Skip to content

Commit 72dd066

Browse files
TravisEz13TravisEz13
authored
Add infrastructure to build and sign (#28)
1 parent 771e649 commit 72dd066

File tree

13 files changed

+918
-0
lines changed

13 files changed

+918
-0
lines changed

‎.vsts-ci/azure-pipelines-ci.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Build-$(System.PullRequest.PullRequestNumber)-$(Date:yyyyMMdd)$(Rev:.rr)
2+
trigger:
3+
# Batch merge builds together while a merge build is running
4+
batch: true
5+
branches:
6+
include:
7+
- master
8+
pr:
9+
branches:
10+
include:
11+
- master
12+
- feature-*
13+
paths:
14+
exclude:
15+
- /.dependabot/*
16+
- /.poshchan/*
17+
- /.github/**/*
18+
- /.vscode/**/*
19+
- /.vsts-ci/misc-analysis.yml
20+
- /tools/**/*
21+
- .editorconfig
22+
- .gitattributes
23+
- .gitignore
24+
- /docs/**/*
25+
- /CHANGELOG.md
26+
- /CONTRIBUTING.md
27+
- /README.md
28+
- /LICENSE.txt
29+
- /CODE_OF_CONDUCT.md
30+
31+
stages:
32+
- stage: Build
33+
displayName: Build PowerShell Package
34+
jobs:
35+
- job: BuildPkg
36+
displayName: Build Package
37+
pool:
38+
vmImage: windows-2019
39+
steps:
40+
- template: templates/ci-build.yml
41+
- pwsh: |
42+
Write-Verbose "BUILD_OUTPUT_PATH- $env:BUILD_OUTPUT_PATH" -Verbose
43+
Write-Verbose "SIGNED_OUTPUT_PATH- $env:SIGNED_OUTPUT_PATH" -Verbose
44+
Copy-Item $env:BUILD_OUTPUT_PATH $env:SIGNED_OUTPUT_PATH -Recurse -Force
45+
displayName: Build Signing Placeholder
46+
- pwsh: |
47+
$(Build.SourcesDirectory)/build.ps1 -Publish -Signed
48+
displayName: Publish
49+
timeoutInMinutes: 10
50+
51+
- stage: Test
52+
displayName: Test Package
53+
jobs:
54+
- template: templates/ci-test.yml
55+
parameters:
56+
jobName: TestPkgWin
57+
displayName: PowerShell Core on Windows
58+
imageName: windows-2019
59+
60+
# Not supported on Windows PowerShell per PSD1
61+
# - template: test.yml
62+
# parameters:
63+
# jobName: TestPkgWinPS
64+
# displayName: Windows PowerShell on Windows
65+
# imageName: windows-2019
66+
# powershellExecutable: powershell
67+
68+
- template: templates/ci-test.yml
69+
parameters:
70+
jobName: TestPkgUbuntu16
71+
displayName: PowerShell Core on Ubuntu 16.04
72+
imageName: ubuntu-16.04
73+
74+
- template: templates/ci-test.yml
75+
parameters:
76+
jobName: TestPkgWinMacOS
77+
displayName: PowerShell Core on macOS
78+
imageName: macOS-10.14

‎.vsts-ci/azure-pipelines-release.yml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
name: $(BuildDefinitionName)_$(date:yyMM).$(date:dd)$(rev:rrr)
2+
3+
trigger:
4+
batch: true
5+
branches:
6+
include:
7+
- master
8+
paths:
9+
exclude:
10+
- /.dependabot/*
11+
- /.poshchan/*
12+
- /.github/**/*
13+
- /.vscode/**/*
14+
- /.vsts-ci/misc-analysis.yml
15+
- /tools/**/*
16+
- .editorconfig
17+
- .gitattributes
18+
- .gitignore
19+
- /docs/**/*
20+
- /CHANGELOG.md
21+
- /CONTRIBUTING.md
22+
- /README.md
23+
- /LICENSE.txt
24+
- /CODE_OF_CONDUCT.md
25+
26+
stages:
27+
- stage: Build
28+
displayName: Build PowerShell Package
29+
jobs:
30+
- job: BuildPkg
31+
displayName: Build Package
32+
pool:
33+
name: 'Package ES CodeHub Lab E'
34+
steps:
35+
- powershell: |
36+
$powerShellPath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'powershell'
37+
Invoke-WebRequest -Uri https://raw.githubusercontent.com/PowerShell/PowerShell/master/tools/install-powershell.ps1 -outfile ./install-powershell.ps1
38+
./install-powershell.ps1 -Destination $powerShellPath
39+
$vstsCommandString = "vso[task.setvariable variable=PATH]$powerShellPath;$env:PATH"
40+
Write-Host "sending " + $vstsCommandString
41+
Write-Host "##$vstsCommandString"
42+
displayName: Install PowerShell Core
43+
44+
- task: PkgESSetupBuild@10
45+
displayName: 'Package ES - Setup Build'
46+
inputs:
47+
productName: PSDesiredStateConfiguration
48+
49+
- template: templates/shouldsign.yml
50+
51+
- powershell: |
52+
Get-ChildItem -Path env:
53+
displayName: Capture environment
54+
condition: succeededOrFailed()
55+
56+
- template: templates/ci-build.yml
57+
58+
- powershell: |
59+
Write-Verbose "BUILD_OUTPUT_PATH- $env:BUILD_OUTPUT_PATH" -Verbose
60+
Write-Verbose "SIGNED_OUTPUT_PATH- $env:SIGNED_OUTPUT_PATH" -Verbose
61+
Copy-Item $env:BUILD_OUTPUT_PATH $env:SIGNED_OUTPUT_PATH -Recurse -Force
62+
displayName: Copy unsigned files first
63+
64+
- task: PkgESCodeSign@10
65+
displayName: 'CodeSign tools/releaseBuild/signing.xml'
66+
env:
67+
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
68+
inputs:
69+
signConfigXml: tools/releaseBuild/signing.xml
70+
inPathRoot: '$(BUILD_OUTPUT_PATH)'
71+
outPathRoot: '$(SIGNED_OUTPUT_PATH)'
72+
condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true'))
73+
74+
- task: PowerShell@1
75+
displayName: 'Create catalog file'
76+
inputs:
77+
scriptType: inlineScript
78+
inlineScript: |
79+
$signedDir = "$env:SIGNED_OUTPUT_PATH\PSDesiredStateConfiguration"
80+
New-FileCatalog -CatalogFilePath "$env:SIGNED_OUTPUT_PATH\PSDesiredStateConfiguration\PSDesiredStateConfiguration.cat" -Path "$signedDir"
81+
82+
- task: PkgESCodeSign@10
83+
displayName: 'CodeSign tools/releaseBuild/FileCatalogSigning.xml'
84+
env:
85+
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
86+
inputs:
87+
signConfigXml: tools/releaseBuild/FileCatalogSigning.xml
88+
inPathRoot: '$(SIGNED_OUTPUT_PATH)'
89+
outPathRoot: '$(SIGNED_OUTPUT_PATH)'
90+
condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true'))
91+
92+
- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
93+
displayName: 'Component Detection'
94+
95+
- task: AntiMalware@3
96+
inputs:
97+
InputType: 'Basic'
98+
ScanType: 'CustomScan'
99+
FileDirPath: '$(SIGNED_OUTPUT_PATH)'
100+
EnableServices: false
101+
SupportLogOnError: false
102+
TreatSignatureUpdateFailureAs: 'Warning'
103+
SignatureFreshness: 'UpToDate'
104+
TreatStaleSignatureAs: 'Error'
105+
106+
- task: PoliCheck@1
107+
condition: succeededOrFailed()
108+
inputs:
109+
targetType: F
110+
optionsFC: 0
111+
optionsXS: 0
112+
optionsPE: '1|2|3|4'
113+
optionsHMENABLE: 0
114+
optionsFTPATH: '$(Build.SourcesDirectory)\tools\terms\FileTypeSet.xml'
115+
116+
- task: CredScan@2
117+
condition: succeededOrFailed()
118+
119+
# Publish results as artifacts
120+
- task: PublishSecurityAnalysisLogs@3
121+
condition: succeededOrFailed()
122+
inputs:
123+
ArtifactName: 'CodeAnalysisLogs'
124+
ArtifactType: 'Container'
125+
126+
# Publish to TSA server
127+
# - task: TSAUpload@1
128+
# condition: succeededOrFailed()
129+
# continueOnError: true
130+
# inputs:
131+
# tsaVersion: 'TsaV2'
132+
# codebase: 'Existing'
133+
# tsaEnvironment: 'PROD'
134+
# codeBaseName: 'PSDesiredStateConfiguration_20190828'
135+
# uploadAPIScan: false
136+
# uploadBinSkim: false
137+
# uploadCredScan: true
138+
# uploadFortifySCA: false
139+
# uploadFxCop: false
140+
# uploadModernCop: false
141+
# uploadPoliCheck: true
142+
# uploadPREfast: false
143+
# uploadRoslyn: false
144+
# uploadTSLint: false
145+
# uploadAsync: true
146+
147+
- pwsh: |
148+
$(Build.SourcesDirectory)/build.ps1 -Publish -Signed
149+
displayName: Publish
150+
timeoutInMinutes: 10

‎.vsts-ci/misc-analysis.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: PR-$(System.PullRequest.PullRequestNumber)-$(Date:yyyyMMdd)$(Rev:.rr)
2+
trigger:
3+
# Batch merge builds together while a merge build is running
4+
batch: true
5+
branches:
6+
include:
7+
- master
8+
9+
pr:
10+
branches:
11+
include:
12+
- master
13+
14+
resources:
15+
- repo: self
16+
clean: true
17+
18+
jobs:
19+
- template: templates/credscan.yml

‎.vsts-ci/templates/ci-build.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
steps:
2+
- pwsh: |
3+
Install-Module -Name "platyPS","Pester" -Force
4+
displayName: Install dependencies
5+
timeoutInMinutes: 10
6+
- pwsh: |
7+
Install-Module -Name "PSScriptAnalyzer" -RequiredVersion 1.18.0 -Force
8+
displayName: Install PSScriptAnalyzer
9+
timeoutInMinutes: 10
10+
- pwsh: |
11+
Install-Module -Name PSPackageProject -Force
12+
displayName: Install PSPackageProject module
13+
timeoutInMinutes: 10
14+
- pwsh: |
15+
$(Build.SourcesDirectory)/build.ps1 -Build
16+
displayName: Build

‎.vsts-ci/templates/ci-test.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
parameters:
2+
jobName: TestPkgWin
3+
imageName: windows-2019
4+
displayName: PowerShell Core on Windows
5+
powershellExecutable: pwsh
6+
7+
jobs:
8+
- job: ${{ parameters.jobName }}
9+
pool:
10+
vmImage: ${{ parameters.imageName }}
11+
displayName: ${{ parameters.displayName }}
12+
steps:
13+
- ${{ parameters.powershellExecutable }}: |
14+
if($IsMacOs)
15+
{
16+
brew update
17+
brew cask install powershell-preview
18+
sudo ln -s -f /usr/local/microsoft/powershell/7-preview/pwsh /usr/local/bin/pwsh
19+
}
20+
elseif($IsLinux)
21+
{
22+
sudo apt-get update
23+
sudo apt-get install powershell-preview
24+
sudo ln -s /opt/microsoft/powershell/7-preview/pwsh /usr/local/bin/pwsh
25+
}
26+
elseif($IsWindows)
27+
{
28+
Invoke-WebRequest -Uri https://raw.githubusercontent.com/PowerShell/PowerShell/master/tools/install-powershell.ps1 -outfile ./install-powershell.ps1
29+
./install-powershell.ps1 -AddToPath -Preview -Destination C:\powershell-preview
30+
$vstsCommandString = "vso[task.setvariable variable=PATH]C:\powershell-preview;$env:PATH"
31+
Write-Host "sending " + $vstsCommandString
32+
Write-Host "##$vstsCommandString"
33+
}
34+
displayName: Setup PowerShell preview
35+
36+
- ${{ parameters.powershellExecutable }}: |
37+
$PSVersionTable
38+
$vstsCommandString = "vso[task.setvariable variable=PSHOME]$pshome"
39+
Write-Host "sending " + $vstsCommandString
40+
Write-Host "##$vstsCommandString"
41+
displayName: Capture PowerShellVersion
42+
43+
- ${{ parameters.powershellExecutable }}: |
44+
dir env:PATH
45+
displayName: Capture Path
46+
47+
- ${{ parameters.powershellExecutable }}: |
48+
Get-PSRepository
49+
displayName: Capture PSRepository
50+
51+
- ${{ parameters.powershellExecutable }}: |
52+
Install-Module -Name "platyPS","Pester" -Force
53+
displayName: Install dependencies
54+
timeoutInMinutes: 10
55+
56+
- ${{ parameters.powershellExecutable }}: |
57+
Install-Module -Name "PSScriptAnalyzer" -RequiredVersion 1.18.0 -Force
58+
displayName: Install dependencies
59+
timeoutInMinutes: 10
60+
61+
- ${{ parameters.powershellExecutable }}: |
62+
Install-Module -Name PSPackageProject -Force
63+
displayName: Install PSPackageProject module
64+
65+
- task: DownloadBuildArtifacts@0
66+
displayName: 'Download artifacts'
67+
inputs:
68+
buildType: current
69+
downloadType: specific
70+
itemPattern: '**/*.nupkg'
71+
downloadPath: '$(System.ArtifactsDirectory)'
72+
73+
- ${{ parameters.powershellExecutable }}: |
74+
$sourceName = 'pspackageproject-local-repo'
75+
Register-PSRepository -Name $sourceName -SourceLocation '$(System.ArtifactsDirectory)' -ErrorAction Ignore
76+
$config = Get-PSPackageProjectConfiguration
77+
$buildOutputPath = $config.BuildOutputPath
78+
$null = New-Item -ItemType Directory -Path $buildOutputPath -Verbose
79+
$moduleName = $config.ModuleName
80+
Save-Module -Repository $sourceName -Name $moduleName -Path $config.BuildOutputPath
81+
displayName: Extract product artifact
82+
timeoutInMinutes: 10
83+
84+
- ${{ parameters.powershellExecutable }}: |
85+
Invoke-PSPackageProjectTest -Type Functional
86+
displayName: Execute functional tests
87+
errorActionPreference: continue
88+
89+
- ${{ parameters.powershellExecutable }}: |
90+
Invoke-PSPackageProjectTest -Type StaticAnalysis
91+
displayName: Execute static analysis tests
92+
errorActionPreference: continue
93+
condition: succeededOrFailed()
94+
95+
96+
- ${{ parameters.powershellExecutable }}: |
97+
Unregister-PSRepository -Name 'pspackageproject-local-repo' -ErrorAction Ignore
98+
displayName: Unregister temporary PSRepository
99+
condition: always()
100+
timeoutInMinutes: 10

‎.vsts-ci/templates/credscan.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
parameters:
2+
pool: 'Hosted VS2017'
3+
jobName: 'credscan'
4+
displayName: Secret Scan
5+
6+
jobs:
7+
- job: ${{ parameters.jobName }}
8+
pool:
9+
name: ${{ parameters.pool }}
10+
11+
displayName: ${{ parameters.displayName }}
12+
13+
steps:
14+
- powershell: Write-Host "##vso[build.updatebuildnumber]$env:BUILD_SOURCEBRANCHNAME-$env:BUILD_SOURCEVERSION-$((get-date).ToString("yyyyMMddhhmmss"))"
15+
displayName: Set Build Name for Non-PR
16+
condition: ne(variables['Build.Reason'], 'PullRequest')
17+
18+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2
19+
displayName: 'Scan for secrets'
20+
inputs:
21+
debugMode: false
22+
23+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2
24+
displayName: 'Publish Secret Scan Logs to Build Artifacts'
25+
continueOnError: true
26+
27+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@1
28+
displayName: 'Check for failures'
29+
inputs:
30+
CredScan: true
31+
ToolLogsNotFoundAction: Error

0 commit comments

Comments
 (0)