Skip to content

Commit f624466

Browse files
andyleejordanandyleejordan
committed
Setup compliant build
Work in progress.
1 parent a0aced8 commit f624466

13 files changed

+273
-260
lines changed

‎.vsts-ci/azure-pipelines-ci.yml

+9-32
Original file line numberDiff line numberDiff line change
@@ -8,47 +8,24 @@ variables:
88
- name: DOTNET_CLI_TELEMETRY_OPTOUT
99
value: 'true'
1010

11-
trigger:
12-
batch: true
13-
branches:
14-
include:
15-
- master
16-
paths:
17-
exclude:
18-
- /.dependabot/*
19-
- /.poshchan/*
20-
- /.github/**/*
21-
- /.vscode/**/*
22-
- /.vsts-ci/misc-analysis.yml
23-
- /tools/**/*
24-
- .editorconfig
25-
- .gitattributes
26-
- .gitignore
27-
- /docs/**/*
28-
- /CHANGELOG.md
29-
- /CONTRIBUTING.md
30-
- /README.md
31-
- /LICENSE.txt
32-
- /CODE_OF_CONDUCT.md
33-
3411
jobs:
35-
- job: 'PS6_Win10'
36-
displayName: PowerShell 6 | Windows 10
12+
- job: windows2022pwsh
13+
displayName: Windows 2022 PowerShell 7
3714
pool:
38-
vmImage: 'vs2017-win2016'
15+
vmImage: windows-2022
3916
steps:
4017
- template: templates/ci-general.yml
4118

42-
- job: 'PS6_macOS'
43-
displayName: PowerShell 6 | macOS
19+
- job: macOS11
20+
displayName: macOS 11
4421
pool:
45-
vmImage: 'macOS-10.14'
22+
vmImage: macOS-11
4623
steps:
4724
- template: templates/ci-general.yml
4825

49-
- job: 'PS6_Ubuntu'
50-
displayName: PowerShell 6 | Ubuntu
26+
- job: ubuntu2004
27+
displayName: Ubuntu 20.04
5128
pool:
52-
vmImage: 'ubuntu-16.04'
29+
vmImage: ubuntu-20.04
5330
steps:
5431
- template: templates/ci-general.yml

‎.vsts-ci/azure-pipelines-release.yml

+43-136
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
1-
# NOTE:
2-
# We stop signing GraphicalTools now since we aren't doing anymore work on it until MAUI
3-
4-
name: PR-$(System.PullRequest.PullRequestNumber)-$(Date:yyyyMMdd)$(Rev:.rr)
1+
name: Release-$(Build.SourceBranchName)-$(Date:yyyyMMdd)$(Rev:.rr)
52

63
variables:
74
# Don't download unneeded packages
@@ -12,158 +9,68 @@ variables:
129
value: 'true'
1310

1411
trigger:
15-
batch: true
1612
branches:
1713
include:
18-
- master
19-
paths:
20-
exclude:
21-
- /.dependabot/*
22-
- /.poshchan/*
23-
- /.github/**/*
24-
- /.vscode/**/*
25-
- /.vsts-ci/misc-analysis.yml
26-
- /tools/**/*
27-
- .editorconfig
28-
- .gitattributes
29-
- .gitignore
30-
- /docs/**/*
31-
- /CHANGELOG.md
32-
- /CONTRIBUTING.md
33-
- /README.md
34-
- /LICENSE.txt
35-
- /CODE_OF_CONDUCT.md
14+
- release
3615

3716
resources:
3817
repositories:
3918
- repository: ComplianceRepo
4019
type: github
41-
endpoint: ComplianceGHRepo
20+
endpoint: GitHub
4221
name: PowerShell/compliance
4322

4423
stages:
4524
- stage: Build
46-
displayName: Build
25+
displayName: Build the release
4726
jobs:
48-
- job: 'ReleaseBuild'
49-
displayName: Release Build
27+
- job: Build
5028
pool:
51-
vmImage: 'windows-latest'
29+
name: 1ES
30+
demands: ImageOverride -equals PSMMS2019-Secure
5231
steps:
5332
- template: templates/ci-general.yml
54-
- pwsh: |
55-
Get-ChildItem -Recurse '$(Build.SourcesDirectory)'
56-
displayName: Capture downloaded artifacts
57-
- publish: '$(Build.SourcesDirectory)\src\Microsoft.PowerShell.ConsoleGuiTools\obj\project.assets.json'
58-
artifact: ConsoleGuiToolsAssetsJson
59-
displayName: Publish ConsoleGuiTools project.assets.json
6033

61-
- job: 'SignBuild'
62-
displayName: Signing Build
63-
dependsOn: 'ReleaseBuild'
34+
- stage: Sign
35+
displayName: Sign the release
36+
jobs:
37+
- job: Sign
6438
pool:
65-
name: 'Package ES Standard Build'
66-
demands: DotNetFramework
39+
name: 1ES
40+
demands: ImageOverride -equals PSMMS2019-Secure
6741
variables:
6842
- group: ESRP
6943
steps:
70-
- powershell: |
71-
Get-ChildItem -Path env:
72-
displayName: Capture environment
73-
condition: succeededOrFailed()
74-
75-
- task: DownloadBuildArtifacts@0
76-
displayName: 'Download Build Artifacts'
77-
inputs:
78-
downloadType: specific
79-
80-
- pwsh: |
81-
Expand-Archive -Path "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\GraphicalTools\Microsoft.PowerShell.ConsoleGuiTools-Windows_NT.zip" -DestinationPath "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.ConsoleGuiTools"
82-
displayName: 'Extract build zip'
83-
84-
- template: EsrpSign.yml@ComplianceRepo
85-
parameters:
86-
# the folder which contains the binaries to sign
87-
buildOutputPath: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools
88-
# the location to put the signed output
89-
signOutputPath: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools-Signed
90-
# the certificate ID to use
91-
certificateId: "CP-230012"
92-
# The file pattern to use
93-
# If not using minimatch: comma separated, with * supported
94-
# If using minimatch: newline separated, with !, **, and * supported.
95-
# See link in the useMinimatch comments.
96-
pattern: 'Microsoft.PowerShell.*.dll,Microsoft.PowerShell.*.psd1,Microsoft.PowerShell.*.psm1'
97-
# decides if the task should use minimatch for the pattern matching.
98-
# https://github.com/isaacs/minimatch#features
99-
useMinimatch: false
100-
101-
- pwsh: |
102-
$signed="$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.ConsoleGuiTools-Signed\*"
103-
$notSigned="$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.ConsoleGuiTools"
104-
Copy-Item $signed $notSigned -Recurse -Force -Verbose
105-
displayName: 'Copy signed files to unsigned folder'
106-
107-
- template: EsrpSign.yml@ComplianceRepo
108-
parameters:
109-
# the folder which contains the binaries to sign
110-
buildOutputPath: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools
111-
# the location to put the signed output
112-
signOutputPath: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools-Signed
113-
# the certificate ID to use
114-
certificateId: "CP-231522"
115-
# The file pattern to use
116-
# If not using minimatch: comma separated, with * supported
117-
# If using minimatch: newline separated, with !, **, and * supported.
118-
# See link in the useMinimatch comments.
119-
pattern: 'NStack.dll,Terminal.Gui.dll'
120-
# decides if the task should use minimatch for the pattern matching.
121-
# https://github.com/isaacs/minimatch#features
122-
useMinimatch: false
123-
124-
- pwsh: |
125-
$signed="$(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools-Signed\*"
126-
$notSigned="$(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools"
127-
Copy-Item $signed $notSigned -Recurse -Force -Verbose
128-
displayName: 'Copy signed files to unsigned folder'
44+
- template: templates/release-general.yml
12945

130-
- publish: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools
131-
artifact: Microsoft.PowerShell.ConsoleGuiTools-Signed
132-
displayName: 'Upload Artifacts'
133-
condition: succeededOrFailed()
134-
135-
- stage: compliance
136-
displayName: Compliance
137-
dependsOn: Build
46+
- stage: PublishGitHub
47+
displayName: Publish the draft release
13848
jobs:
139-
- job: Compliance_Job
49+
- deployment: Publish
50+
environment: GraphicalTools-GitHub
14051
pool:
141-
name: Package ES Standard Build
142-
steps:
143-
- checkout: self
144-
- checkout: ComplianceRepo
145-
- download: current
146-
artifact: Microsoft.PowerShell.ConsoleGuiTools-Signed
147-
- download: current
148-
artifact: ConsoleGuiToolsAssetsJson
149-
150-
- pwsh: |
151-
Get-ChildItem -Recurse '$(Pipeline.Workspace)'
152-
displayName: Capture downloaded artifacts
153-
154-
- template: assembly-module-compliance.yml@ComplianceRepo
155-
parameters:
156-
# binskim
157-
AnalyzeTarget: '$(Pipeline.Workspace)\Microsoft.PowerShell.ConsoleGuiTools-Signed\*.dll'
158-
AnalyzeSymPath: 'SRV*'
159-
# component-governance
160-
sourceScanPath: '$(Pipeline.Workspace)\ConsoleGuiToolsAssetsJson'
161-
# credscan
162-
suppressionsFile: ''
163-
# TermCheck
164-
optionsRulesDBPath: ''
165-
optionsFTPath: ''
166-
# tsa-upload
167-
codeBaseName: 'PSGraphicalTools_20201123'
168-
# selections
169-
APIScan: false # set to false when not using Windows APIs.
52+
name: 1ES
53+
demands: ImageOverride -equals PSMMSUbuntu20.04-Secure
54+
variables:
55+
- group: Publish
56+
strategy:
57+
runOnce:
58+
deploy:
59+
steps:
60+
- template: templates/publish-github.yml
61+
62+
- stage: PublishMarkets
63+
displayName: Publish to marketplace and gallery
64+
jobs:
65+
- deployment: Publish
66+
environment: GraphicalTools-Gallery
67+
pool:
68+
name: 1ES
69+
demands: ImageOverride -equals PSMMSUbuntu20.04-Secure
70+
variables:
71+
- group: Publish
72+
strategy:
73+
runOnce:
74+
deploy:
75+
steps:
76+
- template: templates/publish-markets.yml

‎.vsts-ci/misc-analysis.yml

+4-9
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,25 @@
11
name: PR-$(System.PullRequest.PullRequestNumber)-$(Date:yyyyMMdd)$(Rev:.rr)
2+
23
trigger:
3-
# Batch merge builds together while a merge build is running
4-
batch: true
54
branches:
65
include:
76
- master
87

98
pr:
10-
branches:
11-
include:
12-
- master
9+
- master
1310

1411
resources:
1512
repositories:
1613
- repository: ComplianceRepo
1714
type: github
18-
endpoint: ComplianceGHRepo
15+
endpoint: GitHub
1916
name: PowerShell/compliance
2017

2118
jobs:
22-
- job: Compliance_Job
19+
- job: Compliance
2320
pool:
2421
vmImage: windows-latest
2522
steps:
2623
- checkout: self
27-
clean: true
2824
- checkout: ComplianceRepo
29-
clean: true
3025
- template: ci-compliance.yml@ComplianceRepo

‎.vsts-ci/templates/ci-general.yml

+64-22
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,67 @@
11
parameters:
2-
pwsh: true
2+
- name: pwsh
3+
type: boolean
4+
default: true
35

46
steps:
5-
- pwsh: Write-Host "##vso[build.updatebuildnumber]$env:BUILD_SOURCEBRANCHNAME-$env:BUILD_SOURCEVERSION-$((get-date).ToString("yyyyMMddhhmmss"))"
6-
displayName: Set Build Name for Non-PR
7-
condition: ne(variables['Build.Reason'], 'PullRequest')
8-
- task: PowerShell@2
9-
inputs:
10-
filePath: scripts/azurePipelinesBuild.ps1
11-
pwsh: ${{ parameters.pwsh }}
12-
- task: PublishTestResults@2
13-
inputs:
14-
testRunner: VSTest
15-
testResultsFiles: '**/*.trx'
16-
condition: succeededOrFailed()
17-
- task: PublishTestResults@2
18-
inputs:
19-
testRunner: NUnit
20-
testResultsFiles: '**/TestResults.xml'
21-
condition: succeededOrFailed()
22-
- task: PublishBuildArtifacts@1
23-
inputs:
24-
ArtifactName: GraphicalTools
25-
PathtoPublish: '$(Build.ArtifactStagingDirectory)'
7+
- task: PowerShell@2
8+
displayName: PowerShell version
9+
inputs:
10+
targetType: inline
11+
script: $PSVersionTable
12+
pwsh: ${{ parameters.pwsh }}
13+
14+
- task: UseDotNet@2
15+
displayName: Install .NET 6.0.x SDK
16+
inputs:
17+
packageType: sdk
18+
version: 6.0.x
19+
performMultiLevelLookup: true
20+
21+
- task: PowerShell@2
22+
displayName: Build and test
23+
inputs:
24+
filePath: tools/azurePipelinesBuild.ps1
25+
pwsh: ${{ parameters.pwsh }}
26+
27+
- task: PublishTestResults@2
28+
displayName: Publish VSTest results
29+
inputs:
30+
testRunner: VSTest
31+
testResultsFiles: '**/*.trx'
32+
condition: succeededOrFailed()
33+
34+
- task: PublishTestResults@2
35+
displayName: Publish NUnit results
36+
inputs:
37+
testRunner: NUnit
38+
testResultsFiles: '**/TestResults.xml'
39+
condition: succeededOrFailed()
40+
41+
# NOTE: We zip the artifacts because they're ~20 MB compressed, but ~300 MB raw,
42+
# and we have limited pipeline artifact storage space.
43+
- task: ArchiveFiles@2
44+
displayName: Zip build output
45+
inputs:
46+
rootFolderOrFile: module
47+
includeRootFolder: false
48+
archiveType: zip
49+
archiveFile: GraphicalTools-Build.zip
50+
verbose: true
51+
52+
- publish: GraphicalTools-Build.zip
53+
artifact: GraphicalTools-Build-$(System.JobId)
54+
displayName: Publish build output archive
55+
56+
- task: ArchiveFiles@2
57+
displayName: Zip sources with `project.assets.json`
58+
inputs:
59+
rootFolderOrFile: src
60+
includeRootFolder: false
61+
archiveType: zip
62+
archiveFile: GraphicalTools-Sources.zip
63+
verbose: true
64+
65+
- publish: GraphicalTools-Sources.zip
66+
artifact: GraphicalTools-Sources-$(System.JobId)
67+
displayName: Publish sources archive

0 commit comments

Comments
 (0)