Skip to content

Commit 2690b0c

Browse files
mmitchemmitche
authored
[release/8.0] Switch to dSAS for internal runtimes (#9307)
* Update arcade * Switch to dSAS for internal runtimes
1 parent c5eba89 commit 2690b0c

23 files changed

+331
-96
lines changed

‎eng/Version.Details.xml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -156,25 +156,25 @@
156156
</Dependency>
157157
</ProductDependencies>
158158
<ToolsetDependencies>
159-
<Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="8.0.0-beta.24266.3">
159+
<Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="8.0.0-beta.24324.7">
160160
<Uri>https://github.com/dotnet/arcade</Uri>
161-
<Sha>e6f70c7dd528f05cd28cec2a179d58c22e91d9ac</Sha>
161+
<Sha>3fe41d9e97519a4e9b48293906dbf58714ea9a0d</Sha>
162162
</Dependency>
163-
<Dependency Name="Microsoft.DotNet.CodeAnalysis" Version="8.0.0-beta.24266.3">
163+
<Dependency Name="Microsoft.DotNet.CodeAnalysis" Version="8.0.0-beta.24324.7">
164164
<Uri>https://github.com/dotnet/arcade</Uri>
165-
<Sha>e6f70c7dd528f05cd28cec2a179d58c22e91d9ac</Sha>
165+
<Sha>3fe41d9e97519a4e9b48293906dbf58714ea9a0d</Sha>
166166
</Dependency>
167-
<Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="8.0.0-beta.24266.3">
167+
<Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="8.0.0-beta.24324.7">
168168
<Uri>https://github.com/dotnet/arcade</Uri>
169-
<Sha>e6f70c7dd528f05cd28cec2a179d58c22e91d9ac</Sha>
169+
<Sha>3fe41d9e97519a4e9b48293906dbf58714ea9a0d</Sha>
170170
</Dependency>
171-
<Dependency Name="Microsoft.DotNet.ApiCompat" Version="8.0.0-beta.24266.3">
171+
<Dependency Name="Microsoft.DotNet.ApiCompat" Version="8.0.0-beta.24324.7">
172172
<Uri>https://github.com/dotnet/arcade</Uri>
173-
<Sha>e6f70c7dd528f05cd28cec2a179d58c22e91d9ac</Sha>
173+
<Sha>3fe41d9e97519a4e9b48293906dbf58714ea9a0d</Sha>
174174
</Dependency>
175-
<Dependency Name="Microsoft.DotNet.GenAPI" Version="8.0.0-beta.24266.3">
175+
<Dependency Name="Microsoft.DotNet.GenAPI" Version="8.0.0-beta.24324.7">
176176
<Uri>https://github.com/dotnet/arcade</Uri>
177-
<Sha>e6f70c7dd528f05cd28cec2a179d58c22e91d9ac</Sha>
177+
<Sha>3fe41d9e97519a4e9b48293906dbf58714ea9a0d</Sha>
178178
</Dependency>
179179
<Dependency Name="Microsoft.SourceLink.AzureRepos.Git" Version="8.0.0-beta.23409.2">
180180
<Uri>https://github.com/dotnet/sourcelink</Uri>

‎eng/Versions.props‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@
4949
</PropertyGroup>
5050
<!-- Packages that come from https://github.com/dotnet/arcade -->
5151
<PropertyGroup>
52-
<MicrosoftDotNetApiCompatVersion>8.0.0-beta.24266.3</MicrosoftDotNetApiCompatVersion>
53-
<MicrosoftDotNetCodeAnalysisPackageVersion>8.0.0-beta.24266.3</MicrosoftDotNetCodeAnalysisPackageVersion>
52+
<MicrosoftDotNetApiCompatVersion>8.0.0-beta.24324.7</MicrosoftDotNetApiCompatVersion>
53+
<MicrosoftDotNetCodeAnalysisPackageVersion>8.0.0-beta.24324.7</MicrosoftDotNetCodeAnalysisPackageVersion>
5454
</PropertyGroup>
5555
<!-- Sourcelink -->
5656
<PropertyGroup>

‎eng/common/post-build/publish-using-darc.ps1‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ param(
22
[Parameter(Mandatory=$true)][int] $BuildId,
33
[Parameter(Mandatory=$true)][int] $PublishingInfraVersion,
44
[Parameter(Mandatory=$true)][string] $AzdoToken,
5-
[Parameter(Mandatory=$true)][string] $MaestroToken,
65
[Parameter(Mandatory=$false)][string] $MaestroApiEndPoint = 'https://maestro.dot.net',
76
[Parameter(Mandatory=$true)][string] $WaitPublishingFinish,
87
[Parameter(Mandatory=$false)][string] $ArtifactsPublishingAdditionalParameters,
@@ -31,13 +30,13 @@ try {
3130
}
3231

3332
& $darc add-build-to-channel `
34-
--id $buildId `
35-
--publishing-infra-version $PublishingInfraVersion `
36-
--default-channels `
37-
--source-branch main `
38-
--azdev-pat $AzdoToken `
39-
--bar-uri $MaestroApiEndPoint `
40-
--password $MaestroToken `
33+
--id $buildId `
34+
--publishing-infra-version $PublishingInfraVersion `
35+
--default-channels `
36+
--source-branch main `
37+
--azdev-pat "$AzdoToken" `
38+
--bar-uri "$MaestroApiEndPoint" `
39+
--ci `
4140
@optionalParams
4241

4342
if ($LastExitCode -ne 0) {

‎eng/common/templates-official/job/publish-build-assets.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -76,13 +76,16 @@ jobs:
7676

7777
- task: NuGetAuthenticate@1
7878

79-
- task: PowerShell@2
79+
- task: AzureCLI@2
8080
displayName: Publish Build Assets
8181
inputs:
82-
filePath: eng\common\sdk-task.ps1
83-
arguments: -task PublishBuildAssets -restore -msbuildEngine dotnet
82+
azureSubscription: "Darc: Maestro Production"
83+
scriptType: ps
84+
scriptLocation: scriptPath
85+
scriptPath: $(Build.SourcesDirectory)/eng/common/sdk-task.ps1
86+
arguments: >
87+
-task PublishBuildAssets -restore -msbuildEngine dotnet
8488
/p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests'
85-
/p:BuildAssetRegistryToken=$(MaestroAccessToken)
8689
/p:MaestroApiEndpoint=https://maestro-prod.westus2.cloudapp.azure.com
8790
/p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }}
8891
/p:OfficialBuildId=$(Build.BuildNumber)
@@ -144,7 +147,6 @@ jobs:
144147
arguments: -BuildId $(BARBuildId)
145148
-PublishingInfraVersion 3
146149
-AzdoToken '$(publishing-dnceng-devdiv-code-r-build-re)'
147-
-MaestroToken '$(MaestroApiAccessToken)'
148150
-WaitPublishingFinish true
149151
-ArtifactsPublishingAdditionalParameters '${{ parameters.artifactsPublishingAdditionalParameters }}'
150152
-SymbolPublishingAdditionalParameters '${{ parameters.symbolPublishingAdditionalParameters }}'

‎eng/common/templates-official/job/source-build.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,12 @@ parameters:
3131
# container and pool.
3232
platform: {}
3333

34+
# If set to true and running on a non-public project,
35+
# Internal blob storage locations will be enabled.
36+
# This is not enabled by default because many repositories do not need internal sources
37+
# and do not need to have the required service connections approved in the pipeline.
38+
enableInternalSources: false
39+
3440
jobs:
3541
- job: ${{ parameters.jobNamePrefix }}_${{ parameters.platform.name }}
3642
displayName: Source-Build (${{ parameters.platform.name }})
@@ -62,6 +68,8 @@ jobs:
6268
clean: all
6369

6470
steps:
71+
- ${{ if eq(parameters.enableInternalSources, true) }}:
72+
- template: /eng/common/templates-official/steps/enable-internal-runtimes.yml
6573
- template: /eng/common/templates-official/steps/source-build.yml
6674
parameters:
6775
platform: ${{ parameters.platform }}

‎eng/common/templates-official/job/source-index-stage1.yml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
value: ${{ parameters.sourceIndexPackageSource }}
2424
- name: BinlogPath
2525
value: ${{ parameters.binlogPath }}
26-
- template: /eng/common/templates/variables/pool-providers.yml
26+
- template: /eng/common/templates-official/variables/pool-providers.yml
2727

2828
${{ if ne(parameters.pool, '') }}:
2929
pool: ${{ parameters.pool }}
@@ -34,7 +34,8 @@ jobs:
3434
demands: ImageOverride -equals windows.vs2019.amd64.open
3535
${{ if eq(variables['System.TeamProject'], 'internal') }}:
3636
name: $(DncEngInternalBuildPool)
37-
demands: ImageOverride -equals windows.vs2019.amd64
37+
image: windows.vs2022.amd64
38+
os: windows
3839

3940
steps:
4041
- ${{ each preStep in parameters.preSteps }}:
@@ -70,16 +71,13 @@ jobs:
7071
scriptType: 'ps'
7172
scriptLocation: 'inlineScript'
7273
inlineScript: |
73-
echo "##vso[task.setvariable variable=ARM_CLIENT_ID]$env:servicePrincipalId"
74-
echo "##vso[task.setvariable variable=ARM_ID_TOKEN]$env:idToken"
75-
echo "##vso[task.setvariable variable=ARM_TENANT_ID]$env:tenantId"
74+
echo "##vso[task.setvariable variable=ARM_CLIENT_ID;issecret=true]$env:servicePrincipalId"
75+
echo "##vso[task.setvariable variable=ARM_ID_TOKEN;issecret=true]$env:idToken"
76+
echo "##vso[task.setvariable variable=ARM_TENANT_ID;issecret=true]$env:tenantId"
7677
7778
- script: |
78-
echo "Client ID: $(ARM_CLIENT_ID)"
79-
echo "ID Token: $(ARM_ID_TOKEN)"
80-
echo "Tenant ID: $(ARM_TENANT_ID)"
8179
az login --service-principal -u $(ARM_CLIENT_ID) --tenant $(ARM_TENANT_ID) --allow-no-subscriptions --federated-token $(ARM_ID_TOKEN)
8280
displayName: "Login to Azure"
8381
8482
- script: $(Agent.TempDirectory)/.source-index/tools/UploadIndexStage1 -i .source-index/stage1output -n $(Build.Repository.Name) -s netsourceindexstage1 -b stage1
85-
displayName: Upload stage1 artifacts to source index
83+
displayName: Upload stage1 artifacts to source index

‎eng/common/templates-official/jobs/source-build.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,12 @@ parameters:
2121
# one job runs on 'defaultManagedPlatform'.
2222
platforms: []
2323

24+
# If set to true and running on a non-public project,
25+
# Internal nuget and blob storage locations will be enabled.
26+
# This is not enabled by default because many repositories do not need internal sources
27+
# and do not need to have the required service connections approved in the pipeline.
28+
enableInternalSources: false
29+
2430
jobs:
2531

2632
- ${{ if ne(parameters.allCompletedJobId, '') }}:
@@ -38,9 +44,11 @@ jobs:
3844
parameters:
3945
jobNamePrefix: ${{ parameters.jobNamePrefix }}
4046
platform: ${{ platform }}
47+
enableInternalSources: ${{ parameters.enableInternalSources }}
4148

4249
- ${{ if eq(length(parameters.platforms), 0) }}:
4350
- template: /eng/common/templates-official/job/source-build.yml
4451
parameters:
4552
jobNamePrefix: ${{ parameters.jobNamePrefix }}
4653
platform: ${{ parameters.defaultManagedPlatform }}
54+
enableInternalSources: ${{ parameters.enableInternalSources }}

‎eng/common/templates-official/post-build/post-build.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -272,14 +272,16 @@ stages:
272272

273273
- task: NuGetAuthenticate@1
274274

275-
- task: PowerShell@2
275+
- task: AzureCLI@2
276276
displayName: Publish Using Darc
277277
inputs:
278-
filePath: $(Build.SourcesDirectory)/eng/common/post-build/publish-using-darc.ps1
278+
azureSubscription: "Darc: Maestro Production"
279+
scriptType: ps
280+
scriptLocation: scriptPath
281+
scriptPath: $(Build.SourcesDirectory)/eng/common/post-build/publish-using-darc.ps1
279282
arguments: -BuildId $(BARBuildId)
280283
-PublishingInfraVersion ${{ parameters.publishingInfraVersion }}
281284
-AzdoToken '$(publishing-dnceng-devdiv-code-r-build-re)'
282-
-MaestroToken '$(MaestroApiAccessToken)'
283285
-WaitPublishingFinish true
284286
-ArtifactsPublishingAdditionalParameters '${{ parameters.artifactsPublishingAdditionalParameters }}'
285287
-SymbolPublishingAdditionalParameters '${{ parameters.symbolPublishingAdditionalParameters }}'

‎eng/common/templates-official/steps/enable-internal-runtimes.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Obtains internal runtime download credentials and populates the 'dotnetbuilds-internal-container-read-token-base64'
2+
# variable with the base64-encoded SAS token, by default
3+
4+
parameters:
5+
- name: federatedServiceConnection
6+
type: string
7+
default: 'dotnetbuilds-internal-read'
8+
- name: outputVariableName
9+
type: string
10+
default: 'dotnetbuilds-internal-container-read-token-base64'
11+
- name: expiryInHours
12+
type: number
13+
default: 1
14+
- name: base64Encode
15+
type: boolean
16+
default: true
17+
18+
steps:
19+
- ${{ if ne(variables['System.TeamProject'], 'public') }}:
20+
- template: /eng/common/templates-official/steps/get-delegation-sas.yml
21+
parameters:
22+
federatedServiceConnection: ${{ parameters.federatedServiceConnection }}
23+
outputVariableName: ${{ parameters.outputVariableName }}
24+
expiryInHours: ${{ parameters.expiryInHours }}
25+
base64Encode: ${{ parameters.base64Encode }}
26+
storageAccount: dotnetbuilds
27+
container: internal
28+
permissions: rl

‎eng/common/templates-official/steps/get-delegation-sas.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
parameters:
2+
- name: federatedServiceConnection
3+
type: string
4+
- name: outputVariableName
5+
type: string
6+
- name: expiryInHours
7+
type: number
8+
default: 1
9+
- name: base64Encode
10+
type: boolean
11+
default: false
12+
- name: storageAccount
13+
type: string
14+
- name: container
15+
type: string
16+
- name: permissions
17+
type: string
18+
default: 'rl'
19+
20+
steps:
21+
- task: AzureCLI@2
22+
displayName: 'Generate delegation SAS Token for ${{ parameters.storageAccount }}/${{ parameters.container }}'
23+
inputs:
24+
azureSubscription: ${{ parameters.federatedServiceConnection }}
25+
scriptType: 'pscore'
26+
scriptLocation: 'inlineScript'
27+
inlineScript: |
28+
# Calculate the expiration of the SAS token and convert to UTC
29+
$expiry = (Get-Date).AddHours(${{ parameters.expiryInHours }}).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
30+
31+
$sas = az storage container generate-sas --account-name ${{ parameters.storageAccount }} --name ${{ parameters.container }} --permissions ${{ parameters.permissions }} --expiry $expiry --auth-mode login --as-user -o tsv
32+
33+
if ($LASTEXITCODE -ne 0) {
34+
Write-Error "Failed to generate SAS token."
35+
exit 1
36+
}
37+
38+
if ('${{ parameters.base64Encode }}' -eq 'true') {
39+
$sas = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($sas))
40+
}
41+
42+
Write-Host "Setting '${{ parameters.outputVariableName }}' with the access token value"
43+
Write-Host "##vso[task.setvariable variable=${{ parameters.outputVariableName }};issecret=true]$sas"

0 commit comments

Comments
 (0)