[release/v7.5] Update APIScan to use new symbols server (#25399)

Co-authored-by: Travis Plunk <travis.plunk@microsoft.com>

.pipelines/apiscan-gen-notice.yml

@@ -13,6 +13,9 @@ parameters:
     default: false
 
 variables:
+  # PAT permissions NOTE: Declare a SymbolServerPAT variable in this group with a 'microsoft' organizanization scoped PAT with 'Symbols' Read permission.
+  # A PAT in the wrong org will give a single Error 203. No PAT will give a single Error 401, and individual pdbs may be missing even if permissions are correct.
+  - group: symbols
   - name: ob_outputDirectory
     value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
   - name: CDP_DEFINITION_BUILD_COUNT
@@ -86,8 +89,8 @@ extends:
         softwareName: "PowerShell" # Default is repo name
         versionNumber: "7.5" # Default is build number
         isLargeApp: false # Default: false.
+        symbolsFolder: $(SymbolsServerUrl);$(ob_outputDirectory)
 #softwareFolder - relative path to a folder to be scanned. Default value is root of artifacts folder.
-#symbolsFolder - relative path to a folder that contains symbols. Default value is root of artifacts folder.
 
       tsaOptionsFile: .config\tsaoptions.json
 

.pipelines/templates/compliance/apiscan.yml

@@ -12,9 +12,6 @@ jobs:
         value: fromBranch
       # Defines the variables APIScanClient, APIScanTenant and APIScanSecret
       - group: PS-PS-APIScan
-      # PAT permissions NOTE: Declare a SymbolServerPAT variable in this group with a 'microsoft' organizanization scoped PAT with 'Symbols' Read permission.
-      # A PAT in the wrong org will give a single Error 203. No PAT will give a single Error 401, and individual pdbs may be missing even if permissions are correct.
-      - group: symbols
       - name: branchCounterKey
         value: $[format('{0:yyyyMMdd}-{1}', pipeline.startTime,variables['Build.SourceBranch'])]
       - name: branchCounter
@@ -125,10 +122,25 @@ jobs:
         }
 
         Copy-Item -Path "$OutputFolder\*" -Destination '$(ob_outputDirectory)' -Recurse -Verbose
-
       workingDirectory: '$(repoRoot)'
       displayName: 'Build PowerShell Source'
 
+    - pwsh: |
+        # Only key windows runtimes
+        Get-ChildItem -Path '$(ob_outputDirectory)\runtimes\*' -File -Recurse | Where-Object {$_.FullName -notmatch '.*\/runtimes\/win'} | Foreach-Object {
+          Write-Verbose -Verbose -Message "Deleting $($_.FullName)"
+          Remove-Item -Force -Verbose -Path $_.FullName
+        }
+
+        # Temporarily remove runtimes/win-x64  due to issues with that runtime
+        Get-ChildItem -Path '$(ob_outputDirectory)\runtimes\*' -File -Recurse | Where-Object {$_.FullName -match '.*\/runtimes\/win-x86\/'} | Foreach-Object {
+          Write-Verbose -Verbose -Message "Deleting $($_.FullName)"
+          Remove-Item -Force -Verbose -Path $_.FullName
+        }
+
+      workingDirectory: '$(repoRoot)'
+      displayName: 'Remove unused runtimes'
+
     - task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.
       displayName: 🔏 CodeQL 3000 Finalize
       condition: eq(variables['CODEQL_ENABLED'], 'true')

build.psm1

@@ -3676,6 +3676,14 @@ function New-NugetConfigFile {
     $content += $newLine + $nugetConfigFooterTemplate
 
     Set-Content -Path (Join-Path $Destination 'nuget.config') -Value $content -Force
+
+    # Set the nuget.config file to be skipped by git
+    push-location $Destination
+    try {
+        git update-index --skip-worktree (Join-Path $Destination 'nuget.config')
+    } finally {
+        pop-location
+    }
 }
 
 function Clear-PipelineNugetAuthentication {