Publish NuGet package and PowerShell module in deploy box (#365)

Author: daxian-dbw

.pipelines/Package-Official.yml

@@ -52,8 +52,7 @@ extends:
         Network: KS3
       WindowsHostVersion:
         Version: 2022
-        # Azure container/blob operations get blocked when using KS3
-        Network: KS2
+        Network: KS3
     globalSdl:
       disableLegacyManifest: true
       # disabled Armorty as we dont have any ARM templates to scan. It fails on some sample ARM templates.

.pipelines/Release-Official.yml

@@ -5,6 +5,10 @@ parameters: # parameters are shown up in ADO UI in a build queue time
     displayName: 'Enable debug output'
     type: boolean
     default: false
+  - name: 'publish'
+    displayName: 'Publish artifacts'
+    type: boolean
+    default: true
 
 variables:
   - name: CDP_DEFINITION_BUILD_COUNT
@@ -36,15 +40,16 @@ resources:
 extends:
   template: v2/OneBranch.Official.CrossPlat.yml@templates
   parameters:
+    release:
+      category: NonAzure
     cloudvault:
       enabled: false
     featureFlags:
       LinuxHostVersion:
         Network: KS3
       WindowsHostVersion:
         Version: 2022
-        # Azure container/blob operations get blocked when using KS3
-        Network: KS2
+        Network: KS3
     globalSdl:
       asyncSdl:
         enabled: true
@@ -108,22 +113,28 @@ extends:
       dependsOn: UpdateChangeLog
       jobs:
       - template: /.pipelines/templates/release-publish-github.yml@self
+        parameters:
+          publish: ${{ parameters.publish }}
 
     - stage: PublishNuGet
       displayName: Publish NuGet
       dependsOn: PublishGitHubRelease
+      variables:
+        ob_release_environment: Production
       jobs:
       - template: /.pipelines/templates/release-publish-nuget.yml@self
         parameters:
-          publish: true
+          publish: ${{ parameters.publish }}
 
     - stage: PublishModule
       displayName: Publish Module
       dependsOn: PublishGitHubRelease
+      variables:
+        ob_release_environment: Production
       jobs:
       - template: /.pipelines/templates/release-publish-module.yml@self
         parameters:
-          publish: true
+          publish: ${{ parameters.publish }}
 
     - stage: PublishMsix
       dependsOn: PublishGitHubRelease

.pipelines/templates/module-package.yml

@@ -17,7 +17,7 @@ jobs:
     - group: DotNetPrivateBuildAccess
     - group: certificate_logical_to_actual
     - name: ob_sdl_sbom_enabled
-      value: false
+      value: true
     - name: ob_outputDirectory
       value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
     - name: repoRoot

.pipelines/templates/nupkg-package.yml

@@ -26,7 +26,7 @@ jobs:
     - group: mscodehub-feed-read-akv
     - group: DotNetPrivateBuildAccess
     - name: ob_sdl_sbom_enabled
-      value: false
+      value: true
     - name: ob_sdl_codeql_compiled_enabled
       value: false
 

.pipelines/templates/release-publish-github.yml

@@ -1,3 +1,8 @@
+parameters:
+  - name: publish
+    default: false
+    type: boolean
+
 jobs:
 - job: GithubReleaseDraft
   displayName: Create GitHub Release Draft
@@ -84,6 +89,7 @@ jobs:
       $description = '<!-- TODO: Generate release notes on GitHub! -->'
       Publish-ReleaseDraft -Tag $releaseTag -Name "$releaseTag Release of AIShell" -Description $description -User PowerShell -Repository AIShell -PackageFolder $(PackagesRoot) -Token $(GitHubReleasePat)
     displayName: Publish Release Draft
+    condition: and(ne('${{ parameters.publish }}', 'false'), succeeded())
 
 - template: /.pipelines/templates/wait-for-approval.yml@self
   parameters:

.pipelines/templates/release-publish-module.yml

@@ -6,33 +6,36 @@ parameters:
 jobs:
 - job: ModulePublish
   displayName: Publish to PSGallery
+  pool:
+    type: release
+    os: windows
+  templateContext:
+    inputs:
+      - input: pipelineArtifact
+        pipeline: AIShellPackagePipeline
+        artifactName: drop_module_package
   variables:
-    - name: ob_outputDirectory
-      value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
     # Disable SBOM, signing, and codeQL for this job
     - name: ob_sdl_sbom_enabled
       value: false
     - name: ob_signing_setup_enabled
       value: false
     - name: ob_sdl_codeql_compiled_enabled
       value: false
-  pool:
-    type: windows
 
   steps:
-  - download: AIShellPackagePipeline
-    artifact: drop_module_package
-    displayName: Download module package
-
-  - pwsh: |
-      Get-ChildItem '$(Pipeline.Workspace)/AIShellPackagePipeline/drop_module_package/*.nupkg' -recurse
+  - task: PowerShell@2
+    inputs:
+      targetType: 'inline'
+      script: |
+        Get-ChildItem '$(Pipeline.Workspace)/*.nupkg' -recurse
     displayName: List nupkg package
 
   - task: NuGetCommand@2
     displayName: Push AIShell module to PSGallery feed
     condition: and(ne('${{ parameters.publish }}', 'false'), succeeded())
     inputs:
       command: push
-      packagesToPush: '$(Pipeline.Workspace)/AIShellPackagePipeline/drop_module_package/*.nupkg'
+      packagesToPush: '$(Pipeline.Workspace)/*.nupkg'
       nuGetFeedType: external
       publishFeedCredentials: PowerShellGallery-dongbow

.pipelines/templates/release-publish-nuget.yml

@@ -8,26 +8,35 @@ jobs:
   displayName: Publish to NuGet
   condition: succeeded()
   pool:
-    type: windows
+    type: release
+    os: windows
+  templateContext:
+    inputs:
+      - input: pipelineArtifact
+        pipeline: AIShellPackagePipeline
+        artifactName: drop_nupkg_package
   variables:
-  - group: 'mscodehub-code-read-akv'
-  - name: ob_outputDirectory
-    value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
+    # Disable SBOM, signing, and codeQL for this job
+    - name: ob_sdl_sbom_enabled
+      value: false
+    - name: ob_signing_setup_enabled
+      value: false
+    - name: ob_sdl_codeql_compiled_enabled
+      value: false
 
   steps:
-  - download: AIShellPackagePipeline
-    artifact: drop_nupkg_package
-    displayName: Download nuget packages
-
-  - pwsh: |
-      Get-ChildItem '$(Pipeline.Workspace)/AIShellPackagePipeline/drop_nupkg_package/*.nupkg' -recurse
+  - task: PowerShell@2
+    inputs:
+      targetType: 'inline'
+      script: |
+        Get-ChildItem '$(Pipeline.Workspace)/*.nupkg' -recurse
     displayName: List nupkg package
 
   - task: NuGetCommand@2
     displayName: 'NuGet push'
     condition: and(ne('${{ parameters.publish }}', 'false'), succeeded())
     inputs:
       command: push
-      packagesToPush: '$(Pipeline.Workspace)/AIShellPackagePipeline/drop_nupkg_package/*.nupkg'
+      packagesToPush: '$(Pipeline.Workspace)/*.nupkg'
       nuGetFeedType: external
       publishFeedCredentials: PowerShellNuGetOrgPush