Skip to content

Commit f82598b

Browse files
stateofthearbJustin Nel
stateofthearb
and
Justin Nel
authored
Added ALZ-SYNC pipeline template & calling main yml file (#1029)
Co-authored-by: Justin Nel <[email protected]>
1 parent ff3c74e commit f82598b

File tree

2 files changed

+233
-0
lines changed

2 files changed

+233
-0
lines changed

‎StarterKit/Pipelines/AzureDevOps/GitHub-Flow/epac-alz-sync-main.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# This is the main pipeline entry point for EPAC ALZ sync.
2+
# It calls the reusable pipeline template and passes parameters for modular execution.
3+
trigger: none
4+
pr: none
5+
6+
schedules:
7+
- cron: "0 3 1 */3 *"
8+
displayName: Quarterly EPAC ALZ Sync
9+
branches:
10+
include:
11+
- main
12+
always: true # Always run this schedule
13+
14+
stages:
15+
- stage: EPACSync
16+
displayName: 'EPAC ALZ Library Sync'
17+
jobs:
18+
- template: ../templates/alz-sync.yaml
19+
parameters:
20+
epacVersion: 'latest'
21+
definitionsRootFolder: './Definitions'
22+
projectName: 'EPAC'
23+
gitUserEmail: '[email protected]'
24+
gitUserName: 'EPAC ALZ Sync Bot'
25+
pacEnvironmentSelector: 'epac-prod'
26+
alzLibraryType: 'ALZ' # Or 'AMBA'
27+
storyId: '412' # Optional: Link created work item task to an existing story in Azure DevOps.

‎StarterKit/Pipelines/AzureDevOps/GitHub-Flow/epac-alz-sync-pipeline.yml‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
# This template defines the core sync logic for EPAC ALZ.
2+
# Called by epac-alz-sync-main.yml with environment-specific parameters.
3+
parameters:
4+
- name: epacVersion
5+
type: string
6+
default: 'latest'
7+
- name: definitionsRootFolder
8+
type: string
9+
default: './Definitions'
10+
- name: projectName
11+
type: string
12+
default: 'EPAC'
13+
- name: gitUserEmail
14+
type: string
15+
default: '[email protected]'
16+
- name: gitUserName
17+
type: string
18+
default: 'EPAC Sync Bot'
19+
- name: pacEnvironmentSelector
20+
type: string
21+
default: 'epac-prod'
22+
- name: alzLibraryType
23+
type: string
24+
values:
25+
- 'AMBA'
26+
- 'ALZ'
27+
- name: storyId # Optional parameter to link created work item task to an existing story in Azure DevOps.
28+
type: string
29+
default: ''
30+
31+
jobs:
32+
- job: Sync_EPAC_Policies
33+
displayName: 'Sync ${{ parameters.alzLibraryType }} Policies'
34+
pool:
35+
vmImage: 'ubuntu-latest'
36+
37+
steps:
38+
- checkout: self
39+
displayName: 'Checkout Repo'
40+
persistCredentials: true
41+
42+
- script: |
43+
44+
# Install EPAC module with version handling
45+
if [ "${{ parameters.epacVersion }}" = "latest" ]; then
46+
echo "🔧 Installing latest version of EPAC"
47+
pwsh -Command "Install-Module -Name EnterprisePolicyAsCode -Force -Scope CurrentUser"
48+
else
49+
echo "🔧 Installing EPAC version ${{ parameters.epacVersion }}"
50+
pwsh -Command "Install-Module -Name EnterprisePolicyAsCode -RequiredVersion ${{ parameters.epacVersion }} -Force -Scope CurrentUser"
51+
fi
52+
displayName: '🔧 Install EPAC Module'
53+
54+
- script: |
55+
56+
# Install JQ for JSON parsing
57+
echo "🔧 Installing JQ..."
58+
sudo apt install jq
59+
displayName: '🔧 Install JQ'
60+
61+
- script: |
62+
63+
echo "🔧 Installing DevOps extension & setting defaults..."
64+
az extension add --name azure-devops
65+
az devops configure --defaults organization="${SYSTEM_COLLECTIONURI%/}" project="${{ parameters.projectName }}"
66+
displayName: '🔧 Prep Azure DevOps CLI'
67+
68+
- script: |
69+
70+
# Parse variables
71+
orgUri="${SYSTEM_COLLECTIONURI%/}" # Trim trailing slash
72+
projectName="${PROJECT_NAME}"
73+
repoName="${BUILD_REPOSITORY_NAME}"
74+
remoteUrl="$orgUri/$projectName/_git/$repoName"
75+
BRANCH_NAME="EPAC-${{ parameters.alzLibraryType }}-${BUILD_BUILDNUMBER}"
76+
77+
echo '🛠️Configuring Git...'
78+
git config --global user.email "${{ parameters.gitUserEmail }}"
79+
git config --global user.name "${{ parameters.gitUserName }}"
80+
81+
# Construct Git remote URL
82+
echo "🔗 Constructed remote URL: $remoteUrl"
83+
git remote set-url origin "$remoteUrl"
84+
echo "✅ Git remote updated successfully."
85+
echo "🔄 Preparing to push to branch: $BRANCH_NAME in repo: $repoName"
86+
87+
echo "Checking out branch: $BRANCH_NAME"
88+
git checkout -b $BRANCH_NAME
89+
90+
# Sync policies
91+
echo '🚀Running EPAC Sync...'
92+
pwsh -Command "Sync-ALZPolicyFromLibrary -DefinitionsRootFolder \"${{ parameters.definitionsRootFolder }}\" -Type \"${{ parameters.alzLibraryType }}\" -PacEnvironmentSelector \"${{ parameters.pacEnvironmentSelector }}\""
93+
94+
echo '🔍Checking for changes after sync...'
95+
git add .
96+
if ! git diff --cached --quiet; then
97+
echo '✅ Changes detected — preparing to commit.'
98+
git commit -m "Auto-generated EPAC-${{ parameters.alzLibraryType }} library update"
99+
100+
# This tells Git to use the OAuth token for that specific push
101+
git -c http.extraheader="Authorization: Bearer ${SYSTEM_ACCESSTOKEN}" push -u origin $BRANCH_NAME
102+
103+
else
104+
echo '🟡 No changes detected — skipping commit.'
105+
exit 0
106+
fi
107+
displayName: '🚀 Sync Policies and Commit'
108+
env:
109+
SYSTEM_ACCESSTOKEN: $(System.AccessToken) # Required for Git operations
110+
SYSTEM_COLLECTIONURI: $(System.CollectionUri)
111+
BUILD_REPOSITORY_NAME: $(Build.Repository.Name)
112+
PROJECT_NAME: ${{ parameters.projectName }}
113+
GIT_USER_EMAIL: ${{ parameters.gitUserEmail }}
114+
GIT_USER_NAME: ${{ parameters.gitUserName }}
115+
AZURE_DEVOPS_EXT_PAT: $(System.AccessToken) # Required for Azure CLI to authenticate & create PRs
116+
117+
- script: |
118+
119+
# Parse variables
120+
repoName="${BUILD_REPOSITORY_NAME}"
121+
alzLibraryType="${{ parameters.alzLibraryType }}"
122+
PR_BRANCH="EPAC-$alzLibraryType-${BUILD_BUILDNUMBER}"
123+
sourceBranch="refs/heads/$PR_BRANCH"
124+
targetBranch="refs/heads/main"
125+
storyId="${{ parameters.storyId }}"
126+
description=$(cat <<EOF
127+
Auto-generated PR for EPAC-${{ parameters.alzLibraryType }} policy updates.
128+
129+
Pipeline Details:
130+
- Pipeline Run Link: $(System.TeamFoundationCollectionUri)$(System.TeamProject)/_build/results?buildId=$(Build.BuildId)
131+
EOF
132+
)
133+
134+
# Verify the build is running as expected build service
135+
echo " 🔍Build running as: $(whoami)"
136+
137+
# Fetch the target branch
138+
echo " 🎯Fetching target branch 'main' with OAuth token..."
139+
git -c http.extraheader="Authorization: Bearer ${SYSTEM_ACCESSTOKEN}" fetch origin main
140+
git branch main origin/main
141+
142+
echo "🌿 Show branches"
143+
git branch -a
144+
145+
#validate branches
146+
git show-ref --verify "$sourceBranch" || { echo "❌ Source branch not found. Aborting PR."; exit 1; }
147+
git show-ref --verify "$targetBranch" || { echo "❌ Target branch not found. Aborting PR."; exit 1; }
148+
149+
echo "📦 Verifying remote refs..."
150+
az repos ref list --repository "$repoName" | grep "heads/"
151+
152+
# Create work item
153+
echo "🆕 Creating Azure Boards work item..."
154+
workItemJson=$(az boards work-item create \
155+
--project "${{ parameters.projectName }}" \
156+
--type "Task" \
157+
--title "Auto-generated EPAC-${{ parameters.alzLibraryType }} library update — Build #${BUILD_BUILDNUMBER}" \
158+
--description "Created by pipeline run ${BUILD_BUILDNUMBER}" \
159+
--query '{id:id}' \
160+
--output json)
161+
162+
workItemId=$(echo "$workItemJson" | jq -r '.id')
163+
echo "🔗 Using work item ID: $workItemId"
164+
165+
# Link work item to story if specified
166+
if [ -n "$storyId" ]; then
167+
echo "🔗 Linking Task $workItemId to Story $storyId"
168+
az boards work-item relation add \
169+
--id "$workItemId" \
170+
--relation-type "parent" \
171+
--target-id "$storyId"
172+
fi
173+
174+
# Create a pull request using Azure CLI - uses project build service implicitly for authentication
175+
echo '🧾Creating a pull request targeting the main branch...'
176+
prJson=$(az repos pr create \
177+
--repository "$repoName" \
178+
--source-branch "$sourceBranch" \
179+
--target-branch "$targetBranch" \
180+
--title "Auto-generated EPAC-${alzLibraryType} library update — Build #${BUILD_BUILDNUMBER}" \
181+
--description "$description" \
182+
--output json)
183+
184+
prId=$(echo "$prJson" | jq -r '.pullRequestId')
185+
186+
echo "🔗 Linking work item $workItemId to PR $prId"
187+
az repos pr work-item add \
188+
--id "$prId" \
189+
--work-items "$workItemId"
190+
191+
displayName: '👮 Create Pull Request & link Work Item 🔗'
192+
env:
193+
BUILD_REPOSITORY_NAME: $(Build.Repository.Name)
194+
AZURE_DEVOPS_EXT_PAT: $(System.AccessToken) # Used implicitly by Azure CLI for DevOps auth so it can create PRs
195+
SYSTEM_ACCESSTOKEN: $(System.AccessToken) # Required for Git operations
196+
197+
198+
199+
200+
201+
202+
203+
204+
205+
206+

0 commit comments

Comments
 (0)