Skip to content

Commit 167a768

Browse files
adityapatwardhanadityapatwardhan
authored
Multistage build with release (#37)
1 parent b375a0f commit 167a768

File tree

9 files changed

+490
-0
lines changed

9 files changed

+490
-0
lines changed

‎tools/releaseBuild/yaml/compliance.yml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
steps:
2+
3+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-binskim.BinSkim@3
4+
displayName: 'Run BinSkim '
5+
inputs:
6+
InputType: Basic
7+
AnalyzeTarget: '$(System.ArtifactsDirectory)\uncompressed\*.dll;$(System.ArtifactsDirectory)\uncompressed\*.exe'
8+
AnalyzeSymPath: 'SRV*http://symweb'
9+
AnalyzeVerbose: true
10+
AnalyzeHashes: true
11+
AnalyzeStatistics: true
12+
13+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3
14+
displayName: 'Run MpCmdRun.exe'
15+
16+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-apiscan.APIScan@1
17+
displayName: 'Run APIScan'
18+
inputs:
19+
softwareFolder: '$(System.ArtifactsDirectory)\uncompressed'
20+
softwareName: PowerShell
21+
softwareVersionNum: '$(NugetPackageVersion)'
22+
isLargeApp: false
23+
24+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2
25+
displayName: 'Run CredScan'
26+
inputs:
27+
debugMode: false
28+
29+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-policheck.PoliCheck@1
30+
displayName: 'Run PoliCheck'
31+
inputs:
32+
targetType: F
33+
34+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2
35+
displayName: 'Publish Security Analysis Logs'
36+
37+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-uploadtotsa.TSAUpload@1
38+
displayName: 'TSA upload to Codebase: PowerShellNative Stamp: Azure'
39+
inputs:
40+
codebase: NewOrUpdate
41+
tsaStamp: Azure
42+
codeBaseName: PowerShellNative
43+
notificationAlias: '4e50053a.microsoft.com@amer.teams.ms'
44+
codeBaseAdmins: 'adityap;tplunk;dongbow;slee'
45+
instanceUrlAzure: MSAZURE
46+
projectNameMSAZURE: One
47+
areaPath: 'One\MGMT\Azure Automation\PowerShell\PowerShell Core'
48+
iterationPath: 'One\_Default'
49+
uploadFortifySCA: false
50+
uploadFxCop: false
51+
uploadModernCop: false
52+
uploadPREfast: false
53+
uploadRoslyn: false
54+
uploadTSLint: false
55+
56+
- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
57+
displayName: 'Component Detection'

‎tools/releaseBuild/yaml/linux.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
steps:
2+
- task: PowerShell@2
3+
displayName: 'Build native assemblies for Linux'
4+
inputs:
5+
targetType: filePath
6+
filePath: ./tools/releaseBuild/vstsBuild.ps1
7+
arguments: '-Name $(LINUX_BUILDNAME) -Verbose'

‎tools/releaseBuild/yaml/mac.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
steps:
2+
- task: PowerShell@2
3+
displayName: 'Build native assemblies'
4+
inputs:
5+
targetType: filePath
6+
filePath: ./tools/releaseBuild/PowershellNative.ps1
7+
arguments: '-Arch osx -Configuration Release -RepoRoot $(Build.SourcesDirectory) -TargetLocation $(PackageRoot)'
8+
9+
- powershell: |
10+
$filePath = "$(PackageRoot)/osx-symbols.zip"
11+
Write-Verbose "Artifact to upload: $filePath" -Verbose
12+
Write-Host "##vso[artifact.upload containerfolder=release;artifactname=release]$filePath"
13+
displayName: 'Upload artifact'
14+
15+
- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
16+
displayName: 'Component Detection'
17+
inputs:
18+
sourceScanPath: '$(Build.SourcesDirectory)'

‎tools/releaseBuild/yaml/nuget.yml

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
steps:
2+
- task: DownloadPipelineArtifact@2
3+
inputs:
4+
buildType: current
5+
artifactName: release
6+
targetPath: "$(System.ArtifactsDirectory)/release"
7+
displayName: Download native packages
8+
9+
- task: DownloadPipelineArtifact@2
10+
inputs:
11+
buildType: current
12+
artifactName: signed
13+
targetPath: "$(System.ArtifactsDirectory)/signed"
14+
displayName: Download signed windows native packages
15+
16+
- powershell: |
17+
$null = New-Item $(PackageRoot) -ItemType Directory -Force -Verbose
18+
if(-not (Test-Path '$(System.ArtifactsDirectory)/release' ))
19+
{
20+
New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)/release' -Force
21+
}
22+
Invoke-WebRequest -Uri '$(PSRPBlobUrl)' -OutFile $(System.ArtifactsDirectory)/release/psrp.zip -Verbose
23+
displayName: 'Download PSRP package'
24+
25+
- powershell: 'Get-ChildItem $(System.ArtifactsDirectory)/release'
26+
displayName: 'Capture downloaded zips'
27+
28+
- powershell: |
29+
$extractedRoot = New-Item $(System.ArtifactsDirectory)/uncompressed -ItemType Directory -Force -Verbose
30+
31+
Get-ChildItem $(System.ArtifactsDirectory)/release/*.zip | ForEach-Object {
32+
$baseName = $_.BaseName
33+
if($baseName -match 'x64_arm') {
34+
Write-Verbose "Skipping expanding file $_.Name" -Verbose
35+
}
36+
else {
37+
$folderPath = Join-Path $extractedRoot $baseName
38+
Expand-Archive $_.FullName -DestinationPath $folderPath -Force
39+
}
40+
}
41+
42+
Write-Host "Extracted files:"
43+
Get-ChildItem -Recurse $extractedRoot -File
44+
displayName: 'Extract All Zips'
45+
46+
- template: compliance.yml
47+
48+
- template: upload.yml
49+
parameters:
50+
fileName: 'x64_arm64-symbols.zip'
51+
sourcePath: '$(System.ArtifactsDirectory)\release\x64_arm64-symbols.zip'
52+
- template: upload.yml
53+
parameters:
54+
fileName: 'x64-symbols.zip'
55+
sourcePath: '$(System.ArtifactsDirectory)\release\x64-symbols.zip'
56+
- template: upload.yml
57+
parameters:
58+
fileName: 'x64_arm-symbols.zip'
59+
sourcePath: '$(System.ArtifactsDirectory)\release\x64_arm-symbols.zip'
60+
- template: upload.yml
61+
parameters:
62+
fileName: 'x86-symbols.zip'
63+
sourcePath: '$(System.ArtifactsDirectory)\release\x86-symbols.zip'
64+
65+
- task: NuGetToolInstaller@0
66+
displayName: 'Install NuGet 5.3.1'
67+
inputs:
68+
versionSpec: 5.3.1
69+
70+
- powershell: |
71+
$Branch = $env:BUILD_SOURCEBRANCH
72+
$branchOnly = $Branch -replace '^refs/heads/';
73+
$branchOnly = $branchOnly -replace '[_\-]'
74+
75+
$packageVersion = if($env:PACKAGE_VERSION -eq 'fromBranch' -or !$env:PACKAGE_VERSION)
76+
{
77+
if($Branch -match '^.*(release[-/])')
78+
{
79+
Write-verbose "release branch:" -verbose
80+
$Branch -replace '^.*(release[-/]v)'
81+
}
82+
else
83+
{
84+
"0.0.0"
85+
}
86+
}
87+
else {
88+
"0.0.0"
89+
}
90+
91+
$vstsCommandString = "vso[task.setvariable variable=NugetPackageVersion]$packageVersion"
92+
Write-Verbose -Message "setting $Variable to $packageVersion" -Verbose
93+
Write-Host -Object "##$vstsCommandString"
94+
95+
displayName: Set NuGetPackageVersion
96+
97+
- powershell: |
98+
Import-Module $(Build.SourcesDirectory)\build.psm1
99+
$PackageRoot = New-Item -ItemType Directory -Path $(System.ArtifactsDirectory)\NugetPackage
100+
101+
$WindowsX64ZipPath = Join-Path "$(System.ArtifactsDirectory)/signed" 'win-x64.zip'
102+
$WindowsX86ZipPath = Join-Path "$(System.ArtifactsDirectory)/signed" 'win-x86.zip'
103+
$WindowsARMZipPath = Join-Path "$(System.ArtifactsDirectory)/signed" 'win-x64_arm.zip'
104+
$WindowsARM64ZipPath = Join-Path "$(System.ArtifactsDirectory)/signed" 'win-x64_arm64.zip'
105+
$LinuxZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'linux-x64-symbols.zip'
106+
$LinuxARMZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'linux-arm-symbols.zip'
107+
$LinuxARM64ZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'linux-arm64-symbols.zip'
108+
$LinuxAlpineZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'linux-musl-x64-symbols.zip'
109+
$macOSZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'osx-symbols.zip'
110+
$psrpZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'psrp.zip'
111+
112+
Start-BuildPowerShellNativePackage -PackageRoot $PackageRoot -Version $(NugetPackageVersion) -WindowsX64ZipPath $WindowsX64ZipPath -WindowsX86ZipPath $WindowsX86ZipPath -WindowsARMZipPath $WindowsARMZipPath -WindowsARM64ZipPath $WindowsARM64ZipPath -LinuxZipPath $LinuxZipPath -LinuxARMZipPath $LinuxARMZipPath -LinuxARM64ZipPath $LinuxARM64ZipPath -LinuxAlpineZipPath $LinuxAlpineZipPath -macOSZipPath $macOSZipPath -psrpZipPath $psrpZipPath -NuGetOutputPath $(NuGetPackagePath)
113+
114+
displayName: 'Build NuGet package'
115+
116+
- powershell: 'Get-Childitem $(NuGetPackagePath)'
117+
displayName: 'Capture nuget package'
118+
119+
- powershell: |
120+
## Get the nuget file paths
121+
$files = (Get-ChildItem $(NuGetPackagePath)\*.nupkg).FullName
122+
123+
if($files.Count -lt 1) { throw "No packages available to publish" }
124+
125+
& $(Build.SourcesDirectory)\tools\releaseBuild\generatePackgeSigning.ps1 -Path "$(NuGetPackagePath)\NugetSigning.xml" -NuPkgFiles $files
126+
127+
displayName: 'Generate signing file'
128+
129+
- powershell: 'Get-Content $(NuGetPackagePath)\NugetSigning.xml'
130+
displayName: 'Capture package signing file'
131+
132+
- task: PkgESCodeSign@10
133+
displayName: 'Package ES - CodeSign $(NuGetPackagePath)\NugetSigning.xml'
134+
env:
135+
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
136+
inputs:
137+
signConfigXml: '$(NuGetPackagePath)\NugetSigning.xml'
138+
inPathRoot: ' $(NuGetPackagePath)'
139+
outPathRoot: '$(System.ArtifactsDirectory)\signed'
140+
condition: ne(variables['SKIP_SIGNING'], 'True')
141+
142+
- powershell: |
143+
Copy-Item $(NuGetPackagePath)\*.nupkg -DestinationPath '$(System.ArtifactsDirectory)\signed' -Force -Verbose
144+
displayName: Copy unsigned nuget packge as signing is disabled
145+
condition: eq(variables['SKIP_SIGNING'], 'True')
146+
147+
- powershell: |
148+
Import-Module $env:BUILD_SOURCESDIRECTORY\build.psm1 -Force
149+
150+
$packages = Get-ChildItem -Recurse $(System.ArtifactsDirectory)\signed\*.nupkg -Verbose
151+
152+
if ($packages.Count -eq 0)
153+
{
154+
throw "No signed package found at: $(System.ArtifactsDirectory)\signed"
155+
}
156+
157+
$packages | ForEach-Object { Start-NativeExecution -sb { nuget.exe verify -All $_.FullName } }
158+
displayName: 'Validate NuGet package is signed'
159+
160+
- template: uploadArtifact.yml
161+
parameters:
162+
artifactPath: '$(System.ArtifactsDirectory)\signed'
163+
artifactFilter: 'Microsoft.PowerShell.Native.$(NugetPackageVersion).nupkg'
164+
artifactName: 'finalResults'

‎tools/releaseBuild/yaml/publish.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
parameters:
2+
stageName: ''
3+
environmentName: ''
4+
feedCredential: ''
5+
6+
stages:
7+
- stage: ${{ parameters.stageName }}
8+
displayName: Release PowerShell-Native to '${{ parameters.stageName }}'
9+
condition: and(succeeded('Build'), eq(variables['Build.Reason'], 'Manual'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'))
10+
11+
jobs:
12+
- deployment: Publish_${{ parameters.stageName }}
13+
displayName: Release to Feed
14+
pool:
15+
vmImage: windows-latest
16+
17+
environment: ${{ parameters.environmentName }}
18+
strategy:
19+
runOnce:
20+
deploy:
21+
steps:
22+
- download: current
23+
artifact: release
24+
25+
- powershell: |
26+
Get-ChildItem -Recurse "$(Pipeline.Workspace)/release"
27+
displayName: Capture downloaded artifact
28+
29+
- powershell: |
30+
Copy-Item "$(Pipeline.Workspace)/release/Microsoft.PowerShell.Native.*.nupkg" -Destination "$(Build.ArtifactStagingDirectory)" -Force
31+
Get-ChildItem "$(Build.ArtifactStagingDirectory)/Microsoft.PowerShell.Native.*.nupkg"
32+
displayName: 'Copy and Capture NuGet package'
33+
34+
- task: NuGetCommand@2
35+
displayName: 'NuGet push'
36+
inputs:
37+
command: push
38+
packagesToPush: '$(Build.ReleaseDirectory)/Microsoft.PowerShell.Native.*.nupkg'
39+
nuGetFeedType: external
40+
publishFeedCredentials: ${{ parameters.feedCredential }}

‎tools/releaseBuild/yaml/releaseBuild.yml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
variables:
2+
AuthenticodeSignType: '400'
3+
BuildConfiguration: 'Release'
4+
NuGetPackagePath: '$(System.ArtifactsDirectory)/NuGetRelease'
5+
PackageRoot: '$(System.ArtifactsDirectory)/Packages'
6+
7+
stages:
8+
- stage: Build
9+
displayName: Build Native Binaries
10+
dependsOn: []
11+
jobs:
12+
- job: BuildWin
13+
pool:
14+
name: PowerShell
15+
demands:
16+
- DotNetFramework
17+
- Agent.Image
18+
displayName: Windows
19+
strategy:
20+
matrix:
21+
x64:
22+
ARCHITECTURE: x64
23+
x86:
24+
ARCHITECTURE: x86
25+
x64ARM:
26+
ARCHITECTURE: x64_arm
27+
x64ARM64:
28+
ARCHITECTURE: x64_arm64
29+
steps:
30+
- template: windows.yml
31+
32+
- job: BuildLinux
33+
displayName: Linux
34+
pool:
35+
vmImage: ubuntu-16.04
36+
strategy:
37+
matrix:
38+
UbuntuArm:
39+
LINUX_BUILDNAME: 'ubuntu.16.04-arm'
40+
CentOS:
41+
LINUX_BUILDNAME: 'centos.7'
42+
Alpine:
43+
LINUX_BUILDNAME: 'alpine'
44+
UbuntuArm64:
45+
LINUX_BUILDNAME: 'ubuntu.16.04-arm64'
46+
steps:
47+
- template: linux.yml
48+
49+
- job: BuildMac
50+
displayName: Build Native Binaries on macOS
51+
pool: Hosted Mac Internal
52+
steps:
53+
- template: mac.yml
54+
55+
- job: BuildNuGetPkg
56+
displayName: Build NuGet Package
57+
dependsOn:
58+
- BuildWin
59+
- BuildLinux
60+
- BuildMac
61+
pool:
62+
name: PowerShell
63+
demands:
64+
- DotNetFramework
65+
- Agent.Image
66+
67+
steps:
68+
- template: nuget.yml
69+
70+
- template: publish.yml
71+
parameters:
72+
stageName: AzArtifactsFeed
73+
environmentName: PSNativeAzArtifactApproval
74+
feedCredential: AzArtifactsFeed
75+
76+
- template: publish.yml
77+
parameters:
78+
stageName: NuGet
79+
environmentName: PSNativeNuGetApproval
80+
feedCredential: PowerShellNuGetOrgPush

‎tools/releaseBuild/yaml/upload.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
parameters:
2+
fileName: ''
3+
sourcePath: ''
4+
5+
steps:
6+
- task: AzureFileCopy@2
7+
displayName: 'Upload ${{ parameters.fileName }} to azure blob'
8+
inputs:
9+
SourcePath: '${{ parameters.sourcePath }}'
10+
azureSubscription: 'MGMT-Powershell-CICDInfra (94cf12ad-4fe9-490b-b281-0a260198a4e0)'
11+
Destination: AzureBlob
12+
storage: pscoretestdata
13+
ContainerName: 'PowerShell-Native-Symbols'
14+
BlobPrefix: '$(Build.SourceBranchName)'

0 commit comments

Comments
 (0)