Skip to content

Commit e5515ac

Browse files
joaomorenojoaomoreno
authored
Adopt 1ES PT (microsoft#207844)
* extend 1es pipeline template * oops * fix template references * argh * hmm * hm * hm * use outputs for compilation artifact * this * use 1ES.PublishPipelineArtifact@1 instead of publish * more 1ES.PublishPipelineArtifact@1 adoption * provide windows pool for sdl sources * sdl * fix pools * fix macos * disable sbom for intermediate artifacts * use mariner linux * try inline tsa options * fix credscan * hm * sudo it * more suppressions * be explicit with SBOM build drop paths * fix indentation * fix file extensions * fix cli sbom build drop paths * fix more build * fix unzip cli * careful with _manifest in artifacts * do not close file * add logging * debug * use snapcraft container * remove size check * fix macos cli step * fix snap permissions * fix macos * better logs * fix snap * more cred scan suppressions * even more supressiong * alpine-arm64: try using x64 * Revert "alpine-arm64: try using x64" This reverts commit bf2003b. * test docker * I wonder * logs * hm * fix indentation * hm * hm * fix snap finds * remove auth * use hostArchitecture * snap: limit find * hm * sudo * Add validateToolOutput: None to the build pipeline * bring back sdl-scan * try all tools: true * use release * Update Azure Pipelines YAML file for Linux product build and test * hm * hm * same for win32 * hm * hm * Revert "hm" This reverts commit 1b9dcae. * use branch * fix template file * fix template paths
1 parent e3cf253 commit e5515ac

34 files changed

+1040
-974
lines changed

‎build/azure-pipelines/alpine/cli-build-alpine.yml

Lines changed: 23 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ steps:
3333
workingDirectory: build
3434
displayName: Install pipeline build
3535
36-
- template: ../cli/cli-apply-patches.yml
36+
- template: ../cli/cli-apply-patches.yml@self
3737

3838
- task: Npm@1
3939
displayName: Download openssl prebuilt
@@ -58,7 +58,7 @@ steps:
5858
sudo ln -s "/usr/bin/g++" "/usr/bin/musl-g++" || echo "link exists"
5959
displayName: Install musl build dependencies
6060
61-
- template: ../cli/install-rust-posix.yml
61+
- template: ../cli/install-rust-posix.yml@self
6262
parameters:
6363
targets:
6464
- ${{ if eq(parameters.VSCODE_BUILD_ALPINE_ARM64, true) }}:
@@ -67,7 +67,7 @@ steps:
6767
- x86_64-unknown-linux-musl
6868

6969
- ${{ if eq(parameters.VSCODE_BUILD_ALPINE_ARM64, true) }}:
70-
- template: ../cli/cli-compile.yml
70+
- template: ../cli/cli-compile.yml@self
7171
parameters:
7272
VSCODE_CLI_TARGET: aarch64-unknown-linux-musl
7373
VSCODE_CLI_ARTIFACT: vscode_cli_alpine_arm64_cli
@@ -80,7 +80,7 @@ steps:
8080
OPENSSL_STATIC: "1"
8181

8282
- ${{ if eq(parameters.VSCODE_BUILD_ALPINE, true) }}:
83-
- template: ../cli/cli-compile.yml
83+
- template: ../cli/cli-compile.yml@self
8484
parameters:
8585
VSCODE_CLI_TARGET: x86_64-unknown-linux-musl
8686
VSCODE_CLI_ARTIFACT: vscode_cli_alpine_x64_cli
@@ -92,14 +92,23 @@ steps:
9292
OPENSSL_INCLUDE_DIR: $(Build.ArtifactStagingDirectory)/openssl/x64-linux-musl/include
9393
OPENSSL_STATIC: "1"
9494

95-
- ${{ if eq(parameters.VSCODE_BUILD_ALPINE_ARM64, true) }}:
96-
- template: ../cli/cli-publish.yml
97-
parameters:
98-
VSCODE_CLI_ARTIFACT: vscode_cli_alpine_arm64_cli
99-
VSCODE_CHECK_ONLY: ${{ parameters.VSCODE_CHECK_ONLY }}
95+
- ${{ if not(parameters.VSCODE_CHECK_ONLY) }}:
96+
- ${{ if eq(parameters.VSCODE_BUILD_ALPINE_ARM64, true) }}:
97+
- task: 1ES.PublishPipelineArtifact@1
98+
inputs:
99+
targetPath: $(Build.ArtifactStagingDirectory)/vscode_cli_alpine_arm64_cli.tar.gz
100+
artifactName: vscode_cli_alpine_arm64_cli
101+
sbomBuildDropPath: $(Build.ArtifactStagingDirectory)/cli
102+
sbomPackageName: "VS Code Alpine arm64 CLI"
103+
sbomPackageVersion: $(Build.SourceVersion)
104+
displayName: Publish vscode_cli_alpine_arm64_cli artifact
100105

101-
- ${{ if eq(parameters.VSCODE_BUILD_ALPINE, true) }}:
102-
- template: ../cli/cli-publish.yml
103-
parameters:
104-
VSCODE_CLI_ARTIFACT: vscode_cli_alpine_x64_cli
105-
VSCODE_CHECK_ONLY: ${{ parameters.VSCODE_CHECK_ONLY }}
106+
- ${{ if eq(parameters.VSCODE_BUILD_ALPINE, true) }}:
107+
- task: 1ES.PublishPipelineArtifact@1
108+
inputs:
109+
targetPath: $(Build.ArtifactStagingDirectory)/vscode_cli_alpine_x64_cli.tar.gz
110+
artifactName: vscode_cli_alpine_x64_cli
111+
sbomBuildDropPath: $(Build.ArtifactStagingDirectory)/cli
112+
sbomPackageName: "VS Code Alpine x64 CLI"
113+
sbomPackageVersion: $(Build.SourceVersion)
114+
displayName: Publish vscode_cli_alpine_x64_cli artifact

‎build/azure-pipelines/alpine/product-build-alpine.yml

Lines changed: 31 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ steps:
55
versionFilePath: .nvmrc
66
nodejsMirror: https://github.com/joaomoreno/node-mirror/releases/download
77

8-
- template: ../distro/download-distro.yml
8+
- template: ../distro/download-distro.yml@self
99

1010
- task: AzureKeyVault@1
1111
displayName: "Azure Key Vault: Get Secrets"
@@ -107,16 +107,18 @@ steps:
107107
- script: node build/azure-pipelines/distro/mixin-quality
108108
displayName: Mixin distro quality
109109

110-
- template: ../common/install-builtin-extensions.yml
110+
- template: ../common/install-builtin-extensions.yml@self
111111

112112
- script: |
113113
set -e
114114
TARGET=$([ "$VSCODE_ARCH" == "x64" ] && echo "linux-alpine" || echo "alpine-arm64") # TODO@joaomoreno
115115
yarn gulp vscode-reh-$TARGET-min-ci
116116
(cd .. && mv vscode-reh-$TARGET vscode-server-$TARGET) # TODO@joaomoreno
117117
ARCHIVE_PATH=".build/linux/server/vscode-server-$TARGET.tar.gz"
118+
DIR_PATH="$(realpath ../vscode-server-$TARGET)"
118119
mkdir -p $(dirname $ARCHIVE_PATH)
119120
tar --owner=0 --group=0 -czf $ARCHIVE_PATH -C .. vscode-server-$TARGET
121+
echo "##vso[task.setvariable variable=SERVER_DIR_PATH]$DIR_PATH"
120122
echo "##vso[task.setvariable variable=SERVER_PATH]$ARCHIVE_PATH"
121123
env:
122124
GITHUB_TOKEN: "$(github-distro-mixin-password)"
@@ -128,8 +130,10 @@ steps:
128130
yarn gulp vscode-reh-web-$TARGET-min-ci
129131
(cd .. && mv vscode-reh-web-$TARGET vscode-server-$TARGET-web) # TODO@joaomoreno
130132
ARCHIVE_PATH=".build/linux/web/vscode-server-$TARGET-web.tar.gz"
133+
DIR_PATH="$(realpath ../vscode-server-$TARGET-web)"
131134
mkdir -p $(dirname $ARCHIVE_PATH)
132135
tar --owner=0 --group=0 -czf $ARCHIVE_PATH -C .. vscode-server-$TARGET-web
136+
echo "##vso[task.setvariable variable=WEB_DIR_PATH]$DIR_PATH"
133137
echo "##vso[task.setvariable variable=WEB_PATH]$ARCHIVE_PATH"
134138
env:
135139
GITHUB_TOKEN: "$(github-distro-mixin-password)"
@@ -139,36 +143,40 @@ steps:
139143
condition: and(succeededOrFailed(), notIn(variables['Agent.JobStatus'], 'Succeeded', 'SucceededWithIssues'))
140144
displayName: Generate artifact prefix
141145

142-
- script: mkdir $(agent.builddirectory)/vscode-alpine-$(VSCODE_ARCH)
143-
displayName: Make folder for SBOM
144-
145-
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
146-
displayName: Generate SBOM
146+
- task: 1ES.PublishPipelineArtifact@1
147147
inputs:
148-
BuildDropPath: $(agent.builddirectory)/vscode-alpine-$(VSCODE_ARCH)
149-
PackageName: Visual Studio Code Server
150-
151-
- publish: $(agent.builddirectory)/vscode-alpine-$(VSCODE_ARCH)/_manifest
152-
displayName: Publish SBOM
153-
artifact: $(ARTIFACT_PREFIX)sbom_vscode_alpine_$(VSCODE_ARCH)
154-
155-
- publish: $(SERVER_PATH)
156-
artifact: $(ARTIFACT_PREFIX)vscode_server_alpine_$(VSCODE_ARCH)_archive-unsigned
148+
targetPath: $(SERVER_PATH)
149+
artifactName: $(ARTIFACT_PREFIX)vscode_server_alpine_$(VSCODE_ARCH)_archive-unsigned
150+
sbomBuildDropPath: $(SERVER_DIR_PATH)
151+
sbomPackageName: "VS Code Alpine $(VSCODE_ARCH) Server"
152+
sbomPackageVersion: $(Build.SourceVersion)
157153
displayName: Publish server archive
158154
condition: and(succeededOrFailed(), ne(variables['SERVER_PATH'], ''), ne(variables['VSCODE_ARCH'], 'x64'))
159155

160-
- publish: $(WEB_PATH)
161-
artifact: $(ARTIFACT_PREFIX)vscode_web_alpine_$(VSCODE_ARCH)_archive-unsigned
156+
- task: 1ES.PublishPipelineArtifact@1
157+
inputs:
158+
targetPath: $(WEB_PATH)
159+
artifactName: $(ARTIFACT_PREFIX)vscode_web_alpine_$(VSCODE_ARCH)_archive-unsigned
160+
sbomBuildDropPath: $(WEB_DIR_PATH)
161+
sbomPackageName: "VS Code Alpine $(VSCODE_ARCH) Web"
162+
sbomPackageVersion: $(Build.SourceVersion)
162163
displayName: Publish web server archive
163164
condition: and(succeededOrFailed(), ne(variables['WEB_PATH'], ''), ne(variables['VSCODE_ARCH'], 'x64'))
164165

165-
# Legacy x64 artifact name
166-
- publish: $(SERVER_PATH)
167-
artifact: $(ARTIFACT_PREFIX)vscode_server_linux_alpine_archive-unsigned
166+
# same as above, keep legacy name
167+
- task: 1ES.PublishPipelineArtifact@1
168+
inputs:
169+
targetPath: $(SERVER_PATH)
170+
artifactName: $(ARTIFACT_PREFIX)vscode_server_linux_alpine_archive-unsigned
171+
sbomEnabled: false
168172
displayName: Publish x64 server archive
169173
condition: and(succeededOrFailed(), ne(variables['SERVER_PATH'], ''), eq(variables['VSCODE_ARCH'], 'x64'))
170174

171-
- publish: $(WEB_PATH)
172-
artifact: $(ARTIFACT_PREFIX)vscode_web_linux_alpine_archive-unsigned
175+
# same as above, keep legacy name
176+
- task: 1ES.PublishPipelineArtifact@1
177+
inputs:
178+
targetPath: $(WEB_PATH)
179+
artifactName: $(ARTIFACT_PREFIX)vscode_web_linux_alpine_archive-unsigned
180+
sbomEnabled: false
173181
displayName: Publish x64 web server archive
174182
condition: and(succeededOrFailed(), ne(variables['WEB_PATH'], ''), eq(variables['VSCODE_ARCH'], 'x64'))

‎build/azure-pipelines/cli/cli-apply-patches.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
steps:
2-
- template: ../distro/download-distro.yml
2+
- template: ../distro/download-distro.yml@self
33

44
- script: node build/azure-pipelines/distro/mixin-quality
55
displayName: Mixin distro quality

‎build/azure-pipelines/cli/cli-compile.yml

Lines changed: 12 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -110,13 +110,14 @@ steps:
110110
111111
Write-Host "##vso[task.setvariable variable=VSCODE_CLI_APPLICATION_NAME]$env:VSCODE_CLI_APPLICATION_NAME"
112112
113-
Move-Item -Path $(Build.SourcesDirectory)/cli/target/${{ parameters.VSCODE_CLI_TARGET }}/release/code.exe -Destination "$(Build.ArtifactStagingDirectory)/${env:VSCODE_CLI_APPLICATION_NAME}.exe"
113+
New-Item -ItemType Directory -Force -Path "$(Build.ArtifactStagingDirectory)/cli"
114+
Move-Item -Path $(Build.SourcesDirectory)/cli/target/${{ parameters.VSCODE_CLI_TARGET }}/release/code.exe -Destination "$(Build.ArtifactStagingDirectory)/cli/${env:VSCODE_CLI_APPLICATION_NAME}.exe"
114115
displayName: Stage CLI
115116
116117
- task: ArchiveFiles@2
117118
displayName: Archive CLI
118119
inputs:
119-
rootFolderOrFile: $(Build.ArtifactStagingDirectory)/$(VSCODE_CLI_APPLICATION_NAME).exe
120+
rootFolderOrFile: $(Build.ArtifactStagingDirectory)/cli/$(VSCODE_CLI_APPLICATION_NAME).exe
120121
includeRootFolder: false
121122
archiveType: zip
122123
archiveFile: $(Build.ArtifactStagingDirectory)/${{ parameters.VSCODE_CLI_ARTIFACT }}.zip
@@ -127,43 +128,19 @@ steps:
127128
VSCODE_CLI_APPLICATION_NAME=$(node -p "require(\"$VSCODE_CLI_PRODUCT_JSON\").applicationName")
128129
echo "##vso[task.setvariable variable=VSCODE_CLI_APPLICATION_NAME]$VSCODE_CLI_APPLICATION_NAME"
129130
130-
mv $(Build.SourcesDirectory)/cli/target/${{ parameters.VSCODE_CLI_TARGET }}/release/code $(Build.ArtifactStagingDirectory)/$VSCODE_CLI_APPLICATION_NAME
131+
mkdir -p $(Build.ArtifactStagingDirectory)/cli
132+
mv $(Build.SourcesDirectory)/cli/target/${{ parameters.VSCODE_CLI_TARGET }}/release/code $(Build.ArtifactStagingDirectory)/cli/$VSCODE_CLI_APPLICATION_NAME
131133
displayName: Stage CLI
132134
133-
- ${{ if contains(parameters.VSCODE_CLI_TARGET, '-darwin') }}:
134-
- task: ArchiveFiles@2
135-
displayName: Archive CLI
136-
inputs:
137-
rootFolderOrFile: $(Build.ArtifactStagingDirectory)/$(VSCODE_CLI_APPLICATION_NAME)
138-
includeRootFolder: false
135+
- task: ArchiveFiles@2
136+
displayName: Archive CLI
137+
inputs:
138+
rootFolderOrFile: $(Build.ArtifactStagingDirectory)/cli/$(VSCODE_CLI_APPLICATION_NAME)
139+
includeRootFolder: false
140+
${{ if contains(parameters.VSCODE_CLI_TARGET, '-darwin') }}:
139141
archiveType: zip
140142
archiveFile: $(Build.ArtifactStagingDirectory)/${{ parameters.VSCODE_CLI_ARTIFACT }}.zip
141-
142-
- ${{ else }}:
143-
- task: ArchiveFiles@2
144-
displayName: Archive CLI
145-
inputs:
146-
rootFolderOrFile: $(Build.ArtifactStagingDirectory)/$(VSCODE_CLI_APPLICATION_NAME)
147-
includeRootFolder: false
143+
${{ else }}:
148144
archiveType: tar
149145
tarCompression: gz
150146
archiveFile: $(Build.ArtifactStagingDirectory)/${{ parameters.VSCODE_CLI_ARTIFACT }}.tar.gz
151-
152-
# Make a folder for the SBOM for the specific artifact
153-
- ${{ if contains(parameters.VSCODE_CLI_TARGET, '-windows-') }}:
154-
- powershell: mkdir $(Build.ArtifactStagingDirectory)/sbom_${{ parameters.VSCODE_CLI_ARTIFACT }}
155-
displayName: Make folder for SBOM (Windows)
156-
157-
- ${{ else }}:
158-
- script: mkdir $(Build.ArtifactStagingDirectory)/sbom_${{ parameters.VSCODE_CLI_ARTIFACT }}
159-
displayName: Make folder for SBOM (non-Windows)
160-
161-
# The if cases above are for different OSes,
162-
# but we're still in the branch where the cli is being published in general.
163-
# Generate and publish an SBOM.
164-
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
165-
displayName: Generate SBOM
166-
inputs:
167-
BuildComponentPath: $(Build.SourcesDirectory)/cli
168-
BuildDropPath: $(Build.ArtifactStagingDirectory)/sbom_${{ parameters.VSCODE_CLI_ARTIFACT }}
169-
PackageName: Visual Studio Code CLI

‎build/azure-pipelines/cli/cli-darwin-sign.yml

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,12 @@ steps:
2626
artifact: ${{ target }}
2727
path: $(Build.ArtifactStagingDirectory)/pkg/${{ target }}
2828

29+
- task: ExtractFiles@1
30+
displayName: Extract artifact
31+
inputs:
32+
archiveFilePatterns: $(Build.ArtifactStagingDirectory)/pkg/${{ target }}/*.zip
33+
destinationFolder: $(Build.ArtifactStagingDirectory)/sign/${{ target }}
34+
2935
- script: node build/azure-pipelines/common/sign $(Agent.ToolsDirectory)/esrpclient/*/*/net6.0/esrpcli.dll sign-darwin $(ESRP-PKI) $(esrp-aad-username) $(esrp-aad-password) $(Build.ArtifactStagingDirectory)/pkg "*.zip"
3036
displayName: Codesign
3137

@@ -40,6 +46,11 @@ steps:
4046
echo "##vso[task.setvariable variable=ASSET_ID]$ASSET_ID"
4147
displayName: Set asset id variable
4248
43-
- publish: $(Build.ArtifactStagingDirectory)/pkg/${{ target }}/$(ASSET_ID).zip
49+
- task: 1ES.PublishPipelineArtifact@1
50+
inputs:
51+
targetPath: $(Build.ArtifactStagingDirectory)/pkg/${{ target }}/$(ASSET_ID).zip
52+
artifactName: $(ASSET_ID)
53+
sbomBuildDropPath: $(Build.ArtifactStagingDirectory)/sign/${{ target }}
54+
sbomPackageName: "VS Code macOS ${{ target }} CLI"
55+
sbomPackageVersion: $(Build.SourceVersion)
4456
displayName: Publish signed artifact with ID $(ASSET_ID)
45-
artifact: $(ASSET_ID)

‎build/azure-pipelines/cli/cli-publish.yml

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎build/azure-pipelines/cli/cli-win32-sign.yml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,11 @@ steps:
5959
archiveType: zip
6060
archiveFile: $(Build.ArtifactStagingDirectory)/$(ASSET_ID).zip
6161

62-
- publish: $(Build.ArtifactStagingDirectory)/$(ASSET_ID).zip
62+
- task: 1ES.PublishPipelineArtifact@1
63+
inputs:
64+
targetPath: $(Build.ArtifactStagingDirectory)/$(ASSET_ID).zip
65+
artifactName: $(ASSET_ID)
66+
sbomBuildDropPath: $(Build.ArtifactStagingDirectory)/sign/${{ target }}
67+
sbomPackageName: "VS Code Windows ${{ target }} CLI"
68+
sbomPackageVersion: $(Build.SourceVersion)
6369
displayName: Publish signed artifact with ID $(ASSET_ID)
64-
artifact: $(ASSET_ID)

‎build/azure-pipelines/cli/test.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
steps:
2-
- template: ./install-rust-posix.yml
2+
- template: ./install-rust-posix.yml@self
33

44
- script: cargo clippy -- -D warnings
55
workingDirectory: cli

‎build/azure-pipelines/common/publish.js

Lines changed: 8 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)