.vsts-ci.yml

# Pipeline: https://dev.azure.com/dnceng/internal/_build?definitionId=286

trigger:
  batch: true
  branches:
    include:
    - main
    - release/10.0.1xx-*
    - internal/release/*
    - exp/*

pr:
  branches:
    include:
    - main
    - release/*
    - internal/release/*

parameters:
# When true, runs the pipeline in the same way as the PR pipeline.
- name: runTestBuild
  displayName: Run A Test Build
  type: boolean
  default: false
- name: enableArm64Job
  displayName: Enables the ARM64 job
  type: boolean
  default: false

variables:
- template: /eng/pipelines/templates/variables/sdk-defaults.yml
# Variables used: DncEngInternalBuildPool
- template: /eng/common/templates-official/variables/pool-providers.yml
# Helix testing requires a token when internally run.
# Variables used: HelixApiAccessToken
- group: DotNet-HelixApi-Access
- group: AzureDevOps-Artifact-Feeds-Pats
# Allows Arcade to run a signed build by disabling post-build signing for release-branch builds or manual builds that are not running tests.
- ${{ if and(eq(parameters.runTestBuild, false), or(startswith(variables['Build.SourceBranch'], 'refs/heads/release/'), startswith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'), eq(variables['Build.Reason'], 'Manual'))) }}:
  - name: PostBuildSign
    value: false
# Provides TSA variables for automatic bug reporting.
- ${{ if ne(variables['Build.Reason'], 'PullRequest') }}:
  - group: DotNet-CLI-SDLValidation-Params
### LOCAL ONLY ###
- name: _publishArgument
  value: -publish
- name: _signArgument
  value: -sign /p:SignCoreSdk=true
- name: _officialBuildProperties
  # The OfficialBuilder property is set to Microsoft for the official build only.
  # This property is checked in Directory.Build.props and adds the MICROSOFT_ENABLE_TELEMETRY constant.
  # This constant is used in CompileOptions.cs to set both TelemetryOptOutDefault and TelemetryOptOutDefaultString.
  value: /p:DotNetPublishUsingPipelines=true /p:OfficialBuilder=Microsoft /p:OfficialBuildId=$(Build.BuildNumber)

resources:
  repositories:
  - repository: 1esPipelines
    type: git
    name: 1ESPipelineTemplates/1ESPipelineTemplates
    ref: refs/tags/release

extends:
  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
  parameters:
    containers:
      alpine319WithNode:
        image: mcr.microsoft.com/dotnet-buildtools/prereqs:alpine-3.19-WithNode
      centosStream9:
        image: mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream9
      debian12Amd64:
        image: mcr.microsoft.com/dotnet-buildtools/prereqs:debian-12-gcc14-amd64
      fedora39:
        image: mcr.microsoft.com/dotnet-buildtools/prereqs:fedora-39
      mariner20CrossArm:
        image: mcr.microsoft.com/dotnet-buildtools/prereqs:cbl-mariner-2.0-cross-arm
    sdl:
      sourceAnalysisPool:
        name: $(DncEngInternalBuildPool)
        image: 1es-windows-2022
        os: windows
      policheck:
        enabled: true
      tsa:
        enabled: true
      binskim:
        enabled: true
      ${{ if or(eq(parameters.runTestBuild, true), eq(variables['Build.Reason'], 'PullRequest')) }}:
        componentgovernance:
          # Refdoc: https://docs.opensource.microsoft.com/tools/cg/component-detection/variables/
          ignoreDirectories: artifacts, .packages

    stages:
    ############### BUILD STAGE ###############
    - stage: build
      displayName: Build
      jobs:
      ############### WINDOWS ###############
      - template: /eng/pipelines/templates/jobs/sdk-job-matrix.yml@self
        parameters:
          pool:
            name: $(DncEngInternalBuildPool)
            image: windows.vs2022.amd64
            os: windows
          helixTargetQueue: windows.amd64.vs2022.pre
          oneESCompat:
            templateFolderName: templates-official
            publishTaskPrefix: 1ES.
          runtimeSourceProperties: /p:DotNetRuntimeSourceFeed=https://dotnetbuilds.blob.core.windows.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64)
          locBranch: release/9.0.3xx
          # WORKAROUND: BinSkim requires the folder exist prior to scanning.
          preSteps:
          - powershell: New-Item -ItemType Directory -Path $(Build.SourcesDirectory)/artifacts/bin -Force
            displayName: Create artifacts/bin directory
          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest')) }}:
            timeoutInMinutes: 90
            windowsJobParameterSets:
            ### OFFICIAL ###
            - categoryName: Official
              publishArgument: $(_publishArgument)
              signArgument: $(_signArgument)
              officialBuildProperties: $(_officialBuildProperties)
              enableDefaultArtifacts: true
              runTests: false
              publishRetryConfig: true
              variables:
                _SignType: real
            - categoryName: Official
              buildArchitecture: x86
              publishArgument: $(_publishArgument)
              signArgument: $(_signArgument)
              officialBuildProperties: $(_officialBuildProperties)
              runTests: false
              variables:
                _SignType: real
            - categoryName: Official
              buildArchitecture: arm64
              publishArgument: $(_publishArgument)
              signArgument: $(_signArgument)
              officialBuildProperties: $(_officialBuildProperties)
              runTests: false
              variables:
                _SignType: real
            ### PGO ###
            - categoryName: PGO
              pgoInstrument: true
              publishArgument: $(_publishArgument)
              signArgument: $(_signArgument)
              officialBuildProperties: $(_officialBuildProperties)
              runTests: false
              variables:
                _SignType: real
            - categoryName: PGO
              pgoInstrument: true
              buildArchitecture: x86
              publishArgument: $(_publishArgument)
              signArgument: $(_signArgument)
              officialBuildProperties: $(_officialBuildProperties)
              runTests: false
              variables:
                _SignType: real
            - categoryName: PGO
              pgoInstrument: true
              buildArchitecture: arm64
              publishArgument: $(_publishArgument)
              signArgument: $(_signArgument)
              officialBuildProperties: $(_officialBuildProperties)
              runTests: false
              variables:
                _SignType: real

      ############### LINUX ###############
      - template: /eng/pipelines/templates/jobs/sdk-job-matrix.yml@self
        parameters:
          pool:
            name: $(DncEngInternalBuildPool)
            image: 1es-ubuntu-2204
            os: linux
          helixTargetQueue: ubuntu.2204.amd64
          oneESCompat:
            templateFolderName: templates-official
            publishTaskPrefix: 1ES.
          runtimeSourceProperties: /p:DotNetRuntimeSourceFeed=https://dotnetbuilds.blob.core.windows.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64)
          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest')) }}:
            timeoutInMinutes: 90
            linuxJobParameterSets:
            ### OFFICIAL ###
            # Note: These builds are also portable like the Portable category, but that category uses containers, and doesn't publish zips and tarballs.
            - categoryName: Official
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties)
              runTests: false
            - categoryName: Official
              buildArchitecture: arm
              runtimeIdentifier: linux-arm
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties)
              runTests: false
            - categoryName: Official
              buildArchitecture: arm64
              runtimeIdentifier: linux-arm64
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties)
              runTests: false
            ### PORTABLE ###
            - categoryName: Portable
              # Do not publish zips and tarballs. The linux-x64 binaries are already published by Official.
              publishArgument: $(_publishArgument) /p:PublishBinariesAndBadge=false
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties) /p:BuildSdkDeb=true
              runTests: false
            - categoryName: Portable
              buildArchitecture: arm64
              runtimeIdentifier: linux-arm64
              # Do not publish zips and tarballs. The linux-arm64 binaries are already published by Official.
              publishArgument: $(_publishArgument) /p:PublishBinariesAndBadge=false /p:CLIBUILD_SKIP_TESTS=true
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties) /p:BuildSdkDeb=true
              runTests: false
            - categoryName: Portable
              container: centosStream9
              # Do not publish zips and tarballs. The linux-x64 binaries are already published by Official.
              publishArgument: $(_publishArgument) /p:PublishBinariesAndBadge=false
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties) /p:IsRPMBasedDistro=true
              runTests: false
            - categoryName: Portable
              container: centosStream9
              buildArchitecture: arm64
              runtimeIdentifier: linux-arm64
              # Do not publish zips and tarballs. The linux-arm64 binaries are already published by Official.
              publishArgument: $(_publishArgument) /p:PublishBinariesAndBadge=false /p:CLIBUILD_SKIP_TESTS=true
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties) /p:IsRPMBasedDistro=true
              runTests: false
            ### MUSL ###
            - categoryName: Musl
              container: alpine319WithNode
              runtimeIdentifier: linux-musl-x64
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              # Use HostOSName when running on alpine.
              osProperties: /p:HostOSName=linux-musl
              # SBOM generation is not supported for alpine.
              enableSbom: false
              runTests: false
            - categoryName: Musl
              container: mariner20CrossArm
              buildArchitecture: arm
              runtimeIdentifier: linux-musl-arm
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: /p:OSName=linux-musl
              runTests: false
            - categoryName: Musl
              buildArchitecture: arm64
              runtimeIdentifier: linux-musl-arm64
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: /p:OSName=linux-musl
              runTests: false
            ### PGO ###
            - categoryName: PGO
              pgoInstrument: true
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties)
              runTests: false
            - categoryName: PGO
              pgoInstrument: true
              buildArchitecture: arm64
              runtimeIdentifier: linux-arm64
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              osProperties: $(linuxOsPortableProperties)
              runTests: false

      ############### MACOS ###############
      - template: /eng/pipelines/templates/jobs/sdk-job-matrix.yml@self
        parameters:
          pool:
            name: Azure Pipelines
            image: macOS-latest
            os: macOS
          helixTargetQueue: osx.13.amd64
          oneESCompat:
            templateFolderName: templates-official
            publishTaskPrefix: 1ES.
          runtimeSourceProperties: /p:DotNetRuntimeSourceFeed=https://dotnetbuilds.blob.core.windows.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64)
          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest')) }}:
            timeoutInMinutes: 90
            macOSJobParameterSets:
            ### OFFICIAL ###
            - categoryName: Official
              runtimeIdentifier: osx-x64
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              runTests: false
            - categoryName: Official
              buildArchitecture: arm64
              runtimeIdentifier: osx-arm64
              publishArgument: $(_publishArgument)
              officialBuildProperties: $(_officialBuildProperties)
              runTests: false
      ### ARM64 TESTBUILD ###
      - ${{ if and(or(eq(parameters.runTestBuild, true), eq(variables['Build.Reason'], 'PullRequest')), eq(parameters.enableArm64Job, true)) }}:
        - template: /eng/pipelines/templates/jobs/sdk-job-matrix.yml@self
          parameters:
            pool:
              name: Azure Pipelines
              vmImage: macOS-latest
              os: macOS
            helixTargetQueue: osx.13.arm64
            macOSJobParameterSets:
            - categoryName: TestBuild
              buildArchitecture: arm64
              runtimeIdentifier: osx-arm64

      ############### DOTNET-FORMAT ###############
      - ${{ if or(eq(parameters.runTestBuild, true), eq(variables['Build.Reason'], 'PullRequest')) }}:
        - template: /eng/dotnet-format/dotnet-format-integration.yml@self
          parameters:
            oneESCompat:
              publishTaskPrefix: 1ES.
            runtimeSourceProperties: /p:DotNetRuntimeSourceFeed=https://dotnetbuilds.blob.core.windows.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64)

    ############### PUBLISH STAGE ###############
    - ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest')) }}:
      - stage: publish
        displayName: Publish
        dependsOn: build
        jobs:
        - template: /eng/common/templates-official/job/publish-build-assets.yml@self
          parameters:
            publishUsingPipelines: true
            publishAssetsImmediately: true
            pool:
              name: $(DncEngInternalBuildPool)
              image: 1es-windows-2022
              os: windows