|
| 1 | +# NOTE: |
| 2 | +# We stop signing GraphicalTools now since we aren't doing anymore work on it until MAUI |
| 3 | + |
1 | 4 | name: PR-$(System.PullRequest.PullRequestNumber)-$(Date:yyyyMMdd)$(Rev:.rr) |
2 | 5 |
|
3 | 6 | variables: |
@@ -31,155 +34,136 @@ trigger: |
31 | 34 | - /LICENSE.txt |
32 | 35 | - /CODE_OF_CONDUCT.md |
33 | 36 |
|
34 | | -jobs: |
35 | | -- job: 'ReleaseBuild' |
36 | | - displayName: Release Build |
37 | | - pool: |
38 | | - vmImage: 'vs2017-win2016' |
39 | | - steps: |
40 | | - - template: templates/ci-general.yml |
41 | | - |
42 | | -- job: 'SignBuild' |
43 | | - displayName: Signing Build |
44 | | - dependsOn: 'ReleaseBuild' |
45 | | - pool: |
46 | | - name: 'Package ES CodeHub Lab E' |
47 | | - demands: DotNetFramework |
48 | | - steps: |
49 | | - - powershell: | |
50 | | - Get-ChildItem -Path env: |
51 | | - displayName: Capture environment |
52 | | - condition: succeededOrFailed() |
53 | | -
|
54 | | - - task: PkgESSetupBuild@10 |
55 | | - displayName: 'Package ES - Setup Build' |
56 | | - inputs: |
57 | | - productName: GraphicalTools |
58 | | - |
59 | | - - task: DownloadBuildArtifacts@0 |
60 | | - displayName: 'Download Build Artifacts' |
61 | | - inputs: |
62 | | - downloadType: specific |
63 | | - |
64 | | - - task: PowerShell@1 |
65 | | - displayName: 'Extract build zip' |
66 | | - inputs: |
67 | | - scriptType: inlineScript |
68 | | - inlineScript: | |
69 | | - Expand-Archive -Path "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\GraphicalTools\Microsoft.PowerShell.GraphicalTools-Windows_NT.zip" -DestinationPath "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.GraphicalTools" |
| 37 | +resources: |
| 38 | + repositories: |
| 39 | + - repository: ComplianceRepo |
| 40 | + type: github |
| 41 | + endpoint: ComplianceGHRepo |
| 42 | + name: PowerShell/compliance |
| 43 | + |
| 44 | +stages: |
| 45 | +- stage: Build |
| 46 | + displayName: Build |
| 47 | + jobs: |
| 48 | + - job: 'ReleaseBuild' |
| 49 | + displayName: Release Build |
| 50 | + pool: |
| 51 | + vmImage: 'windows-latest' |
| 52 | + steps: |
| 53 | + - template: templates/ci-general.yml |
| 54 | + - pwsh: | |
| 55 | + Get-ChildItem -Recurse '$(Build.SourcesDirectory)' |
| 56 | + displayName: Capture downloaded artifacts |
| 57 | + - publish: '$(Build.SourcesDirectory)\src\Microsoft.PowerShell.ConsoleGuiTools\obj\project.assets.json' |
| 58 | + artifact: ConsoleGuiToolsAssetsJson |
| 59 | + displayName: Publish ConsoleGuiTools project.assets.json |
| 60 | + |
| 61 | + - job: 'SignBuild' |
| 62 | + displayName: Signing Build |
| 63 | + dependsOn: 'ReleaseBuild' |
| 64 | + pool: |
| 65 | + name: 'Package ES Standard Build' |
| 66 | + demands: DotNetFramework |
| 67 | + variables: |
| 68 | + - group: ESRP |
| 69 | + steps: |
| 70 | + - powershell: | |
| 71 | + Get-ChildItem -Path env: |
| 72 | + displayName: Capture environment |
| 73 | + condition: succeededOrFailed() |
| 74 | +
|
| 75 | + - task: DownloadBuildArtifacts@0 |
| 76 | + displayName: 'Download Build Artifacts' |
| 77 | + inputs: |
| 78 | + downloadType: specific |
| 79 | + |
| 80 | + - pwsh: | |
70 | 81 | Expand-Archive -Path "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\GraphicalTools\Microsoft.PowerShell.ConsoleGuiTools-Windows_NT.zip" -DestinationPath "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.ConsoleGuiTools" |
71 | | -
|
72 | | - - task: PkgESCodeSign@10 |
73 | | - displayName: 'CodeSign tools/releaseBuild/signing.xml' |
74 | | - env: |
75 | | - SYSTEM_ACCESSTOKEN: $(System.AccessToken) |
76 | | - inputs: |
77 | | - signConfigXml: tools/releaseBuild/signing.xml |
78 | | - inPathRoot: '$(Build.ArtifactStagingDirectory)' |
79 | | - outPathRoot: '$(Build.ArtifactStagingDirectory)\Signed' |
80 | | - |
81 | | - - task: PowerShell@1 |
82 | | - displayName: 'Copy signed files to unsigned folder' |
83 | | - inputs: |
84 | | - scriptType: inlineScript |
85 | | - inlineScript: | |
86 | | - $signed="$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Signed\*" |
87 | | - $notSigned="$env:BUILD_ARTIFACTSTAGINGDIRECTORY" |
88 | | - Copy-Item $signed $notSigned -Recurse -Force |
89 | | -
|
90 | | - - task: PowerShell@1 |
91 | | - displayName: 'Create catalog file' |
92 | | - inputs: |
93 | | - scriptType: inlineScript |
94 | | - inlineScript: | |
95 | | - $signedDir = "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.GraphicalTools\Microsoft.PowerShell.GraphicalTools" |
96 | | - New-FileCatalog -CatalogFilePath "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.GraphicalTools\Microsoft.PowerShell.GraphicalTools.cat" -Path "$signedDir" |
97 | | - $signedDir = "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.ConsoleGuiTools\Microsoft.PowerShell.ConsoleGuiTools" |
98 | | - New-FileCatalog -CatalogFilePath "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.ConsoleGuiTools\Microsoft.PowerShell.ConsoleGuiTools.cat" -Path "$signedDir" |
99 | | -
|
100 | | - - task: PkgESCodeSign@10 |
101 | | - displayName: 'CodeSign tools/releaseBuild/FileCatalogSigning.xml' |
102 | | - env: |
103 | | - SYSTEM_ACCESSTOKEN: $(System.AccessToken) |
104 | | - inputs: |
105 | | - signConfigXml: tools/releaseBuild/FileCatalogSigning.xml |
106 | | - inPathRoot: '$(Build.ArtifactStagingDirectory)' |
107 | | - outPathRoot: '$(Build.ArtifactStagingDirectory)' |
108 | | - |
109 | | - - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 |
110 | | - displayName: 'Component Detection' |
111 | | - |
112 | | - - task: AntiMalware@3 |
113 | | - inputs: |
114 | | - InputType: 'Basic' |
115 | | - ScanType: 'CustomScan' |
116 | | - FileDirPath: '$(Build.ArtifactStagingDirectory)' |
117 | | - EnableServices: false |
118 | | - SupportLogOnError: false |
119 | | - TreatSignatureUpdateFailureAs: 'Warning' |
120 | | - SignatureFreshness: 'UpToDate' |
121 | | - TreatStaleSignatureAs: 'Error' |
122 | | - |
123 | | - - task: PoliCheck@1 |
124 | | - condition: succeededOrFailed() |
125 | | - inputs: |
126 | | - targetType: F |
127 | | - optionsFC: 0 |
128 | | - optionsXS: 0 |
129 | | - optionsPE: '1|2|3|4' |
130 | | - optionsHMENABLE: 0 |
131 | | - optionsFTPATH: '$(Build.SourcesDirectory)\tools\terms\FileTypeSet.xml' |
132 | | - # toolVersion: 5.8.2.1 |
133 | | - |
134 | | - - task: CredScan@2 |
135 | | - condition: succeededOrFailed() |
136 | | - |
137 | | - - task: BinSkim@3 |
138 | | - condition: succeededOrFailed() |
139 | | - inputs: |
140 | | - InputType: 'Basic' |
141 | | - Function: 'analyze' |
142 | | - AnalyzeRecurse: true |
143 | | - AnalyzeTarget: '$(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.*Tools.dll;$(Build.ArtifactStagingDirectory)\OutGridView*.dll' |
144 | | - |
145 | | - # Publish results as artifacts |
146 | | - - task: PublishSecurityAnalysisLogs@3 |
147 | | - condition: succeededOrFailed() |
148 | | - inputs: |
149 | | - ArtifactName: 'CodeAnalysisLogs' |
150 | | - ArtifactType: 'Container' |
151 | | - |
152 | | - # Publish to TSA server |
153 | | - - task: TSAUpload@1 |
154 | | - condition: succeededOrFailed() |
155 | | - continueOnError: true |
156 | | - inputs: |
157 | | - tsaVersion: 'TsaV2' |
158 | | - codebase: 'Existing' |
159 | | - tsaEnvironment: 'PROD' |
160 | | - codeBaseName: 'PowerShell_GraphicalTools_20190809' |
161 | | - uploadAPIScan: false |
162 | | - uploadBinSkim: true |
163 | | - uploadCredScan: true |
164 | | - uploadFortifySCA: false |
165 | | - uploadFxCop: false |
166 | | - uploadModernCop: false |
167 | | - uploadPoliCheck: true |
168 | | - uploadPREfast: false |
169 | | - uploadRoslyn: false |
170 | | - uploadTSLint: false |
171 | | - uploadAsync: true |
172 | | - |
173 | | - - task: PowerShell@1 |
174 | | - displayName: 'Upload Artifacts' |
175 | | - condition: succeededOrFailed() |
176 | | - inputs: |
177 | | - scriptType: inlineScript |
178 | | - inlineScript: 'Write-Host "##vso[artifact.upload containerfolder=Microsoft.PowerShell.GraphicalTools-Signed;artifactname=Microsoft.PowerShell.GraphicalTools-Signed]$(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.GraphicalTools\Microsoft.PowerShell.GraphicalTools"' |
179 | | - |
180 | | - - task: PowerShell@1 |
181 | | - displayName: 'Upload Artifacts' |
182 | | - condition: succeededOrFailed() |
183 | | - inputs: |
184 | | - scriptType: inlineScript |
185 | | - inlineScript: 'Write-Host "##vso[artifact.upload containerfolder=Microsoft.PowerShell.ConsoleGuiTools-Signed;artifactname=Microsoft.PowerShell.ConsoleGuiTools-Signed]$(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools\Microsoft.PowerShell.ConsoleGuiTools"' |
| 82 | + displayName: 'Extract build zip' |
| 83 | +
|
| 84 | + - template: EsrpSign.yml@ComplianceRepo |
| 85 | + parameters: |
| 86 | + # the folder which contains the binaries to sign |
| 87 | + buildOutputPath: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools |
| 88 | + # the location to put the signed output |
| 89 | + signOutputPath: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools-Signed |
| 90 | + # the certificate ID to use |
| 91 | + certificateId: "CP-230012" |
| 92 | + # The file pattern to use |
| 93 | + # If not using minimatch: comma separated, with * supported |
| 94 | + # If using minimatch: newline separated, with !, **, and * supported. |
| 95 | + # See link in the useMinimatch comments. |
| 96 | + pattern: 'Microsoft.PowerShell.*.dll,Microsoft.PowerShell.*.psd1,Microsoft.PowerShell.*.psm1' |
| 97 | + # decides if the task should use minimatch for the pattern matching. |
| 98 | + # https://github.com/isaacs/minimatch#features |
| 99 | + useMinimatch: false |
| 100 | + |
| 101 | + - pwsh: | |
| 102 | + $signed="$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.ConsoleGuiTools-Signed\*" |
| 103 | + $notSigned="$env:BUILD_ARTIFACTSTAGINGDIRECTORY\Microsoft.PowerShell.ConsoleGuiTools" |
| 104 | + Copy-Item $signed $notSigned -Recurse -Force -Verbose |
| 105 | + displayName: 'Copy signed files to unsigned folder' |
| 106 | +
|
| 107 | + - template: EsrpSign.yml@ComplianceRepo |
| 108 | + parameters: |
| 109 | + # the folder which contains the binaries to sign |
| 110 | + buildOutputPath: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools |
| 111 | + # the location to put the signed output |
| 112 | + signOutputPath: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools-Signed |
| 113 | + # the certificate ID to use |
| 114 | + certificateId: "CP-231522" |
| 115 | + # The file pattern to use |
| 116 | + # If not using minimatch: comma separated, with * supported |
| 117 | + # If using minimatch: newline separated, with !, **, and * supported. |
| 118 | + # See link in the useMinimatch comments. |
| 119 | + pattern: 'NStack.dll,Terminal.Gui.dll' |
| 120 | + # decides if the task should use minimatch for the pattern matching. |
| 121 | + # https://github.com/isaacs/minimatch#features |
| 122 | + useMinimatch: false |
| 123 | + |
| 124 | + - pwsh: | |
| 125 | + $signed="$(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools-Signed\*" |
| 126 | + $notSigned="$(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools" |
| 127 | + Copy-Item $signed $notSigned -Recurse -Force -Verbose |
| 128 | + displayName: 'Copy signed files to unsigned folder' |
| 129 | +
|
| 130 | + - publish: $(Build.ArtifactStagingDirectory)\Microsoft.PowerShell.ConsoleGuiTools |
| 131 | + artifact: Microsoft.PowerShell.ConsoleGuiTools-Signed |
| 132 | + displayName: 'Upload Artifacts' |
| 133 | + condition: succeededOrFailed() |
| 134 | + |
| 135 | +- stage: compliance |
| 136 | + displayName: Compliance |
| 137 | + dependsOn: Build |
| 138 | + jobs: |
| 139 | + - job: Compliance_Job |
| 140 | + pool: |
| 141 | + name: Package ES Standard Build |
| 142 | + steps: |
| 143 | + - checkout: self |
| 144 | + - checkout: ComplianceRepo |
| 145 | + - download: current |
| 146 | + artifact: Microsoft.PowerShell.ConsoleGuiTools-Signed |
| 147 | + - download: current |
| 148 | + artifact: ConsoleGuiToolsAssetsJson |
| 149 | + |
| 150 | + - pwsh: | |
| 151 | + Get-ChildItem -Recurse '$(Pipeline.Workspace)' |
| 152 | + displayName: Capture downloaded artifacts |
| 153 | +
|
| 154 | + - template: assembly-module-compliance.yml@ComplianceRepo |
| 155 | + parameters: |
| 156 | + # binskim |
| 157 | + AnalyzeTarget: '$(Pipeline.Workspace)\Microsoft.PowerShell.ConsoleGuiTools-Signed\*.dll' |
| 158 | + AnalyzeSymPath: 'SRV*' |
| 159 | + # component-governance |
| 160 | + sourceScanPath: '$(Pipeline.Workspace)\ConsoleGuiToolsAssetsJson' |
| 161 | + # credscan |
| 162 | + suppressionsFile: '' |
| 163 | + # TermCheck |
| 164 | + optionsRulesDBPath: '' |
| 165 | + optionsFTPath: '' |
| 166 | + # tsa-upload |
| 167 | + codeBaseName: 'PSGraphicalTools_20201123' |
| 168 | + # selections |
| 169 | + APIScan: false # set to false when not using Windows APIs. |
0 commit comments