PowerShell-PowerShell/.pipelines/templates/linux.yml

parameters:
  Runtime: 'linux-x64'
  BuildConfiguration: 'release'
  JobName: 'build_linux'

jobs:
- job: build_${{ parameters.JobName }}
  displayName: Build_Linux_${{ parameters.Runtime }}_${{ parameters.BuildConfiguration }}
  condition: succeeded()
  pool:
    type: linux
  variables:
  - name: NugetSecurityAnalysisWarningLevel
    value: none
  - name: DOTNET_NOLOGO
    value: 1
  - group: DotNetPrivateBuildAccess
  - name: ob_outputDirectory
    value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
  - name: ob_sdl_codeSignValidation_enabled
    value: false
  - name: ob_sdl_binskim_enabled
    value: true
  - name: ob_sdl_tsa_configFile
    value: $(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
  - name: ob_sdl_credscan_suppressionsFile
    value: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
  - name: BUILDCONFIGURATION
    value: ${{ parameters.BuildConfiguration }}
  - name: Runtime
    value: ${{ parameters.Runtime }}
  - name: ob_sdl_sbom_packageName
    value: 'Microsoft.Powershell.Linux.${{ parameters.Runtime }}'
  # We add this manually, so we need it disabled the OneBranch auto-injected one.
  - name: ob_sdl_codeql_compiled_enabled
    value: false

  steps:
  - checkout: self
    clean: true
    env:
      ob_restore_phase: true # This ensures checkout is done at the beginning of the restore phase

  - template: /.pipelines/templates/SetVersionVariables.yml@self
    parameters:
      ReleaseTagVar: $(ReleaseTagVar)

  - template: /.pipelines/templates/cloneToOfficialPath.yml@self

  - template: /.pipelines/templates/insert-nuget-config-azfeed.yml@self
    parameters:
      repoRoot: $(PowerShellRoot)

  - task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step.
    condition: eq(variables['CODEQL_ENABLED'], 'true')
    env:
      ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
    inputs:
      Enabled: true
      # AnalyzeInPipeline: false = upload results
      # AnalyzeInPipeline: true = do not upload results
      AnalyzeInPipeline: false
      Language: csharp

  - template: /.pipelines/templates/install-dotnet.yml@self

  - pwsh: |
      $runtime = $env:RUNTIME

      $params = @{}
      if ($env:BUILDCONFIGURATION -eq 'minSize') {
        Write-Verbose -Message "Building for minimal size"
        $params['ForMinimalSize'] = $true
      }

      Write-Verbose -Message "Building PowerShell with Runtime: $runtime"
      Import-Module -Name $(PowerShellRoot)/build.psm1 -Force
      $buildWithSymbolsPath = New-Item -ItemType Directory -Path $(Pipeline.Workspace)/Symbols_$(Runtime) -Force

      $null = New-Item -ItemType Directory -Path $buildWithSymbolsPath -Force -Verbose

      $ReleaseTagParam = @{}

      if ($env:RELEASETAGVAR) {
        $ReleaseTagParam['ReleaseTag'] = $env:RELEASETAGVAR
      }

      Start-PSBuild -Runtime $runtime -Configuration Release -Output $buildWithSymbolsPath @params -Clean -PSModuleRestore @ReleaseTagParam

      $outputPath = Join-Path '$(ob_outputDirectory)' 'psoptions'
      $null = New-Item -ItemType Directory -Path $outputPath -Force
      $psOptPath = "$outputPath/psoptions.json"
      Save-PSOptions -PSOptionsPath $psOptPath

      Write-Verbose -Verbose "Verifying pdbs exist in build folder"
      $pdbs = Get-ChildItem -Path $buildWithSymbolsPath -Recurse -Filter *.pdb
      if ($pdbs.Count -eq 0) {
        Write-Error -Message "No pdbs found in build folder"
      }
      else {
        Write-Verbose -Verbose "Found $($pdbs.Count) pdbs in build folder"
        $pdbs | ForEach-Object {
          Write-Verbose -Verbose "Pdb: $($_.FullName)"
        }
      }

      Write-Verbose -Verbose "Completed building PowerShell for '$env:BUILDCONFIGURATION' configuration"
    displayName: 'Build Linux - $(Runtime)'
    env:
      __DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
      ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.

  - task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.
    condition: eq(variables['CODEQL_ENABLED'], 'true')
    env:
      ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.

  - pwsh: |
      $platform = 'linux'
      $vstsCommandString = "vso[task.setvariable variable=ArtifactPlatform]$platform"
      Write-Host ("sending " + $vstsCommandString)
      Write-Host "##$vstsCommandString"
    displayName: Set artifact platform

  - pwsh: |
      $pathForUpload = New-Item -ItemType Directory -Path '$(ob_outputDirectory)/Unsigned-$(Runtime)' -Force
      Write-Verbose -Verbose -Message "pathForUpload: $pathForUpload"
      Copy-Item -Path '$(Pipeline.Workspace)/Symbols_$(Runtime)/*' -Destination $pathForUpload -Recurse -Force -Verbose
    displayName: Copy unsigned files for upload

  - template: /.pipelines/templates/step/finalize.yml@self

- job: sign_${{ parameters.JobName }}
  displayName: Sign_Linux_${{ parameters.Runtime }}_${{ parameters.BuildConfiguration }}
  condition: succeeded()
  dependsOn: build_${{ parameters.JobName }}
  pool:
    type: windows
  variables:
  - name: NugetSecurityAnalysisWarningLevel
    value: none
  - name: DOTNET_NOLOGO
    value: 1
  - group: DotNetPrivateBuildAccess
  - group: certificate_logical_to_actual
  - name: ob_outputDirectory
    value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
  - name: ob_sdl_codeSignValidation_enabled
    value: false
  - name: ob_sdl_binskim_enabled
    value: false
  - name: ob_sdl_tsa_configFile
    value: $(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
  - name: ob_sdl_credscan_suppressionsFile
    value: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
  - name: BuildConfiguration
    value: ${{ parameters.BuildConfiguration }}
  - name: Runtime
    value: ${{ parameters.Runtime }}
  - name: ob_sdl_codeql_compiled_enabled
    value: false

  steps:
  - checkout: self
    clean: true
    env:
      ob_restore_phase: true # This ensures checkout is done at the beginning of the restore phase

  - template: /.pipelines/templates/SetVersionVariables.yml@self
    parameters:
      ReleaseTagVar: $(ReleaseTagVar)

  - template: /.pipelines/templates/cloneToOfficialPath.yml@self

  - task: DownloadPipelineArtifact@2
    inputs:
      artifact: drop_linux_build_${{ parameters.JobName }}
      path: $(Pipeline.Workspace)/drop_linux_build
    displayName: Download build

  - pwsh: |
      Get-ChildItem -Path $(Pipeline.Workspace)/drop_linux_build -Recurse
    displayName: Capture downloaded files

  - pwsh: |
      $pwshPath = Get-ChildItem -Path $(Pipeline.Workspace)/drop_linux_build -File -Recurse | Where-Object { $_.Name -eq 'pwsh' }
      $rootPath = Split-Path -Path $pwshPath.FullName -Parent
      Write-Verbose -Verbose "Setting vso[task.setvariable variable=DropRootPath]$rootPath"
      Write-Host "##vso[task.setvariable variable=DropRootPath]$rootPath"
    displayName: Set drop root path

  - template: /.pipelines/templates/obp-file-signing.yml@self
    parameters:
      binPath: $(DropRootPath)
      OfficialBuild: $(ps_official_build)

  - template: /.pipelines/templates/step/finalize.yml@self