azure-pipelines.yml

variables:
  # Cannot use key:value syntax in root defined variables
  - name: _TeamName
    value: DotNetCore
  - name: _PublishUsingPipelines
    value: true
  - name: _DotNetArtifactsCategory
    value: .NETCore
  - name: skipComponentGovernanceDetection
    value: true
  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
    - group: SDL_Settings

# CI and PR triggers
trigger:
  batch: true
  branches:
    include:
    - master
    - production
pr:
- master
- production

stages:
- stage: build
  displayName: Build  
  # Three phases for each of the three OSes we want to run on
  jobs:
  - template: /eng/common/templates/jobs/jobs.yml
    parameters:
      enableMicrobuild: false
      enablePublishBuildArtifacts: true
      enablePublishTestResults: false
      enablePublishBuildAssets: true
      enablePublishUsingPipelines: ${{ variables._PublishUsingPipelines }}
      enableTelemetry: true
      helixRepo: dotnet/arcade-services
      jobs:
      - job: Windows_NT
        timeoutInMinutes: 90
        pool:
          vmImage: windows-2019

        variables:
        - _InternalBuildArgs: ''
        - _ProductionArgs: ''

        # Only enable publishing in non-public, non PR scenarios.
        - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
          # DotNet-Blob-Feed provides: dotnetfeed-storage-access-key-1
          # DotNet-Symbol-Server-Pats provides: microsoft-symbol-server-pat, symweb-symbol-server-pat
          # Publish-Build-Assets provides: MaestroAccessToken, BotAccount-dotnet-maestro-bot-PAT
          - group: DotNet-Blob-Feed
          - group: DotNet-Symbol-Server-Pats
          - group: Publish-Build-Assets
          - _PublishBlobFeedUrl: https://dotnetfeed.blob.core.windows.net/dotnet-core/index.json
          - _InternalBuildArgs: /p:DotNetSignType=$(_SignType) /p:TeamName=$(_TeamName)
              /p:DotNetPublishBlobFeedKey=$(dotnetfeed-storage-access-key-1)
              /p:DotNetPublishBlobFeedUrl=$(_PublishBlobFeedUrl)
              /p:DotNetPublishToBlobFeed=$(_DotNetPublishToBlobFeed)
              /p:DotNetPublishUsingPipelines=$(_PublishUsingPipelines)
              /p:DotNetArtifactsCategory=$(_DotNetArtifactsCategory)
              /p:DotNetSymbolServerTokenMsdl=$(microsoft-symbol-server-pat)
              /p:DotNetSymbolServerTokenSymWeb=$(symweb-symbol-server-pat)
              /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
        # In production, create stable package versions
        # TODO: We depend on a prerelease version of Microsoft.TeamFoundationServer.Client
        # https://github.com/dotnet/arcade-services/issues/59
        # and so we can't stabilize for right now.
        # - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['Build.SourceBranchName'], 'production')) }}:
            # - _ProductionArgs: /p:DotNetFinalVersionKind=release
              
        strategy:
          matrix:
            # Only build debug in non-official builds
            ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
                debug_configuration:
                  _BuildConfig: Debug
                  _PublishType: none
                  _SignType: test
                  _DotNetPublishToBlobFeed : false
            release_configuration:
              _BuildConfig: Release
              # PRs or external builds are not signed.
              ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
                _PublishType: none
                _SignType: test
                _DotNetPublishToBlobFeed : false
              ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
                _PublishType: blob
                _SignType: test
                _DotNetPublishToBlobFeed : true
        steps:
        - checkout: self
          clean: true

        - task: UseDotNet@2
          displayName: Install Correct .NET Version
          inputs:
            useGlobalJson: true

        - task: NuGetToolInstaller@0
          inputs:
            versionSpec: 5.5.x

        - task: NodeTool@0
          inputs:
            versionSpec: 12.x

        - task: NuGetCommand@2
          displayName: Restore Packages
          inputs:
            command: restore
            solution: "**/*.sln"
            feedstoUse: config

        - powershell: eng\set-version-parameters.ps1
          displayName: Calculate release version variables

        - powershell: |
            [xml]$manifest = Get-Content src\Maestro\MaestroApplication\ApplicationPackageRoot\ApplicationManifest.xml
            $manifest.SelectSingleNode("/*[local-name()='ApplicationManifest']/*[local-name()='Policies']").RemoveAll()
            $manifest.SelectSingleNode("/*[local-name()='ApplicationManifest']/*[local-name()='Principals']").RemoveAll()
            $manifest.Save("src\Maestro\MaestroApplication\ApplicationPackageRoot\ApplicationManifest.xml")
            git diff
          displayName: Remove Service Fabric RunAsPolicy

        - script: eng\common\cibuild.cmd
            -configuration $(_BuildConfig)
            -prepareMachine
            $(_InternalBuildArgs)
            $(_ProductionArgs)
            /p:Test=false
            /P:Sign=false
          name: Build
          displayName: Build / Publish
          condition: succeeded()

        - task: ComponentGovernanceComponentDetection@0
          inputs:
            # `.packages` directory is used by some tools running during build.
            # By default ComponentDetection scans this directory and sometimes reports
            # vulnerabilities for packages that are not part of the published product.
            # We can ignore this directory because actual vulnerabilities
            # that we are interested in will be found by the tool
            # when scanning .csproj and package.json files.
            ignoreDirectories: '.packages'

        - template: /eng/test.yaml

        - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
        
          ## Prepare service fabric artifact
          - task: ServiceFabricUpdateManifests@2
            inputs:
              applicationPackagePath: $(Build.ArtifactStagingDirectory)\ServiceFabric\MaestroApplication\applicationpackage

          - powershell: |
              robocopy src/Maestro/MaestroApplication/PublishProfiles $(Build.ArtifactStagingDirectory)\ServiceFabric\MaestroApplication\projectartifacts\PublishProfiles /S *.xml
              robocopy src/Maestro/MaestroApplication/ApplicationParameters $(Build.ArtifactStagingDirectory)\ServiceFabric\MaestroApplication\projectartifacts\ApplicationParameters /S *.xml
              robocopy src/Maestro/MaestroApplication/ApplicationPackageRoot $(Build.ArtifactStagingDirectory)\ServiceFabric\MaestroApplication\projectartifacts\ApplicationPackageRoot /S *.xml
              exit 0
            displayName: Copy Maestro Project Artifacts

          - publish: $(Build.ArtifactStagingDirectory)\ServiceFabric\MaestroApplication
            artifact: MaestroApplication
            displayName: Publish MaestroApplication
            
          - task: ServiceFabricUpdateManifests@2
            inputs:
              applicationPackagePath: $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication\applicationpackage

          - powershell: |
              robocopy src/Telemetry/TelemetryApplication/PublishProfiles $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication\projectartifacts\PublishProfiles /S *.xml
              robocopy src/Telemetry/TelemetryApplication/ApplicationParameters $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication\projectartifacts\ApplicationParameters /S *.xml
              robocopy src/Telemetry/TelemetryApplication/ApplicationPackageRoot $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication\projectartifacts\ApplicationPackageRoot /S *.xml
              exit 0
            displayName: Copy Telemetry Project Artifacts

          - publish: $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication
            artifact: TelemetryApplication
            displayName: Publish TelemetryApplication

          - script: $(Build.SourcesDirectory)\.dotnet\dotnet publish -o $(Build.ArtifactStagingDirectory)\DotNet.Status.Web\publish -f netcoreapp3.1
            workingDirectory: src/DotNet.Status.Web
            displayName: dotnet publish DotNet.Status.Web

          - task: ArchiveFiles@2
            inputs:
              rootFolderOrFile: $(Build.ArtifactStagingDirectory)/DotNet.Status.Web/publish
              includeRootFolder: false
              archiveType: zip
              archiveFile: $(Build.ArtifactStagingDirectory)/DotNet.Status.Web/package/DotNetStatus.zip
              replaceExistingArchive: true

          - publish: $(Build.ArtifactStagingDirectory)/DotNet.Status.Web/package
            artifact: DotNetStatus
            displayName: Publish DotNet.Status.Web

          - script: $(Build.SourcesDirectory)\.dotnet\dotnet publish -o $(Build.ArtifactStagingDirectory)\RolloutScorerAzureFunction\publish -f netcoreapp3.1
            workingDirectory: src/RolloutScorer/RolloutScorerAzureFunction
            displayName: dotnet publish RolloutScorerAzureFunction

          - task: ArchiveFiles@2
            inputs:
              rootFolderOrFile: $(Build.ArtifactStagingDirectory)/RolloutScorerAzureFunction/publish
              includeRootFolder: false
              archiveType: zip
              archiveFile: $(Build.ArtifactStagingDirectory)/RolloutScorerAzureFunction/package/RolloutScorer.zip
              replaceExistingArchive: true

          - publish: $(Build.ArtifactStagingDirectory)/RolloutScorerAzureFunction/package
            artifact: RolloutScorer
            displayName: Publish RolloutScorerAzureFunction
          
          ## Prepare database update artifact
          - script: $(Build.SourcesDirectory)\.dotnet\dotnet publish -o $(Build.ArtifactStagingDirectory)\Maestro.Data -f netcoreapp3.1
            workingDirectory: src/Maestro/Maestro.Data
            displayName: Create Data Package
            
          - task: CopyFiles@2
            displayName: Copy update-database.ps1
            inputs:
              sourceFolder: $(Build.SourcesDirectory)\src\Maestro
              contents: update-database.ps1 
              targetFolder: $(Build.ArtifactStagingDirectory)\Maestro.Data\
            
          - task: PublishBuildArtifacts@1
            displayName: Publish Maestro.Data Artifact
            inputs:
              PathtoPublish: $(Build.ArtifactStagingDirectory)\Maestro.Data
              ArtifactName: Maestro.Data
              ArtifactType: Container
          
          ## Prepare release utilities artifact
          - task: CopyFiles@2
            displayName: Prepare Release Utilities
            inputs:
              sourceFolder: $(Build.SourcesDirectory)\eng
              contents: '*'
              targetFolder: $(Build.ArtifactStagingDirectory)\eng
              
          - publish: $(Build.ArtifactStagingDirectory)\eng
            artifact: ReleaseUtilities
            displayName: Publish Release Utilities Artifact

          - publish: $(Build.SourcesDirectory)\artifacts\bin\Maestro.ScenarioTests\$(_BuildConfig)\netcoreapp3.1\publish
            artifact: Maestro.ScenarioTests

          # Reenable tagging when stable package versions can be generated.
          # https://github.com/dotnet/arcade-services/issues/59
          # - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['Build.SourceBranchName'], 'production')) }}:
            # - powershell: eng\create-tag.ps1 -AccessToken $(System.AccessToken)

- ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
  - template: eng\common\templates\post-build\post-build.yml
    parameters:
      # Symbol validation isn't being very reliable lately. This should be enabled back
      # once this issue is resolved: https://github.com/dotnet/arcade/issues/2871
      enableSymbolValidation: false
      enableSigningValidation: false
      # This is to enable SDL runs part of Post-Build Validation Stage
      SDLValidationParameters:
        enable: true
        params: '-SourceToolsList @("policheck","credscan")
        -TsaInstanceURL $(_TsaInstanceURL)
        -TsaProjectName $(_TsaProjectName)
        -TsaNotificationEmail $(_TsaNotificationEmail)
        -TsaCodebaseAdmin $(_TsaCodebaseAdmin)
        -TsaBugAreaPath $(_TsaBugAreaPath)
        -TsaIterationPath $(_TsaIterationPath)
        -TsaRepositoryName "Arcade-Services"
        -TsaCodebaseName "Arcade-Services"
        -TsaPublish $True'
- ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), in(variables['Build.SourceBranch'], 'refs/heads/master', 'refs/heads/production'))}}:
  - template: eng\deploy.yaml
    parameters:
      ${{ if ne(variables['Build.SourceBranch'], 'refs/heads/production') }}:
        DeploymentEnvironment: Staging
        DotNetStatusAppName: dotneteng-status-staging
        DotNetStatusEndpoint: .NET Engineering Deployment Notification - Staging
        MaestroPublishEndpoint: https://maestro-prod.westus2.cloudapp.azure.com
        MaestroTestEndpoint: https://maestro-int.westus2.cloudapp.azure.com
        PublishProfile: Int
        RolloutScorerAppName: rollout-scorer-int
        ServiceFabricConnection: Maestro-Int
        Subscription: NetHelixStaging
        VariableGroup: MaestroInt KeyVault
        StatusVariableGroup: DotNetStatus Staging
        GrafanaHost: https://dotnet-eng-grafana-staging.westus2.cloudapp.azure.com
        GrafanaKeyVault: dotnet-grafana-staging
        GrafanaVariableGroup: Dotnet-Grafana-Staging
      ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/production') }}:
        DeploymentEnvironment: Production
        DotNetStatusAppName: dotneteng-status
        DotNetStatusEndpoint: .NET Engineering Deployment Notification - Production
        MaestroPublishEndpoint: https://maestro-prod.westus2.cloudapp.azure.com
        MaestroTestEndpoint: https://maestro-prod.westus2.cloudapp.azure.com
        PublishProfile: Prod
        RolloutScorerAppName: rollout-scorer-prod
        ServiceFabricConnection: Maestro-Prod
        Subscription: NetHelix
        VariableGroup: MaestroProd KeyVault
        StatusVariableGroup: DotNetStatus Production
        GrafanaHost: https://dotnet-eng-grafana.westus2.cloudapp.azure.com
        GrafanaKeyVault: dotnet-grafana
        GrafanaVariableGroup: Dotnet-Grafana-Production