Skip to content

Commit bc63289

Browse files
anamnavianamnavi
authored
Add release pipeline (#165)
1 parent 41ec3a0 commit bc63289

2 files changed

Lines changed: 219 additions & 0 deletions

File tree

‎.config/tsaoptions.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"instanceUrl": "https://msazure.visualstudio.com",
3+
"projectName": "One",
4+
"areaPath": "One\\MGMT\\Compute\\Powershell\\Powershell\\PowerShell Core\\Microsoft.PowerShell.Archive",
5+
"notificationAliases": [
6+
"annavied@microsoft.com",
7+
"adityap@microsoft.com"
8+
]
9+
}

‎Archive-Release-Official.yml‎

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
name: Microsoft-PowerShell-Archive-Release-$(Build.BuildId)
2+
trigger: none
3+
pr:
4+
branches:
5+
include:
6+
- master
7+
- release*
8+
parameters: # parameters are shown up in ADO UI in a build queue time
9+
- name: 'debug'
10+
displayName: 'Enable debug output'
11+
type: boolean
12+
default: false
13+
14+
variables:
15+
- name: DOTNET_CLI_TELEMETRY_OPTOUT
16+
value: 1
17+
- name: POWERSHELL_TELEMETRY_OPTOUT
18+
value: 1
19+
- name: WindowsContainerImage
20+
value: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest # Docker image which is used to build the project https://aka.ms/obpipelines/containers
21+
22+
resources:
23+
repositories:
24+
- repository: templates
25+
type: git
26+
name: OneBranch.Pipelines/GovernedTemplates
27+
ref: refs/heads/main
28+
29+
extends: # Governed template expands from here which defines over all pipeline orchestration with OneBranch security, Compliance & Governance enabled
30+
template: v2/OneBranch.Official.CrossPlat.yml@templates # The Official template may only be used by Production-classified pipelines
31+
parameters:
32+
featureFlags:
33+
WindowsHostVersion: '1ESWindows2022'
34+
linuxEsrpSigning: true
35+
customTags: 'ES365AIMigrationTooling'
36+
release:
37+
category: NonAzure
38+
globalSdl:
39+
disableLegacyManifest: true
40+
sbom:
41+
enabled: true
42+
packageName: Microsoft.PowerShell.Archive
43+
codeql:
44+
tsaEnabled: true
45+
compiled:
46+
enabled: true
47+
credscan:
48+
enabled: true
49+
scanFolder: $(Build.SourcesDirectory)\Microsoft.PowerShell.Archive
50+
binskim:
51+
enabled: true
52+
apiscan:
53+
enabled: false
54+
55+
stages:
56+
- stage: stagebuild
57+
displayName: Build and Package Microsoft.PowerShell.Archive
58+
jobs:
59+
- job: jobbuild
60+
displayName: Build Microsoft.PowerShell.Archive Files
61+
variables:
62+
- name: ob_outputDirectory
63+
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
64+
- name: repoRoot
65+
value: $(Build.SourcesDirectory)\Microsoft.PowerShell.Archive
66+
- name: srcCodePath
67+
value: $(repoRoot)\Microsoft.PowerShell.Archive
68+
- name: ob_sdl_tsa_configFile
69+
value: $(Build.SourcesDirectory)\Microsoft.PowerShell.Archive\.config\tsaoptions.json
70+
- name: signSrcPath
71+
value: $(repoRoot)\Microsoft.PowerShell.Archive
72+
- name: signOutPath
73+
value: $(repoRoot)/signed
74+
- name: ob_sdl_sbom_enabled
75+
value: true
76+
- name: ob_signing_setup_enabled
77+
value: true
78+
#CodeQL tasks added manually to workaround signing failures
79+
- name: ob_sdl_codeql_compiled_enabled
80+
value: false
81+
pool:
82+
type: windows
83+
steps:
84+
- checkout: self
85+
env:
86+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
87+
88+
- pwsh: |
89+
if (-not (Test-Path $(repoRoot)/.config/tsaoptions.json)) {
90+
Get-ChildItem $(Build.SourcesDirectory) -recurse -ErrorAction SilentlyContinue
91+
throw "tsaoptions.json does not exist under $(repoRoot)/.config"
92+
}
93+
displayName: Test if tsaoptions.json exists
94+
env:
95+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
96+
97+
- pwsh: |
98+
Get-ChildItem env:
99+
displayName: Capture Environment
100+
env:
101+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
102+
103+
- pwsh: |
104+
Write-Host "Displaying contents of Build.SourcesDirectory: $(Build.SourcesDirectory)"
105+
Get-ChildItem $(Build.SourcesDirectory) -Recurse
106+
displayName: 'Capture Build.SourcesDirectory $(Build.SourcesDirectory)'
107+
env:
108+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
109+
110+
- pwsh: |
111+
Write-Host "Displaying contents of signSrcPath: $(signSrcPath)"
112+
Get-ChildItem $(signSrcPath) -Recurse
113+
displayName: 'Capture signSrcPath $(signSrcPath)'
114+
env:
115+
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
116+
117+
- task: onebranch.pipeline.signing@1
118+
displayName: Sign 1st party files
119+
inputs:
120+
command: 'sign'
121+
signing_profile: external_distribution
122+
files_to_sign: '**\*.ps1;**\*.psd1;**\*.psm1'
123+
search_root: $(signSrcPath)
124+
125+
- pwsh: |
126+
# for Publish-PSResource call, folder structure needs to be 'moduleName/moduleName.psd1'
127+
$signedModuleDirPath = Join-Path $(signOutPath) -ChildPath "Microsoft.PowerShell.Archive"
128+
Copy-Item -Path $(signSrcPath) -Dest $signedModuleDirPath -Recurse
129+
Get-ChildItem $(signOutPath) -Recurse
130+
$signedModuleDirExists = Test-Path $signedModuleDirPath
131+
Write-Verbose -Verbose "expected module dir '$signedModuleDirPath' with signed files exists: $signedModuleDirExists"
132+
displayName: "Copy signed files from '$(signSrcPath)' to '$(signOutPath)/Microsoft.PowerShell.Archive'"
133+
134+
- pwsh: |
135+
# This need to be done before set-location so the module from PSHome is loaded
136+
Import-Module -Name Microsoft.PowerShell.PSResourceGet -Force
137+
138+
$signedModuleDirPath = Join-Path $(signOutPath) -ChildPath "Microsoft.PowerShell.Archive"
139+
Set-Location $signedModuleDirPath
140+
$publishPath = Join-Path $(signOutPath) -ChildPath 'PublishedNupkg'
141+
142+
$null = New-Item -ItemType Directory -Path $publishPath -Force
143+
144+
Register-PSResourceRepository -Name 'localRepo' -Uri $publishPath
145+
Publish-PSResource -Path $signedModuleDirPath -Repository 'localRepo' -Verbose
146+
Write-Output "##vso[task.setvariable variable=publishPath]$publishPath"
147+
displayName: Create nupkg for publishing
148+
149+
- task: onebranch.pipeline.signing@1
150+
displayName: Sign nupkg
151+
inputs:
152+
command: 'sign'
153+
signing_profile: external_distribution
154+
files_to_sign: '**\*.nupkg'
155+
search_root: '$(publishPath)'
156+
157+
- task: CopyFiles@2
158+
displayName: "Copy nupkg to ob_outputDirectory - '$(ob_outputDirectory)'"
159+
inputs:
160+
Contents: $(publishPath)\Microsoft.PowerShell.Archive.*.nupkg
161+
TargetFolder: $(ob_outputDirectory)
162+
163+
- stage: release
164+
displayName: Release Microsoft.PowerShell.Archive
165+
dependsOn: stagebuild
166+
variables:
167+
version: $[ stageDependencies.build.main.outputs['package.version'] ]
168+
drop: $(Pipeline.Workspace)/drop_stagebuild_jobbuild
169+
ob_release_environment: 'Production'
170+
171+
jobs:
172+
- job: validation
173+
displayName: Manual validation
174+
pool:
175+
type: server
176+
timeoutInMinutes: 1440
177+
steps:
178+
- task: ManualValidation@0
179+
displayName: Wait 24 hours for validation
180+
inputs:
181+
instructions: Please validate the release
182+
timeoutInMinutes: 1440
183+
184+
- job: PSGalleryPublish
185+
displayName: Publish to PSGallery
186+
dependsOn: validation
187+
templateContext:
188+
inputs:
189+
- input: pipelineArtifact
190+
artifactName: drop_stagebuild_jobbuild
191+
pool:
192+
type: release
193+
os: windows
194+
variables:
195+
ob_outputDirectory: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
196+
steps:
197+
- task: PowerShell@2
198+
inputs:
199+
targetType: 'inline'
200+
script: |
201+
Get-ChildItem "$(Pipeline.Workspace)/" -Recurse
202+
displayName: Find signed Nupkg
203+
204+
- task: NuGetCommand@2
205+
displayName: Push Microsoft.PowerShell.Archive module artifacts to PowerShell Gallery feed
206+
inputs:
207+
command: push
208+
packagesToPush: '$(Pipeline.Workspace)\Microsoft.PowerShell.Archive\signed\PublishedNupkg\Microsoft.PowerShell.Archive.*.nupkg'
209+
nuGetFeedType: external
210+
publishFeedCredentials: Archive-PSGalleryPush

0 commit comments

Comments
 (0)