Skip to content

Commit 473498e

Browse files
committed
move signing to it's own job
1 parent 4331d7b commit 473498e

File tree

1 file changed

+59
-28
lines changed

1 file changed

+59
-28
lines changed

.pipelines/OSS_Microsoft_PSSA-Official.yml

Lines changed: 59 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -55,47 +55,39 @@ extends:
5555
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
5656
- name: repoRoot
5757
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA
58+
- name: ob_sdl_sbom_enabled
59+
value: false
5860
- name: ob_sdl_tsa_configFile
5961
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA\.config\tsaoptions.json
62+
- name: signSrcPath
63+
value: $(repoRoot)/out
6064
pool:
6165
type: windows
6266
steps:
6367
- checkout: self
64-
# make sure this happens before signing setup
65-
env:
66-
ob_restore_phase: true
6768

6869
- pwsh: |
6970
if (-not (Test-Path $(repoRoot)/.config/tsaoptions.json)) {
7071
Get-ChildItem $(Build.SourcesDirectory) -recurse -ErrorAction SilentlyContinue
71-
throw "tsaoptions.json does not exist under $(Build.SourcesDirectory)/OSS_Microsoft_PSSA/.config"
72+
throw "tsaoptions.json does not exist under $(repoRoot)/.config"
7273
}
7374
displayName: Test if tsaoptions.json exists
74-
# make sure this happens before signing setup
75-
env:
76-
ob_restore_phase: true
7775
76+
# this is installing .NET
7877
- pwsh: |
79-
Set-Location "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA"
78+
Set-Location "$(repoRoot)"
8079
try { ./build.ps1 -Configuration Release -All } catch { throw $_ }
8180
displayName: Execute build
82-
# make sure this happens before signing setup
83-
env:
84-
ob_restore_phase: true
8581
8682
- pwsh: |
87-
$signSrcPath = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/out"
88-
# Set signing src path variable
89-
$vstsCommandString = "vso[task.setvariable variable=signSrcPath]${signSrcPath}"
90-
Write-Host "sending $vstsCommandString"
91-
Write-Host "##$vstsCommandString"
92-
$signOutStep1 = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/Step1"
83+
$signSrcPath = $env:SIGNSRCPATH
84+
$signOutStep1 = "$(repoRoot)/Step1"
9385
$null = New-Item -ItemType Directory -Path $signOutStep1
9486
# Set signing out path variable
9587
$vstsCommandString = "vso[task.setvariable variable=signOutStep1]${signOutStep1}"
9688
Write-Host "sending $vstsCommandString"
9789
Write-Host "##$vstsCommandString"
98-
$signOutPath = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/signed"
90+
$signOutPath = "$(repoRoot)/signed"
9991
$null = New-Item -ItemType Directory -Path $signOutPath
10092
# Set signing out path variable
10193
$vstsCommandString = "vso[task.setvariable variable=signOutPath]${signOutPath}"
@@ -106,17 +98,53 @@ extends:
10698
Write-Host "sending $vstsCommandString"
10799
Write-Host "##$vstsCommandString"
108100
# Get version and create a variable
109-
$moduleData = Import-PowerShellDataFile "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/Engine/PSScriptAnalyzer.psd1"
101+
$moduleData = Import-PowerShellDataFile "$(repoRoot)/Engine/PSScriptAnalyzer.psd1"
110102
$moduleVersion = $moduleData.ModuleVersion
111103
$vstsCommandString = "vso[task.setvariable variable=moduleVersion]${moduleVersion}"
112104
$vstsCommandString = "vso[task.setvariable variable=ob_sdl_sbom_packageversion]${moduleVersion}"
113105
114106
Write-Host "sending $vstsCommandString"
115107
Write-Host "##$vstsCommandString"
116108
displayName: Setup variables for signing
117-
# make sure this happens before signing setup
118-
env:
119-
ob_restore_phase: true
109+
110+
- task: CopyFiles@2
111+
displayName: "Copy Files for 'publish build directory' publish task"
112+
inputs:
113+
SourceFolder: "$(signSrcPath)"
114+
Contents: '**'
115+
TargetFolder: $(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT
116+
117+
- job: jobsign
118+
dependsOn: jobbuild
119+
displayName: Sign Microsoft.PowerShell.ScriptAnalyzer Files
120+
variables:
121+
- name: ob_outputDirectory
122+
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
123+
- name: repoRoot
124+
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA
125+
- name: ob_sdl_tsa_configFile
126+
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA\.config\tsaoptions.json
127+
- name: ob_sdl_sbom_enabled
128+
value: true
129+
- name: ob_sdl_codeql_compiled_enabled
130+
value: false
131+
- name: signSrcPath
132+
value: $(repoRoot)/out
133+
pool:
134+
type: windows
135+
steps:
136+
- checkout: self
137+
138+
- task: DownloadPipelineArtifact@2
139+
displayName: 'Download build files'
140+
inputs:
141+
targetPath: $(signSrcPath)
142+
artifact: drop_stagebuild_jobbuild
143+
144+
- pwsh: |
145+
Set-Location "$(signSrcPath)"
146+
dir -recurse *
147+
displayName: Capture artifacts
120148
121149
- task: onebranch.pipeline.signing@1
122150
displayName: Sign 1st party files
@@ -137,12 +165,12 @@ extends:
137165
- task: CopyFiles@2
138166
displayName: "Copy Files for 'publish build directory' publish task"
139167
inputs:
140-
SourceFolder: "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA"
168+
SourceFolder: "$(signSrcPath)"
141169
Contents: '**'
142170
TargetFolder: $(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT
143171

144172
- job: nupkg
145-
dependsOn: jobbuild
173+
dependsOn: jobsign
146174
displayName: Package Microsoft.PowerShell.ScriptAnalyzer
147175
variables:
148176
- name: ob_outputDirectory
@@ -155,6 +183,8 @@ extends:
155183
value: false
156184
- name: ob_sdl_codeql_compiled_enabled
157185
value: false
186+
- name: signSrcPath
187+
value: $(repoRoot)/out
158188
pool:
159189
type: windows
160190
steps:
@@ -163,22 +193,23 @@ extends:
163193
- pwsh: |
164194
if (-not (Test-Path $(repoRoot)/.config/tsaoptions.json)) {
165195
Get-ChildItem $(Build.SourcesDirectory) -recurse -ErrorAction SilentlyContinue
166-
throw "tsaoptions.json does not exist under $(Build.SourcesDirectory)/OSS_Microsoft_PSSA/.config"
196+
throw "tsaoptions.json does not exist under $(repoRoot)/.config"
167197
}
168198
displayName: Test if tsaoptions.json exists
169199
170200
- task: DownloadPipelineArtifact@2
171201
displayName: 'Download build files'
172202
inputs:
173-
targetPath: $(Build.SourcesDirectory)/artifacts/build
203+
targetPath: $(signSrcPath)
204+
artifact: drop_stagebuild_jobsign
174205
## download
175206
- pwsh: |
176-
Set-Location "$(Build.SourcesDirectory)/artifacts/"
207+
Set-Location "$(signSrcPath)"
177208
dir -recurse *
178209
displayName: Capture artifacts
179210
180211
- pwsh: |
181-
Set-Location "$(Build.SourcesDirectory)/artifacts/build"
212+
Set-Location "$(repoRoot)"
182213
./build -BuildNupkg -CopyManifest -signed
183214
displayName: Create nupkg for publishing
184215

0 commit comments

Comments
 (0)