|
| 1 | +# Copyright (c) Microsoft Corporation. |
| 2 | +# Licensed under the MIT License. |
| 3 | + |
| 4 | +jobs: |
| 5 | +- job: APIScan |
| 6 | + displayName: APIScan with fxdependent build |
| 7 | + condition: succeeded() |
| 8 | + pool: |
| 9 | + type: windows |
| 10 | + variables: |
| 11 | + - name: runCodesignValidationInjection |
| 12 | + value : false |
| 13 | + - name: NugetSecurityAnalysisWarningLevel |
| 14 | + value: none |
| 15 | + # Defines the variables APIScanClient, APIScanTenant and APIScanSecret |
| 16 | + - group: PS-PS-APIScan |
| 17 | + - group: 'Azure Blob variable group' |
| 18 | + - group: mscodehub-feed-read-general |
| 19 | + - group: mscodehub-feed-read-akv |
| 20 | + - name: ob_outputDirectory |
| 21 | + value: '$(Build.ArtifactStagingDirectory)\ONEBRANCH_ARTIFACT' |
| 22 | + - name: repoRoot |
| 23 | + value: $(Build.SourcesDirectory)\AIShell |
| 24 | + - name: ob_sdl_tsa_configFile |
| 25 | + value: $(repoRoot)\.config\tsaoptions.json |
| 26 | + - name: Codeql.SourceRoot |
| 27 | + value: $(repoRoot) |
| 28 | + |
| 29 | + # APIScan can take a long time |
| 30 | + timeoutInMinutes: 180 |
| 31 | + |
| 32 | + steps: |
| 33 | + - checkout: self |
| 34 | + clean: true |
| 35 | + fetchTags: true |
| 36 | + fetchDepth: 1000 |
| 37 | + displayName: Checkout AIShell |
| 38 | + retryCountOnTaskFailure: 1 |
| 39 | + env: |
| 40 | + ob_restore_phase: true # This ensures checkout is done at the beginning of the restore phase |
| 41 | + |
| 42 | + - template: ..\update-nuget-config.yml@self |
| 43 | + parameters: |
| 44 | + repoRoot: $(repoRoot) |
| 45 | + |
| 46 | + - task: UseDotNet@2 |
| 47 | + displayName: 'Use .NET Core sdk' |
| 48 | + inputs: |
| 49 | + useGlobalJson: true |
| 50 | + packageType: 'sdk' |
| 51 | + workingDirectory: $(Build.SourcesDirectory)" |
| 52 | + |
| 53 | + # - pwsh: | |
| 54 | + # dotnet tool install dotnet-symbol --tool-path $(Agent.ToolsDirectory)\tools\dotnet-symbol |
| 55 | + # $symbolToolPath = Get-ChildItem -Path $(Agent.ToolsDirectory)\tools\dotnet-symbol\dotnet-symbol.exe | Select-Object -First 1 -ExpandProperty FullName |
| 56 | + # Write-Host "##vso[task.setvariable variable=symbolToolPath]$symbolToolPath" |
| 57 | + # displayName: Install dotnet-symbol |
| 58 | + # workingDirectory: '$(repoRoot)' |
| 59 | + # retryCountOnTaskFailure: 2 |
| 60 | + |
| 61 | + - task: AzurePowerShell@5 |
| 62 | + displayName: Download winverify-private Artifacts |
| 63 | + inputs: |
| 64 | + azureSubscription: az-blob-cicd-infra |
| 65 | + scriptType: inlineScript |
| 66 | + azurePowerShellVersion: LatestVersion |
| 67 | + workingDirectory: '$(repoRoot)' |
| 68 | + pwsh: true |
| 69 | + inline: | |
| 70 | + # download smybols for getfilesiginforedist.dll |
| 71 | + $storageAccountName = "pscoretestdata" |
| 72 | + $containerName = 'winverify-private' |
| 73 | + $winverifySymbolsPath = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)\winverify-symbols' -Force |
| 74 | + $dllName = 'getfilesiginforedist.dll' |
| 75 | + $winverifySymbolsDllPath = Join-Path $winverifySymbolsPath $dllName |
| 76 | +
|
| 77 | + $context = New-AzStorageContext -StorageAccountName $storageAccountName -UseConnectedAccount |
| 78 | + Get-AzStorageBlobContent -Container $containerName -Blob $dllName -Destination $winverifySymbolsDllPath -Context $context |
| 79 | +
|
| 80 | + - pwsh: | |
| 81 | + Get-ChildItem -Path '$(System.ArtifactsDirectory)\winverify-symbols' |
| 82 | + displayName: Capture winverify-private Artifacts |
| 83 | + workingDirectory: '$(repoRoot)' |
| 84 | + condition: succeededOrFailed() |
| 85 | +
|
| 86 | + - task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step. |
| 87 | + displayName: 🔏 CodeQL 3000 Init |
| 88 | + condition: eq(variables['CODEQL_ENABLED'], 'true') |
| 89 | + inputs: |
| 90 | + Language: csharp |
| 91 | + |
| 92 | + - pwsh: | |
| 93 | + Import-Module '$(repoRoot)\build.psm1' -Force |
| 94 | + Start-Build -Configuration StaticAnalysis -Runtime fxdependent -Clean -Verbose |
| 95 | +
|
| 96 | + $outputJson = '$(repoRoot)\_build_output_.json' |
| 97 | + if (-not (Test-Path $outputJson)) { |
| 98 | + throw "'_build_output_.json' was not produced." |
| 99 | + } |
| 100 | +
|
| 101 | + $result = Get-Content $outputJson | ConvertFrom-Json |
| 102 | + $OutputFolder = $result.App |
| 103 | + Write-Verbose "App path: $OutputFolder" -Verbose |
| 104 | +
|
| 105 | + Write-Verbose -Verbose -Message "Deleting the 'ref' folder ..." |
| 106 | + if (Test-Path $OutputFolder\ref) { |
| 107 | + Remove-Item -Recurse -Force $OutputFolder\ref |
| 108 | + } |
| 109 | +
|
| 110 | + # Only keep windows runtimes |
| 111 | + Write-Verbose -Verbose -Message "Deleting non-win-x64 runtimes ..." |
| 112 | + Get-ChildItem -Path "$OutputFolder\runtimes\*" | Where-Object {$_.FullName -notmatch '.*\\runtimes\\win'} | Foreach-Object { |
| 113 | + Write-Verbose -Verbose -Message "Deleting $($_.FullName)" |
| 114 | + Remove-Item -Path $_.FullName -Recurse -Force |
| 115 | + } |
| 116 | +
|
| 117 | + # Remove win-x86/arm/arm64 runtimes due to issues with those runtimes |
| 118 | + Write-Verbose -Verbose -Message "Temporarily deleting win-x86/arm/arm64 runtimes ..." |
| 119 | + Get-ChildItem -Path "$OutputFolder\runtimes\*" | Where-Object {$_.FullName -match '.*\\runtimes\\win-(x86|arm)'} | Foreach-Object { |
| 120 | + Write-Verbose -Verbose -Message "Deleting $($_.FullName)" |
| 121 | + Remove-Item -Path $_.FullName -Recurse -Force |
| 122 | + } |
| 123 | +
|
| 124 | + Write-Host |
| 125 | + Write-Verbose -Verbose -Message "Show content in 'runtimes' folder:" |
| 126 | + Get-ChildItem -Path "$OutputFolder\runtimes" |
| 127 | + Write-Host |
| 128 | +
|
| 129 | + # Replace 'getfilesiginforedist.dll' from the 'runtimes\win-x64' folder |
| 130 | + Write-Verbose -Verbose -Message "Replace 'getfilesiginforedist.dll':" |
| 131 | + $targetFile = Get-ChildItem -Path "$OutputFolder\runtimes\*" -Recurse | Where-Object {$_.Name -eq 'getfilesiginforedist.dll'} |
| 132 | + Remove-Item -Path $targetFile.FullName -Verbose |
| 133 | + Copy-Item -Path '$(System.ArtifactsDirectory)\winverify-symbols\getfilesiginforedist.dll' -Destination $targetFile.FullName -Verbose |
| 134 | +
|
| 135 | + Write-Host "##vso[task.setvariable variable=appPath]$OutputFolder" |
| 136 | + workingDirectory: '$(repoRoot)' |
| 137 | + displayName: 'Build AIShell Source' |
| 138 | +
|
| 139 | + - pwsh: | |
| 140 | + $Destination = '$(ob_outputDirectory)' |
| 141 | + if (-not (Test-Path $Destination)) { |
| 142 | + Write-Verbose -Verbose -Message "Creating destination folder '$Destination'" |
| 143 | + $null = mkdir $Destination |
| 144 | + } |
| 145 | +
|
| 146 | + Write-Verbose -Verbose -Message "Copy AIShell app to '$Destination':" |
| 147 | + Copy-Item -Path '$(appPath)\*' -Destination $Destination -Recurse -Verbose |
| 148 | +
|
| 149 | + Write-Host |
| 150 | + Write-Verbose -Verbose -Message "Show content in '$Destination':" |
| 151 | + Get-ChildItem -Path $Destination | Out-String -width 150 |
| 152 | + Write-Host |
| 153 | + Write-Verbose -Verbose -Message "Show content in '$Destination\runtimes':" |
| 154 | + Get-ChildItem -Path "$Destination\runtimes" -Recurse | Out-String -width 150 |
| 155 | + workingDirectory: '$(repoRoot)' |
| 156 | + displayName: 'Copy AIShell to ob_outputDirectory' |
| 157 | +
|
| 158 | + - task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step. |
| 159 | + displayName: 🔏 CodeQL 3000 Finalize |
| 160 | + condition: eq(variables['CODEQL_ENABLED'], 'true') |
| 161 | + |
| 162 | + - pwsh: | |
| 163 | + Get-ChildItem -Path env: | Out-String -width 150 -Stream | write-Verbose -Verbose |
| 164 | + workingDirectory: '$(repoRoot)' |
| 165 | + displayName: Capture Environment |
| 166 | + condition: succeededOrFailed() |
| 167 | +
|
| 168 | + # Explicitly download symbols for the drop since the SDL image doesn't have http://SymWeb access and APIScan cannot handle https yet. |
| 169 | + # - pwsh: | |
| 170 | + # $pat = '$(SymbolServerPAT)' |
| 171 | + # if ($pat -like '*PAT*' -or $pat -eq '') |
| 172 | + # { |
| 173 | + # throw 'No PAT defined' |
| 174 | + # } |
| 175 | + # $url = 'https://microsoft.artifacts.visualstudio.com/defaultcollection/_apis/symbol/symsrv' |
| 176 | + # $(symbolToolPath) --authenticated-server-path $(SymbolServerPAT) $url --symbols -d "$env:ob_outputDirectory\*" --recurse-subdirectories |
| 177 | + # displayName: 'Download Symbols for binaries' |
| 178 | + # retryCountOnTaskFailure: 2 |
| 179 | + # workingDirectory: '$(repoRoot)' |
| 180 | + |
| 181 | + - pwsh: | |
| 182 | + Get-ChildItem '$(ob_outputDirectory)' -File -Recurse | |
| 183 | + Foreach-Object { |
| 184 | + [pscustomobject]@{ |
| 185 | + Path = $_.FullName |
| 186 | + Version = $_.VersionInfo.FileVersion |
| 187 | + Md5Hash = (Get-FileHash -Algorithm MD5 -Path $_.FullName).Hash |
| 188 | + Sha512Hash = (Get-FileHash -Algorithm SHA512 -Path $_.FullName).Hash |
| 189 | + } |
| 190 | + } | Export-Csv -Path '$(Build.SourcesDirectory)\ReleaseFileHash.csv' |
| 191 | + workingDirectory: '$(repoRoot)' |
| 192 | + displayName: 'Create release file hash artifact' |
| 193 | +
|
| 194 | + - pwsh: | |
| 195 | + Copy-Item -Path '$(Build.SourcesDirectory)\ReleaseFileHash.csv' -Destination '$(ob_outputDirectory)' -Verbose |
| 196 | + displayName: 'Publish Build File Hash artifact' |
0 commit comments