Skip to content

Commit b4365ad

Browse files
adityapatwardhanOneBranch Resources
adityapatwardhan
and
OneBranch Resources
authored
Adding OneBranch pipeline YAML config file for OSS_Microsoft_PSSA-Official (#1981)
* Adding OneBranch pipeline YAML config file for OSS_Microsoft_PSSA-Official * Updates to signing and TSA * Fix typo * Fix typo 2 * Fix typo 3 * Update CR feedback * Revert back to old signing * Fix source direcctory for credscan --------- Co-authored-by: OneBranch Resources <ezstart@microsoft.com>
1 parent c085ee3 commit b4365ad

File tree

2 files changed

+170
-0
lines changed

2 files changed

+170
-0
lines changed

‎.config/tsaoptions.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"instanceUrl": "https://msazure.visualstudio.com",
3+
"projectName": "One",
4+
"areaPath": "One\\MGMT\\Compute\\Powershell\\Powershell\\PowerShell Core",
5+
"notificationAliases": [
6+
"jimtru@microsoft.com",
7+
"slee@microsoft.com"
8+
],
9+
"codebaseName": "PSSA_202403"
10+
}

‎.pipelines/OSS_Microsoft_PSSA-Official.yml

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
# This Yaml Document has been converted by ESAI Yaml Pipeline Conversion Tool.
2+
# Please make sure to check all the converted content, it is your team's responsibility to make sure that the pipeline is still valid and functions as expected.
3+
# This pipeline will be extended to the OneBranch template
4+
name: PSSA-Release-$(Build.BuildId)
5+
trigger: none
6+
pr:
7+
branches:
8+
include:
9+
- master
10+
- release*
11+
variables:
12+
- name: DOTNET_CLI_TELEMETRY_OPTOUT
13+
value: 1
14+
- name: POWERSHELL_TELEMETRY_OPTOUT
15+
value: 1
16+
- name: WindowsContainerImage
17+
value: onebranch.azurecr.io/windows/ltsc2019/vse2022:latest
18+
resources:
19+
repositories:
20+
- repository: ComplianceRepo
21+
type: github
22+
endpoint: ComplianceGHRepo
23+
name: PowerShell/compliance
24+
ref: master
25+
- repository: onebranchTemplates
26+
type: git
27+
name: OneBranch.Pipelines/GovernedTemplates
28+
ref: refs/heads/main
29+
extends:
30+
template: v2/OneBranch.Official.CrossPlat.yml@onebranchTemplates
31+
parameters:
32+
customTags: 'ES365AIMigrationTooling'
33+
globalSdl:
34+
sbom:
35+
enabled: false
36+
codeql:
37+
compiled:
38+
enabled: true
39+
asyncSdl: # https://aka.ms/obpipelines/asyncsdl
40+
enabled: true
41+
forStages: [Build]
42+
credscan:
43+
enabled: true
44+
scanFolder: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA
45+
binskim:
46+
enabled: true
47+
apiscan:
48+
enabled: false
49+
50+
stages:
51+
- stage: Build
52+
displayName: Build
53+
jobs:
54+
- job: Build_Job
55+
displayName: Build Microsoft.PowerShell.ScriptAnalyzer
56+
variables:
57+
- group: ESRP
58+
- name: ob_outputDirectory
59+
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
60+
- name: repoRoot
61+
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA
62+
- name: ob_sdl_tsa_configFile
63+
value: $(Build.SourcesDirectory)\OSS_Microsoft_PSSA\.config\tsaoptions.json
64+
pool:
65+
type: windows
66+
steps:
67+
- checkout: self
68+
- checkout: ComplianceRepo
69+
70+
- pwsh: |
71+
if (-not (Test-Path $(repoRoot)/.config/tsaoptions.json)) {
72+
Get-ChildItem $(Build.SourcesDirectory) -recurse -ErrorAction SilentlyContinue
73+
throw "tsaoptions.json does not exist under $(Build.SourcesDirectory)/OSS_Microsoft_PSSA/.config"
74+
}
75+
displayName: Test if tsaoptions.json exists
76+
77+
#- pwsh: |
78+
# New-Item -ItemType Directory -Path $(Build.SourcesDirectory)/.config -Force -Verbose
79+
# Copy-Item '$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/.config/tsaoptions.json' '$(Build.SourcesDirectory)/.config/tsaoptions.json' -Force -Verbose
80+
# displayName: Copy tsaoptions
81+
82+
- pwsh: |
83+
Set-Location "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA"
84+
try { ./build.ps1 -Configuration Release -All } catch { throw $_ }
85+
displayName: Execute build
86+
87+
- pwsh: |
88+
$signSrcPath = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/out"
89+
# Set signing src path variable
90+
$vstsCommandString = "vso[task.setvariable variable=signSrcPath]${signSrcPath}"
91+
Write-Host "sending $vstsCommandString"
92+
Write-Host "##$vstsCommandString"
93+
$signOutStep1 = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/Step1"
94+
$null = New-Item -ItemType Directory -Path $signOutStep1
95+
# Set signing out path variable
96+
$vstsCommandString = "vso[task.setvariable variable=signOutStep1]${signOutStep1}"
97+
Write-Host "sending $vstsCommandString"
98+
Write-Host "##$vstsCommandString"
99+
$signOutPath = "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/signed"
100+
$null = New-Item -ItemType Directory -Path $signOutPath
101+
# Set signing out path variable
102+
$vstsCommandString = "vso[task.setvariable variable=signOutPath]${signOutPath}"
103+
Write-Host "sending $vstsCommandString"
104+
Write-Host "##$vstsCommandString"
105+
# Set path variable for guardian codesign validation
106+
$vstsCommandString = "vso[task.setvariable variable=GDN_CODESIGN_TARGETDIRECTORY]${signOutPath}"
107+
Write-Host "sending $vstsCommandString"
108+
Write-Host "##$vstsCommandString"
109+
# Get version and create a variable
110+
$moduleData = Import-PowerShellDataFile "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA/Engine/PSScriptAnalyzer.psd1"
111+
$moduleVersion = $moduleData.ModuleVersion
112+
$vstsCommandString = "vso[task.setvariable variable=moduleVersion]${moduleVersion}"
113+
Write-Host "sending $vstsCommandString"
114+
Write-Host "##$vstsCommandString"
115+
displayName: Setup variables for signing
116+
117+
- template: EsrpSign.yml@ComplianceRepo
118+
parameters:
119+
buildOutputPath: $(signSrcPath)
120+
signOutputPath: $(signOutStep1)
121+
certificateId: "CP-230012"
122+
useMinimatch: true
123+
pattern: |
124+
**\*.psd1
125+
**\*.psm1
126+
**\*.ps1xml
127+
**\Microsoft*.dll
128+
129+
- template: EsrpSign.yml@ComplianceRepo
130+
parameters:
131+
buildOutputPath: $(signOutStep1)
132+
signOutputPath: $(signOutPath)
133+
certificateId: "CP-231522"
134+
useMinimatch: true
135+
pattern: |
136+
**/Pluralize*.dll
137+
**/Newtonsoft*.dll
138+
139+
- template: Sbom.yml@ComplianceRepo
140+
parameters:
141+
BuildDropPath: $(signOutPath)
142+
Build_Repository_Uri: 'https://github.com/powershell/PSScriptAnalyzer'
143+
144+
- pwsh: |
145+
Set-Location "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA"
146+
./build -BuildNupkg -CopyManifest -signed
147+
displayName: Create nupkg for publishing
148+
149+
- task: CopyFiles@2
150+
displayName: "Copy Files for 'publish build directory' publish task"
151+
inputs:
152+
SourceFolder: "$(Build.SourcesDirectory)/OSS_Microsoft_PSSA"
153+
Contents: '**'
154+
TargetFolder: $(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT/build
155+
156+
- task: CopyFiles@2
157+
displayName: "Copy Files for 'Publish module nupkg' publish task"
158+
inputs:
159+
Contents: "$(signOutPath)/PSScriptAnalyzer.$(moduleVersion).nupkg"
160+
TargetFolder: $(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT/nupkg

0 commit comments

Comments
 (0)