mirror of
https://github.com/PowerShell/PowerShell
synced 2026-06-08 12:12:50 +00:00
Aditya Patwardhan
@@ -0,0 +1,79 @@
|
||||
# Copyright (c) Microsoft Corporation.
|
||||
# Licensed under the MIT License.
|
||||
|
||||
trigger: none
|
||||
|
||||
variables:
|
||||
- name: ob_outputDirectory
|
||||
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
|
||||
- name: CDP_DEFINITION_BUILD_COUNT
|
||||
value: $[counter('', 0)]
|
||||
# Defines the variables AzureFileCopySubscription, StorageAccount, StorageAccountKey, StorageResourceGroup, StorageSubscriptionName
|
||||
- group: 'Azure Blob variable group'
|
||||
# Defines the variables CgPat, CgOrganization, and CgProject
|
||||
- group: 'ComponentGovernance'
|
||||
- group: 'PoolNames'
|
||||
- name: LinuxContainerImage
|
||||
value: onebranch.azurecr.io/linux/ubuntu-2004:latest
|
||||
- name: WindowsContainerImage
|
||||
value: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
|
||||
|
||||
resources:
|
||||
repositories:
|
||||
- repository: templates
|
||||
type: git
|
||||
name: OneBranch.Pipelines/GovernedTemplates
|
||||
ref: refs/heads/main
|
||||
|
||||
extends:
|
||||
template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates
|
||||
parameters:
|
||||
featureFlags:
|
||||
WindowsHostVersion:
|
||||
Version: 2022
|
||||
globalSdl:
|
||||
compiled:
|
||||
enabled: true
|
||||
armory:
|
||||
enabled: false
|
||||
sbom:
|
||||
enabled: false
|
||||
cg:
|
||||
enabled: true
|
||||
ignoreDirectories: '.devcontainer,demos,docker,docs,src,test,tools/packaging'
|
||||
tsa:
|
||||
enabled: true # onebranch publish all SDL results to TSA. If TSA is disabled all SDL tools will forced into 'break' build mode.
|
||||
credscan:
|
||||
enabled: true
|
||||
scanFolder: $(Build.SourcesDirectory)
|
||||
suppressionsFile: $(Build.SourcesDirectory)\.config\suppress.json
|
||||
binskim:
|
||||
break: true # always break the build on binskim issues in addition to TSA upload
|
||||
policheck:
|
||||
break: true # always break the build on policheck issues. You can disable it by setting to 'false'
|
||||
# APIScan requires a non-Ready-To-Run build
|
||||
apiscan:
|
||||
enabled: true
|
||||
softwareName: "PowerShell" # Default is repo name
|
||||
versionNumber: "7.5" # Default is build number
|
||||
isLargeApp: false # Default: false.
|
||||
#softwareFolder - relative path to a folder to be scanned. Default value is root of artifacts folder.
|
||||
#symbolsFolder - relative path to a folder that contains symbols. Default value is root of artifacts folder.
|
||||
|
||||
tsaOptionsFile: .config\tsaoptions.json
|
||||
|
||||
stages:
|
||||
- stage: APIScan
|
||||
displayName: 'ApiScan'
|
||||
dependsOn: []
|
||||
jobs:
|
||||
- template: /.pipelines/templates/compliance/apiscan.yml@self
|
||||
parameters:
|
||||
parentJobs: []
|
||||
- stage: notice
|
||||
displayName: Generate Notice File
|
||||
dependsOn: []
|
||||
jobs:
|
||||
- template: /.pipelines/templates/compliance/generateNotice.yml@self
|
||||
parameters:
|
||||
parentJobs: []
|
||||
@@ -0,0 +1,181 @@
|
||||
# Copyright (c) Microsoft Corporation.
|
||||
# Licensed under the MIT License.
|
||||
|
||||
jobs:
|
||||
- job: APIScan
|
||||
variables:
|
||||
- name: runCodesignValidationInjection
|
||||
value : false
|
||||
- name: NugetSecurityAnalysisWarningLevel
|
||||
value: none
|
||||
- name: ReleaseTagVar
|
||||
value: fromBranch
|
||||
# Defines the variables APIScanClient, APIScanTenant and APIScanSecret
|
||||
- group: PS-PS-APIScan
|
||||
# PAT permissions NOTE: Declare a SymbolServerPAT variable in this group with a 'microsoft' organizanization scoped PAT with 'Symbols' Read permission.
|
||||
# A PAT in the wrong org will give a single Error 203. No PAT will give a single Error 401, and individual pdbs may be missing even if permissions are correct.
|
||||
- group: symbols
|
||||
- name: branchCounterKey
|
||||
value: $[format('{0:yyyyMMdd}-{1}', pipeline.startTime,variables['Build.SourceBranch'])]
|
||||
- name: branchCounter
|
||||
value: $[counter(variables['branchCounterKey'], 1)]
|
||||
- group: DotNetPrivateBuildAccess
|
||||
- group: Azure Blob variable group
|
||||
- group: ReleasePipelineSecrets
|
||||
- group: mscodehub-feed-read-general
|
||||
- group: mscodehub-feed-read-akv
|
||||
- name: ob_outputDirectory
|
||||
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
|
||||
- name: repoRoot
|
||||
value: '$(Build.SourcesDirectory)\PowerShell'
|
||||
- name: ob_sdl_tsa_configFile
|
||||
value: $(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
|
||||
- name: ob_sdl_credscan_suppressionsFile
|
||||
value: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
|
||||
|
||||
pool:
|
||||
type: windows
|
||||
|
||||
# APIScan can take a long time
|
||||
timeoutInMinutes: 180
|
||||
|
||||
steps:
|
||||
- checkout: self
|
||||
clean: true
|
||||
fetchTags: true
|
||||
fetchDepth: 1000
|
||||
displayName: Checkout PowerShell
|
||||
retryCountOnTaskFailure: 1
|
||||
env:
|
||||
ob_restore_phase: true # This ensures checkout is done at the beginning of the restore phase
|
||||
|
||||
- template: ../SetVersionVariables.yml
|
||||
parameters:
|
||||
ReleaseTagVar: $(ReleaseTagVar)
|
||||
CreateJson: yes
|
||||
UseJson: no
|
||||
|
||||
- template: ../insert-nuget-config-azfeed.yml
|
||||
parameters:
|
||||
repoRoot: '$(repoRoot)'
|
||||
|
||||
- pwsh: |
|
||||
Import-Module .\build.psm1 -force
|
||||
Start-PSBootstrap
|
||||
workingDirectory: '$(repoRoot)'
|
||||
retryCountOnTaskFailure: 2
|
||||
displayName: 'Bootstrap'
|
||||
env:
|
||||
__DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
|
||||
|
||||
- pwsh: |
|
||||
Import-Module .\build.psm1 -force
|
||||
Find-DotNet
|
||||
dotnet tool install dotnet-symbol --tool-path $(Agent.ToolsDirectory)\tools\dotnet-symbol
|
||||
$symbolToolPath = Get-ChildItem -Path $(Agent.ToolsDirectory)\tools\dotnet-symbol\dotnet-symbol.exe | Select-Object -First 1 -ExpandProperty FullName
|
||||
Write-Host "##vso[task.setvariable variable=symbolToolPath]$symbolToolPath"
|
||||
displayName: Install dotnet-symbol
|
||||
workingDirectory: '$(repoRoot)'
|
||||
retryCountOnTaskFailure: 2
|
||||
|
||||
- pwsh: |
|
||||
$modules = 'Az.Accounts', 'Az.Storage'
|
||||
foreach($module in $modules) {
|
||||
if(!(get-module $module -listavailable)) {
|
||||
Write-Verbose "installing $module..." -verbose
|
||||
Install-Module $module -force -AllowClobber
|
||||
} else {
|
||||
Write-Verbose "$module already installed." -verbose
|
||||
}
|
||||
}
|
||||
displayName: Install PowerShell modules
|
||||
workingDirectory: '$(repoRoot)'
|
||||
|
||||
- task: AzurePowerShell@5
|
||||
displayName: Download winverify-private Artifacts
|
||||
inputs:
|
||||
azureSubscription: az-blob-cicd-infra
|
||||
scriptType: inlineScript
|
||||
azurePowerShellVersion: LatestVersion
|
||||
workingDirectory: '$(repoRoot)'
|
||||
pwsh: true
|
||||
inline: |
|
||||
# download smybols for getfilesiginforedist.dll
|
||||
$downloadsDirectory = '$(Build.ArtifactStagingDirectory)/downloads'
|
||||
$uploadedDirectory = '$(Build.ArtifactStagingDirectory)/uploaded'
|
||||
$storageAccountName = "pscoretestdata"
|
||||
$containerName = 'winverify-private'
|
||||
$winverifySymbolsPath = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)/winverify-symbols' -Force
|
||||
$dllName = 'getfilesiginforedist.dll'
|
||||
$winverifySymbolsDllPath = Join-Path $winverifySymbolsPath $dllName
|
||||
|
||||
$context = New-AzStorageContext -StorageAccountName $storageAccountName -UseConnectedAccount
|
||||
|
||||
Get-AzStorageBlobContent -Container $containerName -Blob $dllName -Destination $winverifySymbolsDllPath -Context $context
|
||||
|
||||
- pwsh: |
|
||||
Get-ChildItem -Path '$(System.ArtifactsDirectory)/winverify-symbols'
|
||||
displayName: Capture winverify-private Artifacts
|
||||
workingDirectory: '$(repoRoot)'
|
||||
condition: succeededOrFailed()
|
||||
|
||||
- pwsh: |
|
||||
Import-Module .\build.psm1 -force
|
||||
Find-DotNet
|
||||
Start-PSBuild -Configuration StaticAnalysis -PSModuleRestore -Clean -Runtime fxdependent-win-desktop
|
||||
|
||||
$OutputFolder = Split-Path (Get-PSOutput)
|
||||
|
||||
Write-Verbose -Verbose -Message "Deleting ref folder from output folder"
|
||||
if (Test-Path $OutputFolder/ref) {
|
||||
Remove-Item -Recurse -Force $OutputFolder/ref
|
||||
}
|
||||
|
||||
Copy-Item -Path "$OutputFolder\*" -Destination '$(ob_outputDirectory)' -Recurse -Verbose
|
||||
|
||||
workingDirectory: '$(repoRoot)'
|
||||
displayName: 'Build PowerShell Source'
|
||||
|
||||
- pwsh: |
|
||||
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
|
||||
workingDirectory: '$(repoRoot)'
|
||||
displayName: Capture Environment
|
||||
condition: succeededOrFailed()
|
||||
|
||||
# Explicitly download symbols for the drop since the SDL image doesn't have http://SymWeb access and APIScan cannot handle https yet.
|
||||
- pwsh: |
|
||||
Import-Module .\build.psm1 -force
|
||||
Find-DotNet
|
||||
$pat = '$(SymbolServerPAT)'
|
||||
if ($pat -like '*PAT*' -or $pat -eq '')
|
||||
{
|
||||
throw 'No PAT defined'
|
||||
}
|
||||
$url = 'https://microsoft.artifacts.visualstudio.com/defaultcollection/_apis/symbol/symsrv'
|
||||
$(symbolToolPath) --authenticated-server-path $(SymbolServerPAT) $url --symbols -d "$env:ob_outputDirectory\*" --recurse-subdirectories
|
||||
displayName: 'Download Symbols for binaries'
|
||||
retryCountOnTaskFailure: 2
|
||||
workingDirectory: '$(repoRoot)'
|
||||
|
||||
- pwsh: |
|
||||
Get-ChildItem '$(ob_outputDirectory)' -File -Recurse |
|
||||
Foreach-Object {
|
||||
[pscustomobject]@{
|
||||
Path = $_.FullName
|
||||
Version = $_.VersionInfo.FileVersion
|
||||
Md5Hash = (Get-FileHash -Algorithm MD5 -Path $_.FullName).Hash
|
||||
Sha512Hash = (Get-FileHash -Algorithm SHA512 -Path $_.FullName).Hash
|
||||
}
|
||||
} | Export-Csv -Path '$(Build.SourcesDirectory)/ReleaseFileHash.csv'
|
||||
workingDirectory: '$(repoRoot)'
|
||||
displayName: 'Create release file hash artifact'
|
||||
|
||||
- pwsh: |
|
||||
Copy-Item -Path '$(Build.SourcesDirectory)/ReleaseFileHash.csv' -Destination '$(ob_outputDirectory)' -Verbose
|
||||
displayName: 'Publish Build File Hash artifact'
|
||||
|
||||
- pwsh: |
|
||||
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
|
||||
displayName: Capture Environment
|
||||
condition: succeededOrFailed()
|
||||
workingDirectory: '$(repoRoot)'
|
||||
@@ -0,0 +1,154 @@
|
||||
# Copyright (c) Microsoft Corporation.
|
||||
# Licensed under the MIT License.
|
||||
|
||||
parameters:
|
||||
- name: parentJobs
|
||||
type: jobList
|
||||
|
||||
jobs:
|
||||
- job: generateNotice
|
||||
variables:
|
||||
- name: runCodesignValidationInjection
|
||||
value : false
|
||||
- name: NugetSecurityAnalysisWarningLevel
|
||||
value: none
|
||||
- name: ob_outputDirectory
|
||||
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT/notice'
|
||||
- name: ob_sdl_apiscan_enabled
|
||||
value: false
|
||||
- name: repoRoot
|
||||
value: '$(Build.SourcesDirectory)\PowerShell'
|
||||
- name: ob_sdl_tsa_configFile
|
||||
value: $(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
|
||||
- name: ob_sdl_credscan_suppressionsFile
|
||||
value: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
|
||||
|
||||
displayName: Generate Notice
|
||||
dependsOn:
|
||||
${{ parameters.parentJobs }}
|
||||
pool:
|
||||
type: windows
|
||||
|
||||
timeoutInMinutes: 15
|
||||
|
||||
steps:
|
||||
- checkout: self
|
||||
clean: true
|
||||
|
||||
- pwsh: |
|
||||
[string]$Branch=$env:BUILD_SOURCEBRANCH
|
||||
$branchOnly = $Branch -replace '^refs/heads/';
|
||||
$branchOnly = $branchOnly -replace '[_\-]'
|
||||
|
||||
if ($branchOnly -eq 'master') {
|
||||
$container = 'tpn'
|
||||
} else {
|
||||
$branchOnly = $branchOnly -replace '[\./]', '-'
|
||||
$container = "tpn-$branchOnly"
|
||||
}
|
||||
|
||||
$vstsCommandString = "vso[task.setvariable variable=tpnContainer]$container"
|
||||
Write-Verbose -Message $vstsCommandString -Verbose
|
||||
Write-Host -Object "##$vstsCommandString"
|
||||
displayName: Set ContainerName
|
||||
|
||||
- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
|
||||
displayName: 'Component Detection'
|
||||
inputs:
|
||||
sourceScanPath: '$(repoRoot)\tools'
|
||||
|
||||
- pwsh: |
|
||||
$(repoRoot)/tools/clearlyDefined/ClearlyDefined.ps1 -TestAndHarvest
|
||||
displayName: Verify that packages have license data
|
||||
|
||||
|
||||
- task: msospo.ospo-extension.8d7f9abb-6896-461d-9e25-4f74ed65ddb2.notice@0
|
||||
displayName: 'NOTICE File Generator'
|
||||
inputs:
|
||||
outputfile: '$(ob_outputDirectory)\ThirdPartyNotices.txt'
|
||||
# output format can be html or text
|
||||
outputformat: text
|
||||
# this isn't working
|
||||
# additionaldata: $(Build.SourcesDirectory)\assets\additionalAttributions.txt
|
||||
|
||||
|
||||
- pwsh: |
|
||||
Get-Content -Raw -Path $(repoRoot)\assets\additionalAttributions.txt | Out-File '$(ob_outputDirectory)\ThirdPartyNotices.txt' -Encoding utf8NoBOM -Force -Append
|
||||
Get-Content -Raw -Path $(repoRoot)\assets\additionalAttributions.txt
|
||||
displayName: Append Additional Attributions
|
||||
continueOnError: true
|
||||
|
||||
- pwsh: |
|
||||
Get-Content -Raw -Path '$(ob_outputDirectory)\ThirdPartyNotices.txt'
|
||||
displayName: Capture Notice
|
||||
continueOnError: true
|
||||
|
||||
- powershell: |
|
||||
[System.Net.ServicePointManager]::SecurityProtocol =
|
||||
[System.Net.ServicePointManager]::SecurityProtocol -bor
|
||||
[System.Security.Authentication.SslProtocols]::Tls12 -bor
|
||||
[System.Security.Authentication.SslProtocols]::Tls11
|
||||
|
||||
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord
|
||||
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord
|
||||
Get-PackageProvider -Name NuGet -ForceBootstrap
|
||||
displayName: Initalize PowerShellGet
|
||||
|
||||
- powershell: |
|
||||
$modules = 'Az.Accounts', 'Az.Storage'
|
||||
foreach($module in $modules) {
|
||||
if(!(get-module $module -listavailable)) {
|
||||
Write-Verbose "installing $module..." -verbose
|
||||
Install-Module $module -force -AllowClobber
|
||||
} else {
|
||||
Write-Verbose "$module already installed." -verbose
|
||||
#Update-Module $module -verbose
|
||||
}
|
||||
}
|
||||
displayName: Install PowerShell modules
|
||||
|
||||
- powershell: |
|
||||
if(Get-Command -Name Uninstall-AzureRm -ErrorAction Ignore){
|
||||
Write-Verbose "running Uninstall-AzureRm" -verbose
|
||||
Uninstall-AzureRm
|
||||
} else {
|
||||
Write-Verbose "Uninstall-AzureRm not present" -verbose
|
||||
}
|
||||
displayName: Uninstall Uninstall-AzureRm
|
||||
continueOnError: true
|
||||
|
||||
- task: AzurePowerShell@5
|
||||
displayName: Upload Notice
|
||||
inputs:
|
||||
azureSubscription: az-blob-cicd-infra
|
||||
scriptType: inlineScript
|
||||
azurePowerShellVersion: LatestVersion
|
||||
workingDirectory: '$(repoRoot)'
|
||||
pwsh: true
|
||||
inline: |
|
||||
try {
|
||||
$downloadsDirectory = '$(Build.ArtifactStagingDirectory)/downloads'
|
||||
$uploadedDirectory = '$(Build.ArtifactStagingDirectory)/uploaded'
|
||||
$storageAccountName = "pscoretestdata"
|
||||
$containerName = '$(tpnContainer)'
|
||||
$blobName = 'ThirdPartyNotices.txt'
|
||||
$noticePath = "$(ob_outputDirectory)\$blobName"
|
||||
|
||||
Write-Verbose -Verbose "creating context ($storageAccountName) ..."
|
||||
$context = New-AzStorageContext -StorageAccountName $storageAccountName -UseConnectedAccount
|
||||
|
||||
Write-Verbose -Verbose "checking if container ($containerName) exists ..."
|
||||
$containerExists = Get-AzStorageContainer -Name $containerName -Context $context -ErrorAction SilentlyContinue
|
||||
if (-not $containerExists) {
|
||||
Write-Verbose -Verbose "Creating container ..."
|
||||
$null = New-AzStorageContainer -Name $containerName -Context $context
|
||||
Write-Verbose -Verbose "Blob container $containerName created successfully."
|
||||
}
|
||||
|
||||
Write-Verbose -Verbose "Setting blob ($blobName) content ($noticePath) ..."
|
||||
$null = Set-AzStorageBlobContent -File $noticePath -Container $containerName -Blob $blobName -Context $context -confirm:$false -force
|
||||
Write-Verbose -Verbose "Done"
|
||||
} catch {
|
||||
Get-Error
|
||||
throw
|
||||
}
|
||||
Reference in New Issue
Block a user