azure-pipelines.yml

# Setting batch to true, triggers one build at a time.
# if there is a push while a build in progress, it will wait,
# until the running build finishes, and produce a build with all the changes
# that happened during the last build.
trigger:
  batch: true
  branches:
    include:
      - main
      - dev
      - release/*
      - internal/release/*
  paths:
    include:
      - '*'
    exclude:
      - eng/Version.Details.xml
      - .github/*
      - docs/*
      - CODE_OF_CONDUCT.md
      - CONTRIBUTING.md
      - README.md
      - SECURITY.md
      - LICENSE.TXT
      - PATENTS.TXT
      - THIRD-PARTY-NOTICES.TXT

pr:
  branches:
    include:
      - main
      - dev
      - release/*
      - internal/release/*
  paths:
    include:
      - '*'
    exclude:
      - eng/Version.Details.xml
      - .github/*
      - docs/*
      - CODE_OF_CONDUCT.md
      - CONTRIBUTING.md
      - README.md
      - SECURITY.md
      - LICENSE.TXT
      - PATENTS.TXT
      - THIRD-PARTY-NOTICES.TXT

variables:
  - name: _TeamName
    value: dotnet-r9
  - name: NativeToolsOnMachine
    value: true
  - name: DOTNET_SKIP_FIRST_TIME_EXPERIENCE
    value: true

  - name: SkipQualityGates
    value: false

  - name: runAsPublic
    value: ${{ eq(variables['System.TeamProject'], 'public') }}

  - name: _BuildConfig
    value: Release
  - name: isOfficialBuild
    value: ${{ and(ne(variables['runAsPublic'], 'true'), notin(variables['Build.Reason'], 'PullRequest')) }}
  - name: Build.Arcade.ArtifactsPath
    value: $(Build.SourcesDirectory)/artifacts/
  - name: Build.Arcade.LogsPath
    value: $(Build.Arcade.ArtifactsPath)log/$(_BuildConfig)/
  - name: Build.Arcade.TestResultsPath
    value: $(Build.Arcade.ArtifactsPath)TestResults/$(_BuildConfig)/
  - name: Build.Arcade.VSIXOutputPath
    value: $(Build.Arcade.ArtifactsPath)VSIX

  - ${{ if or(startswith(variables['Build.SourceBranch'], 'refs/heads/release/'), startswith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'), eq(variables['Build.Reason'], 'Manual')) }}:
    - name: PostBuildSign
      value: false
  - ${{ else }}:
    - name: PostBuildSign
      value: true

  # Produce test-signed build for PR and Public builds
  - ${{ if or(eq(variables['runAsPublic'], 'true'), eq(variables['Build.Reason'], 'PullRequest')) }}:
    # needed for darc (dependency flow) publishing
    - name: _PublishArgs
      value: ''
    - name: _OfficialBuildIdArgs
      value: ''
    # needed for signing
    - name: _SignType
      value: test
    - name: _SignArgs
      value: ''
    - name: _Sign
      value: false

  # Set up non-PR build from internal project
  - ${{ if and(ne(variables['runAsPublic'], 'true'), ne(variables['Build.Reason'], 'PullRequest')) }}:
    # needed for darc (dependency flow) publishing
    - name: _PublishArgs
      value: >-
            /p:DotNetPublishUsingPipelines=true
    - name: _OfficialBuildIdArgs
      value: /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
    # needed for signing
    - name: _SignType
      value: real
    - name: _SignArgs
      value: /p:DotNetSignType=$(_SignType) /p:TeamName=$(_TeamName) /p:Sign=$(_Sign) /p:DotNetPublishUsingPipelines=true
    - name: _Sign
      value: true

  # Enable source index only for main branch builds
  - ${{ if and(ne(variables['runAsPublic'], 'true'), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['Build.SourceBranch'], 'refs/heads/main')) }}:
    - name: enableSourceIndex
      value: true
  - ${{ else }}:
    - name: enableSourceIndex
      value: false

resources:
  repositories:
  - repository: 1ESPipelineTemplates
    type: git
    name: 1ESPipelineTemplates/1ESPipelineTemplates
    ref: refs/tags/release

extends:
  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
  parameters:
    sdl:
      policheck:
        enabled: true
        exclusionsFile: $(Build.SourcesDirectory)\.config\PoliCheckExclusions.xml
      sourceAnalysisPool:
        name: NetCore1ESPool-Internal
        image: windows.vs2022preview.amd64
        os: windows
      tsa:
        enabled: true
    customBuildTags:
    - ES365AIMigrationTooling

    stages:
    - stage: build
      displayName: Build
      variables:
      - template: /eng/common/templates-official/variables/pool-providers.yml@self
      jobs:
      - template: /eng/common/templates-official/jobs/jobs.yml@self
        parameters:
          enableMicrobuild: true
          enableTelemetry: true
          enableSourceIndex: ${{ variables['enableSourceIndex'] }}
          runAsPublic: ${{ variables['runAsPublic'] }}
          # Publish build logs
          enablePublishBuildArtifacts: true
          # Publish test logs
          enablePublishTestResults: true
          # Publish NuGet packages using v3
          # https://github.com/dotnet/arcade/blob/main/Documentation/CorePackages/Publishing.md#basic-onboarding-scenario-for-new-repositories-to-the-current-publishing-version-v3
          enablePublishUsingPipelines: true
          enablePublishBuildAssets: true
          workspace:
            clean: all

          jobs:

          # ----------------------------------------------------------------
          # This job build and run tests on Windows
          # ----------------------------------------------------------------
          - job: Windows
            timeoutInMinutes: 180
            testResultsFormat: VSTest
            pool:
              name: NetCore1ESPool-Internal
              image: windows.vs2022preview.amd64
              os: windows

            variables:
            - _buildScript: $(Build.SourcesDirectory)/build.cmd -ci -NativeToolsOnMachine

            templateContext:
              outputs:
              - output: pipelineArtifact
                displayName: 'Publish Azure DevOps extension artifacts'
                condition: succeeded()
                targetPath: '$(Build.Arcade.VSIXOutputPath)'
                artifactName: 'VSIXArtifacts'

            preSteps:
            - checkout: self
              clean: true
              persistCredentials: true
              fetchDepth: 1

            steps:
            - template: /eng/pipelines/templates/BuildAndTest.yml
              parameters:
                buildScript: $(_buildScript)
                buildConfig: $(_BuildConfig)
                repoLogPath: $(Build.Arcade.LogsPath)
                repoTestResultsPath: $(Build.Arcade.TestResultsPath)
                skipQualityGates: ${{ eq(variables['SkipQualityGates'], 'true') }}
                isWindows: true
                warnAsError: 0

          # ----------------------------------------------------------------
          # This job build and run tests on Ubuntu
          # ----------------------------------------------------------------
          - job: Ubuntu
            timeoutInMinutes: 180
            testResultsFormat: VSTest
            pool:
              name: NetCore1ESPool-Internal
              image: 1es-mariner-2
              os: linux

            variables:
            - _buildScript: $(Build.SourcesDirectory)/build.sh --ci

            preSteps:
            - checkout: self
              clean: true
              persistCredentials: true
              fetchDepth: 1

            steps:
            - template: /eng/pipelines/templates/BuildAndTest.yml
              parameters:
                buildScript: $(_buildScript)
                buildConfig: $(_BuildConfig)
                repoLogPath: $(Build.Arcade.LogsPath)
                repoTestResultsPath: $(Build.Arcade.TestResultsPath)
                skipQualityGates: ${{ eq(variables['SkipQualityGates'], 'true') }}
                isWindows: false
                warnAsError: 0

    # ----------------------------------------------------------------
    # This stage performs quality gates enforcements
    # ----------------------------------------------------------------
    - stage: codecoverage
      displayName: CodeCoverage
      dependsOn:
      - build
      condition: and(succeeded('build'), ne(variables['SkipQualityGates'], 'true'))
      variables:
      - template: /eng/common/templates-official/variables/pool-providers.yml@self
      jobs:
      - template: /eng/common/templates-official/jobs/jobs.yml@self
        parameters:
          enableMicrobuild: true
          enableTelemetry: true
          runAsPublic: ${{ variables['runAsPublic'] }}
          workspace:
            clean: all

          # ----------------------------------------------------------------
          # This stage downloads the code coverage reports from the build jobs,
          # merges those and validates the combined test coverage.
          # ----------------------------------------------------------------
          jobs:
          - job: CodeCoverageReport
            timeoutInMinutes: 180

            pool:
              name: NetCore1ESPool-Internal
              image: 1es-mariner-2
              os: linux

            preSteps:
            - checkout: self
              clean: true
              persistCredentials: true
              fetchDepth: 1

            steps:
            - script: $(Build.SourcesDirectory)/build.sh --ci --restore
              displayName: Init toolset

            - template: /eng/pipelines/templates/VerifyCoverageReport.yml


    # ----------------------------------------------------------------
    # This stage only performs a build treating warnings as errors
    # to detect any kind of code style violations
    # ----------------------------------------------------------------
    - stage: correctness
      displayName: Correctness
      dependsOn: []
      variables:
      - template: /eng/common/templates-official/variables/pool-providers.yml@self
      jobs:
      - template: /eng/common/templates-official/jobs/jobs.yml@self
        parameters:
          enableMicrobuild: true
          enableTelemetry: true
          runAsPublic: ${{ variables['runAsPublic'] }}
          workspace:
            clean: all

          jobs:
          - job: WarningsCheck
            timeoutInMinutes: 180

            pool:
              ${{ if eq(variables['runAsPublic'], 'true') }}:
              name: NetCore1ESPool-Internal
              image: 1es-mariner-2
              os: linux

            variables:
            - _buildScript: $(Build.SourcesDirectory)/build.sh --ci

            preSteps:
            - checkout: self
              clean: true
              persistCredentials: true
              fetchDepth: 1

            steps:
            - template: '\eng\pipelines\templates\BuildAndTest.yml'
              parameters:
                buildScript: $(_buildScript)
                buildConfig: $(_BuildConfig)
                repoLogPath: $(Build.Arcade.LogsPath)
                repoTestResultsPath: $(Build.Arcade.TestResultsPath)
                skipTests: true
                skipQualityGates: true
                isWindows: false


    # Publish and validation steps. Only run in official builds
    - ${{ if and(ne(variables['runAsPublic'], 'true'), notin(variables['Build.Reason'], 'PullRequest')) }}:
      - template: /eng/common/templates-official/post-build/post-build.yml@self
        parameters:
          validateDependsOn:
          - build
          - codecoverage
          - correctness
          publishingInfraVersion: 3
          enableSymbolValidation: false
          enableSigningValidation: false
          enableNugetValidation: false
          enableSourceLinkValidation: false
          # these param values come from the DotNet-Winforms-SDLValidation-Params azdo variable group
          SDLValidationParameters:
            enable: false
            params: ' -SourceToolsList $(_TsaSourceToolsList)
              -TsaInstanceURL $(_TsaInstanceURL)
              -TsaProjectName $(_TsaProjectName)
              -TsaNotificationEmail $(_TsaNotificationEmail)
              -TsaCodebaseAdmin $(_TsaCodebaseAdmin)
              -TsaBugAreaPath $(_TsaBugAreaPath)
              -TsaIterationPath $(_TsaIterationPath)
              -TsaRepositoryName $(_TsaRepositoryName)
              -TsaCodebaseName $(_TsaCodebaseName)
              -TsaOnboard $(_TsaOnboard)
              -TsaPublish $(_TsaPublish)'