|
| 1 | +# Copyright (c) Microsoft Corporation. |
| 2 | +# Licensed under the MIT License. |
| 3 | + |
| 4 | +jobs: |
| 5 | +- job: APIScan |
| 6 | + displayName: APIScan with fxdependent build |
| 7 | + condition: succeeded() |
| 8 | + pool: |
| 9 | + type: windows |
| 10 | + variables: |
| 11 | + - name: runCodesignValidationInjection |
| 12 | + value : false |
| 13 | + - name: NugetSecurityAnalysisWarningLevel |
| 14 | + value: none |
| 15 | + # PAT permissions NOTE: Declare a SymbolServerPAT variable in this group with a 'microsoft' organizanization scoped PAT with 'Symbols' Read permission. |
| 16 | + # A PAT in the wrong org will give a single Error 203. No PAT will give a single Error 401, and individual pdbs may be missing even if permissions are correct. |
| 17 | + - group: symbols |
| 18 | + # Defines the variables APIScanClient, APIScanTenant and APIScanSecret |
| 19 | + - group: PS-PS-APIScan |
| 20 | + - group: DotNetPrivateBuildAccess |
| 21 | + - group: 'Azure Blob variable group' |
| 22 | + - group: ReleasePipelineSecrets |
| 23 | + - group: mscodehub-feed-read-general |
| 24 | + - group: mscodehub-feed-read-akv |
| 25 | + - name: ob_outputDirectory |
| 26 | + value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT' |
| 27 | + - name: repoRoot |
| 28 | + value: $(Build.SourcesDirectory)\AIShell |
| 29 | + - name: ob_sdl_tsa_configFile |
| 30 | + value: $(repoRoot)\.config\tsaoptions.json |
| 31 | + - name: ob_sdl_apiscan_enabled |
| 32 | + value: true |
| 33 | + - name: ob_sdl_apiscan_softwareName |
| 34 | + value: 'AIShell' |
| 35 | + - name: ob_sdl_apiscan_versionNumber |
| 36 | + value: '1.0' |
| 37 | + - name: ob_sdl_apiscan_isLargeApp |
| 38 | + value: false |
| 39 | + - name: ob_sdl_apiscan_symbolsFolder |
| 40 | + value: $(SymbolsServerUrl);$(ob_outputDirectory) |
| 41 | + - name: Codeql.SourceRoot |
| 42 | + value: $(repoRoot) |
| 43 | + |
| 44 | + # APIScan can take a long time |
| 45 | + timeoutInMinutes: 180 |
| 46 | + |
| 47 | + steps: |
| 48 | + - checkout: self |
| 49 | + clean: true |
| 50 | + fetchTags: true |
| 51 | + fetchDepth: 1000 |
| 52 | + displayName: Checkout AIShell |
| 53 | + retryCountOnTaskFailure: 1 |
| 54 | + env: |
| 55 | + ob_restore_phase: true # This ensures checkout is done at the beginning of the restore phase |
| 56 | + |
| 57 | + - template: update-nuget-config.yml@self |
| 58 | + parameters: |
| 59 | + repoRoot: $(repoRoot) |
| 60 | + |
| 61 | + - task: UseDotNet@2 |
| 62 | + displayName: 'Use .NET Core sdk' |
| 63 | + inputs: |
| 64 | + useGlobalJson: true |
| 65 | + packageType: 'sdk' |
| 66 | + workingDirectory: $(Build.SourcesDirectory)" |
| 67 | + |
| 68 | + - pwsh: | |
| 69 | + dotnet tool install dotnet-symbol --tool-path $(Agent.ToolsDirectory)\tools\dotnet-symbol |
| 70 | + $symbolToolPath = Get-ChildItem -Path $(Agent.ToolsDirectory)\tools\dotnet-symbol\dotnet-symbol.exe | Select-Object -First 1 -ExpandProperty FullName |
| 71 | + Write-Host "##vso[task.setvariable variable=symbolToolPath]$symbolToolPath" |
| 72 | + displayName: Install dotnet-symbol |
| 73 | + workingDirectory: '$(repoRoot)' |
| 74 | + retryCountOnTaskFailure: 2 |
| 75 | +
|
| 76 | + - task: AzurePowerShell@5 |
| 77 | + displayName: Download winverify-private Artifacts |
| 78 | + inputs: |
| 79 | + azureSubscription: az-blob-cicd-infra |
| 80 | + scriptType: inlineScript |
| 81 | + azurePowerShellVersion: LatestVersion |
| 82 | + workingDirectory: '$(repoRoot)' |
| 83 | + pwsh: true |
| 84 | + inline: | |
| 85 | + # download smybols for getfilesiginforedist.dll |
| 86 | + $storageAccountName = "pscoretestdata" |
| 87 | + $containerName = 'winverify-private' |
| 88 | + $winverifySymbolsPath = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)/winverify-symbols' -Force |
| 89 | + $dllName = 'getfilesiginforedist.dll' |
| 90 | + $winverifySymbolsDllPath = Join-Path $winverifySymbolsPath $dllName |
| 91 | +
|
| 92 | + $context = New-AzStorageContext -StorageAccountName $storageAccountName -UseConnectedAccount |
| 93 | + Get-AzStorageBlobContent -Container $containerName -Blob $dllName -Destination $winverifySymbolsDllPath -Context $context |
| 94 | +
|
| 95 | + - pwsh: | |
| 96 | + Get-ChildItem -Path '$(System.ArtifactsDirectory)/winverify-symbols' |
| 97 | + displayName: Capture winverify-private Artifacts |
| 98 | + workingDirectory: '$(repoRoot)' |
| 99 | + condition: succeededOrFailed() |
| 100 | +
|
| 101 | + - task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step. |
| 102 | + displayName: 🔏 CodeQL 3000 Init |
| 103 | + condition: eq(variables['CODEQL_ENABLED'], 'true') |
| 104 | + inputs: |
| 105 | + Language: csharp |
| 106 | + |
| 107 | + - pwsh: | |
| 108 | + Import-Module $(repoRoot)/build.psm1 -Force |
| 109 | + Start-Build -Configuration StaticAnalysis -Runtime fxdependent -Clean -Verbose |
| 110 | +
|
| 111 | + $outputJson = '$(repoRoot)/_build_output_.json' |
| 112 | + if (-not (Test-Path $outputJson)) { |
| 113 | + throw "'_build_output_.json' was not produced." |
| 114 | + } |
| 115 | +
|
| 116 | + $result = Get-Content $outputJson | ConvertFrom-Json |
| 117 | + Write-Verbose "App path: $($result.App)" -Verbose |
| 118 | + $OutputFolder = $result.App |
| 119 | +
|
| 120 | + Write-Verbose -Verbose -Message "Deleting ref folder from output folder" |
| 121 | + if (Test-Path $OutputFolder/ref) { |
| 122 | + Remove-Item -Recurse -Force $OutputFolder/ref |
| 123 | + } |
| 124 | +
|
| 125 | + Copy-Item -Path "$OutputFolder\*" -Destination '$(ob_outputDirectory)' -Recurse -Verbose |
| 126 | + workingDirectory: '$(repoRoot)' |
| 127 | + displayName: 'Build AIShell Source' |
| 128 | +
|
| 129 | + - pwsh: | |
| 130 | + # Only key windows runtimes |
| 131 | + Get-ChildItem -Path '$(ob_outputDirectory)\runtimes\*' -File -Recurse | Where-Object {$_.FullName -notmatch '.*\/runtimes\/win'} | Foreach-Object { |
| 132 | + Write-Verbose -Verbose -Message "Deleting $($_.FullName)" |
| 133 | + Remove-Item -Force -Verbose -Path $_.FullName |
| 134 | + } |
| 135 | +
|
| 136 | + # Temporarily remove runtimes/win-x86 due to issues with that runtime |
| 137 | + Get-ChildItem -Path '$(ob_outputDirectory)\runtimes\*' -File -Recurse | Where-Object {$_.FullName -match '.*\/runtimes\/win-x86\/'} | Foreach-Object { |
| 138 | + Write-Verbose -Verbose -Message "Deleting $($_.FullName)" |
| 139 | + Remove-Item -Force -Verbose -Path $_.FullName |
| 140 | + } |
| 141 | +
|
| 142 | + workingDirectory: '$(repoRoot)' |
| 143 | + displayName: 'Remove unused runtimes' |
| 144 | +
|
| 145 | + - task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step. |
| 146 | + displayName: 🔏 CodeQL 3000 Finalize |
| 147 | + condition: eq(variables['CODEQL_ENABLED'], 'true') |
| 148 | + |
| 149 | + - pwsh: | |
| 150 | + Get-ChildItem -Path env: | Out-String -width 150 -Stream | write-Verbose -Verbose |
| 151 | + workingDirectory: '$(repoRoot)' |
| 152 | + displayName: Capture Environment |
| 153 | + condition: succeededOrFailed() |
| 154 | +
|
| 155 | + # Explicitly download symbols for the drop since the SDL image doesn't have http://SymWeb access and APIScan cannot handle https yet. |
| 156 | + - pwsh: | |
| 157 | + $pat = '$(SymbolServerPAT)' |
| 158 | + if ($pat -like '*PAT*' -or $pat -eq '') { |
| 159 | + throw 'No PAT defined' |
| 160 | + } |
| 161 | + $url = 'https://microsoft.artifacts.visualstudio.com/defaultcollection/_apis/symbol/symsrv' |
| 162 | + $(symbolToolPath) --authenticated-server-path $(SymbolServerPAT) $url --symbols -d "$env:ob_outputDirectory\*" --recurse-subdirectories |
| 163 | + displayName: 'Download Symbols for binaries' |
| 164 | + retryCountOnTaskFailure: 2 |
| 165 | + workingDirectory: '$(repoRoot)' |
| 166 | +
|
| 167 | + - pwsh: | |
| 168 | + Get-ChildItem '$(ob_outputDirectory)' -File -Recurse | |
| 169 | + Foreach-Object { |
| 170 | + [pscustomobject]@{ |
| 171 | + Path = $_.FullName |
| 172 | + Version = $_.VersionInfo.FileVersion |
| 173 | + Md5Hash = (Get-FileHash -Algorithm MD5 -Path $_.FullName).Hash |
| 174 | + Sha512Hash = (Get-FileHash -Algorithm SHA512 -Path $_.FullName).Hash |
| 175 | + } |
| 176 | + } | Export-Csv -Path '$(Build.SourcesDirectory)/ReleaseFileHash.csv' |
| 177 | + workingDirectory: '$(repoRoot)' |
| 178 | + displayName: 'Create release file hash artifact' |
| 179 | +
|
| 180 | + - pwsh: | |
| 181 | + Copy-Item -Path '$(Build.SourcesDirectory)/ReleaseFileHash.csv' -Destination '$(ob_outputDirectory)' -Verbose |
| 182 | + displayName: 'Publish Build File Hash artifact' |
| 183 | +
|
| 184 | + - pwsh: | |
| 185 | + Get-ChildItem -Path env: | Out-String -width 150 -Stream | write-Verbose -Verbose |
| 186 | + displayName: Capture Environment |
| 187 | + condition: succeededOrFailed() |
| 188 | + workingDirectory: '$(repoRoot)' |
0 commit comments