWinDesktop)\.(msi|zip){1}') + { + $messageInstance = "$($_.Name) is not a valid package name" + $message += $messageInstance + Write-Warning $messageInstance + } + } + + if($message.count -gt 0){throw ($message | out-string)} + displayName: 'Validate Zip and MSI Package Names' + + - pwsh: | + Get-ChildItem $(System.ArtifactsDirectory)\* -recurse -include *.zip, *.msi | ForEach-Object { + if($_.Name -match 'PowerShell-\d+\.\d+\.\d+\-([a-z]*.\d+\-)?win\-(${{ parameters.architecture }})\.(zip){1}') + { + Expand-Archive -Path $_.FullName -DestinationPath $(ob_outputDirectory) + } + } + displayName: 'Extract Zip to ob_outputDirectory' + + - pwsh: | + Write-Verbose "VPack Version: $(ob_createvpack_version)" -Verbose + Get-ChildItem -Path $(ob_outputDirectory)\* -Recurse + Get-Content $(ob_outputdirectory)\preview.json | Write-Host + displayName: Debug Output Directory and Version + condition: succeededOrFailed() + + - pwsh: | + Write-Host "Using VPackPublishOverride variable" + $vpackVersion = '$(VPackPublishOverride)' + $vstsCommandString = "vso[task.setvariable variable=ob_createvpack_version]$vpackVersion" + Write-Host "sending " + $vstsCommandString + Write-Host "##$vstsCommandString" + condition: and(ne(variables.VPackPublishOverride, ''), ne(variables.VPackPublishOverride, 'None')) + displayName: 'Set ob_createvpack_version with VPackPublishOverride' + + - pwsh: | + Get-ChildItem -Path env: + displayName: Capture Environment + condition: succeededOrFailed() + + - pwsh: | + Write-Verbose "VPack Version: $(ob_createvpack_version)" -Verbose + Get-ChildItem -Path $(ob_outputDirectory)\* -Recurse + displayName: Debug Output Directory and Version + condition: succeededOrFailed() + + - task: onebranch.pipeline.signing@1 + displayName: 'Onebranch Signing' + inputs: + command: 'sign' + signing_environment: 'azure-ado' + cp_code: $(windows_build_tools_cert_id) + files_to_sign: '**/*.exe;**/*.dll;**/*.ps1;**/*.psm1' + search_root: $(ob_outputDirectory)