Skip to content

Commit c7a1a31

Browse files
JimSuplizioJimSuplizio
authored
Merge 22f0648 into f5b9637 
2 parents f5b9637 + 22f0648 commit c7a1a31

File tree

9 files changed

+275
-194
lines changed

9 files changed

+275
-194
lines changed

‎.vscode/cspell.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"en-gb"
1111
],
1212
"ignorePaths": [
13-
"eng/common/**",
13+
"eng/**",
1414
".vscode/cspell.json"
1515
],
1616
"words": [

‎eng/pipelines/templates/stages/1es-redirect.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,15 @@ extends:
4444
exclude:
4545
- repository: azure-sdk-build-tools
4646
runInSingleJob: true
47+
# Turn off the build warnings caused by disabling some sdl checks
48+
createAdoIssuesForJustificationsForDisablement: false
49+
binskim:
50+
# Exclude imported azure-sdk-build-tools gpg/azcopy binaries
51+
# See https://dev.azure.com/securitytools/SecurityIntegration/_wiki/wikis/Guardian/1378/Glob-Format
52+
analyzeTargetGlob: +:file|**/*.jar;+:file|**/*.exe;-:f|**/tools/gpg/**/*.dll;-:f|**/tools/gpg/**/*.exe;-:f|**/tools/azcopy/**/*.exe;-:f|**/tools/azcopy/**/*.dll
53+
# TODO: migrate analyze spot bugs configuration eng/pipelines/templates/jobs/archetype-sdk-client.yml's task named "Run code quality tools (lint, checkstyle and spotbug)"
54+
spotBugs:
55+
enabled: false
4756
eslint:
4857
enabled: false
4958
justificationForDisabling: 'ESLint injected task has failures because it uses an old version of mkdirp. We should not fail for tools not controlled by the repo. See: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=3499746'

‎eng/pipelines/templates/stages/archetype-android-release.yml‎

Lines changed: 104 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -19,36 +19,72 @@ stages:
1919
- stage: Signing
2020
dependsOn: ${{parameters.DependsOn}}
2121
jobs:
22-
- deployment: SignPackage
23-
environment: esrp
22+
- job: SignPackage
2423
timeoutInMinutes: 20
2524
pool:
26-
name: azsdk-pool-mms-ubuntu-2004-general
27-
image: azsdk-pool-mms-ubuntu-2004-1espt
28-
os: linux
29-
30-
strategy:
31-
runOnce:
32-
deploy:
33-
steps:
34-
- checkout: self
35-
36-
- checkout: azure-sdk-build-tools
37-
path: azure-sdk-build-tools
38-
39-
- download: current
40-
artifact: ${{parameters.ArtifactName}}
41-
timeoutInMinutes: 5
42-
43-
- template: /tools/java-esrp-signing/java-esrp-signing.yml@azure-sdk-build-tools
44-
parameters:
45-
Artifacts: ${{parameters.Artifacts}}
46-
ArtifactDirectory: $(Pipeline.Workspace)/${{parameters.ArtifactName}}
47-
48-
- template: /eng/common/pipelines/templates/steps/publish-1es-artifact.yml
49-
parameters:
50-
ArtifactName: ${{parameters.ArtifactName}}-signed
51-
ArtifactPath: $(Pipeline.Workspace)/${{parameters.ArtifactName}}
25+
name: azsdk-pool-mms-win-2022-general
26+
image: azsdk-pool-mms-win-2022-1espt
27+
os: windows
28+
steps:
29+
- checkout: self
30+
31+
- checkout: azure-sdk-build-tools
32+
path: azure-sdk-build-tools
33+
34+
- template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
35+
parameters:
36+
SkipCheckoutNone: true
37+
Repositories:
38+
- Name: Azure/azure-sdk-for-android
39+
Commitish: $(Build.SourceVersion)
40+
WorkingDirectory: $(Pipeline.Workspace)/azure-sdk-for-android
41+
42+
- download: current
43+
displayName: 'Download Artifact: ${{parameters.ArtifactName}}'
44+
artifact: ${{parameters.ArtifactName}}
45+
46+
- template: /tools/java-esrp-signing/java-esrp-signing.yml@azure-sdk-build-tools
47+
parameters:
48+
Artifacts: ${{parameters.Artifacts}}
49+
ArtifactDirectory: $(Pipeline.Workspace)/${{parameters.ArtifactName}}
50+
51+
# Publish the ESRP signed directory. This will still be used by the
52+
# Dev feed publish.
53+
- template: /eng/common/pipelines/templates/steps/publish-1es-artifact.yml
54+
parameters:
55+
ArtifactPath: $(Pipeline.Workspace)/${{parameters.ArtifactName}}
56+
ArtifactName: ${{parameters.ArtifactName}}-signed
57+
58+
# Downloading the ESRP signed artifacts
59+
- download: current
60+
displayName: 'Download Signed Artifacts'
61+
artifact: ${{parameters.ArtifactName}}-signed
62+
63+
# Unfortunately, the way single libraries publishing works with ESRP is that only
64+
# what's being published can be in the directory. gpg sign and flatten needs to be
65+
# done for each artifact and the resulting directory is filtered by the groupId and
66+
# artifactId. The flattened directory needs to have the artifact name in it to be
67+
# unique since each publish task only publishes a single library.
68+
- ${{ each artifact in parameters.Artifacts }}:
69+
- template: tools/gpg/gpg.yml@azure-sdk-build-tools
70+
- template: /eng/pipelines/templates/steps/gpg-sign-and-flatten.yml
71+
parameters:
72+
ArtifactID: ${{artifact.name}}
73+
GroupID: ${{artifact.groupId}}
74+
ArtifactDirectory: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed
75+
OutputDirectory: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-${{artifact.name}}-esrp-gpg-signed
76+
FlattenedESRPDirectory: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-${{artifact.name}}-esrp-flattened
77+
# Note: In spite of the fact that the variable is named JavaRepoRoot, the
78+
# root needs to be the root of the android repository. This template, like many
79+
# of the release steps and scripts, is copied from Java.
80+
JavaRepoRoot: $(Pipeline.Workspace)/azure-sdk-for-android
81+
82+
# The packages-esrp-gpg-signed will be used for the ESRP publish for Android which
83+
# is still a single library publish and doesn't require the flattened directory
84+
- template: /eng/common/pipelines/templates/steps/publish-1es-artifact.yml
85+
parameters:
86+
ArtifactPath: '$(Pipeline.Workspace)/${{parameters.ArtifactName}}-${{artifact.name}}-esrp-flattened'
87+
ArtifactName: '${{parameters.ArtifactName}}-${{artifact.name}}-esrp-flattened'
5288

5389
# We generate two interdependent stages for each artifact listed in the ci.yml file, creates the release
5490
# in GitHub. The Release stage publishes to Maven Central. Both stages require approval since they
@@ -62,10 +98,9 @@ stages:
6298
dependsOn: Signing
6399
condition: and(succeeded(), ne(variables['SetDevVersion'], 'true'), ne(variables['Skip.Release'], 'true'), ne(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-android-pr'))
64100
jobs:
65-
- deployment: TagRepository
101+
- job: TagRepository
66102
displayName: "Create release tag"
67103
condition: ne(variables['Skip.TagRepository'], 'true')
68-
environment: maven
69104
timeoutInMinutes: 5
70105
dependsOn:
71106
- ${{ if eq(parameters.VerifyVersions, 'true')}}:
@@ -75,92 +110,67 @@ stages:
75110
name: azsdk-pool-mms-win-2022-general
76111
image: azsdk-pool-mms-win-2022-1espt
77112
os: windows
78-
79-
strategy:
80-
runOnce:
81-
deploy:
82-
steps:
83-
- checkout: self
84-
- download: current
85-
displayName: 'Download Artifact: ${{parameters.ArtifactName}}-signed'
86-
artifact: ${{parameters.ArtifactName}}-signed
87-
- template: /eng/common/pipelines/templates/steps/create-tags-and-git-release.yml
88-
parameters:
89-
ArtifactLocation: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed/${{artifact.safeName}}
90-
PackageRepository: Maven
91-
ReleaseSha: $(Build.SourceVersion)
113+
steps:
114+
- checkout: self
115+
- download: current
116+
displayName: 'Download Artifact: ${{parameters.ArtifactName}}-signed'
117+
artifact: ${{parameters.ArtifactName}}-signed
118+
- template: /eng/common/pipelines/templates/steps/create-tags-and-git-release.yml
119+
parameters:
120+
ArtifactLocation: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed/${{artifact.safeName}}
121+
PackageRepository: Maven
122+
ReleaseSha: $(Build.SourceVersion)
92123

93124
- ${{if ne(artifact.options.skipPublishPackage, 'true')}}:
94-
- deployment: PublishPackage
95-
displayName: "Publish to Maven Central"
125+
- deployment: PublishESRPPackage
126+
displayName: "Publish to Maven Central via ESRP"
96127
condition: and(succeeded(), ne(variables['Skip.PublishPackage'], 'true'))
97128
environment: maven
98129
dependsOn: TagRepository
99130

131+
templateContext:
132+
type: releaseJob
133+
isProduction: true
134+
inputs:
135+
- input: pipelineArtifact
136+
artifactName: '${{parameters.ArtifactName}}-${{artifact.name}}-esrp-flattened'
137+
targetPath: '$(Pipeline.Workspace)/${{parameters.ArtifactName}}-${{artifact.name}}-esrp-flattened'
138+
100139
pool:
101140
name: azsdk-pool-mms-win-2022-general
102141
image: azsdk-pool-mms-win-2022-1espt
103142
os: windows
104-
105143
strategy:
106144
runOnce:
107145
deploy:
108146
steps:
109-
- checkout: self
110-
- checkout: azure-sdk-build-tools
111-
path: azure-sdk-build-tools
112-
- template: tools/gpg/gpg.yml@azure-sdk-build-tools
113-
- template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
147+
- template: /eng/pipelines/templates/steps/java-esrp-publishing.yml
114148
parameters:
115-
SkipCheckoutNone: true
116-
Repositories:
117-
- Name: Azure/azure-sdk-for-android
118-
Commitish: $(Build.SourceVersion)
119-
WorkingDirectory: $(Pipeline.Workspace)/azure-sdk-for-android
120-
121-
- template: /eng/pipelines/templates/steps/java-publishing.yml
122-
parameters:
123-
ArtifactID: ${{artifact.name}}
124-
GroupID: ${{artifact.groupId}}
125-
ArtifactDirectory: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed
126-
OutputDirectory: $(Pipeline.Workspace)/EsrpPackages
127-
Target: EsrpRelease
128-
# Note: In spite of the fact that the variable is named JavaRepoRoot, the
129-
# root needs to be the root of the android repository
130-
JavaRepoRoot: $(Pipeline.Workspace)/azure-sdk-for-android
131-
132-
- template: /eng/common/pipelines/templates/steps/publish-1es-artifact.yml
133-
parameters:
134-
ArtifactName: ${{parameters.ArtifactName}}-${{artifact.name}}-esrp-$(System.JobAttempt)
135-
ArtifactPath: $(Pipeline.Workspace)/EsrpPackages
149+
FlattenedDirectory: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-${{artifact.name}}-esrp-flattened
136150

137151
- ${{if ne(artifact.options.skipPublishDocs, 'true')}}:
138-
- deployment: PublishDocs
152+
- job: PublishDocs
139153
displayName: Publish Docs to GitHubIO Blob Storage
140154
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'))
141-
environment: maven
142-
dependsOn: PublishPackage
155+
dependsOn: PublishESRPPackage
143156

144157
pool:
145158
name: azsdk-pool-mms-win-2022-general
146159
image: azsdk-pool-mms-win-2022-1espt
147160
os: windows
148161

149-
strategy:
150-
runOnce:
151-
deploy:
152-
steps:
153-
- template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
154-
- download: current
155-
displayName: 'Download Artifact: ${{parameters.ArtifactName}}-signed'
156-
artifact: ${{parameters.ArtifactName}}-signed
157-
patterns: ${{artifact.safeName}}/**
158-
- pwsh: |
159-
Get-ChildItem -Recurse $(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed/${{artifact.safeName}}
160-
workingDirectory: $(Pipeline.Workspace)
161-
displayName: Output Visible Artifacts
162-
- template: /eng/common/pipelines/templates/steps/publish-blobs.yml
163-
parameters:
164-
FolderForUpload: '$(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed/${{artifact.safeName}}'
165-
TargetLanguage: 'android'
166-
ArtifactLocation: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed/${{artifact.safeName}}
162+
steps:
163+
- template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
164+
- download: current
165+
displayName: 'Download Artifact: ${{parameters.ArtifactName}}-signed'
166+
artifact: ${{parameters.ArtifactName}}-signed
167+
patterns: ${{artifact.safeName}}/**
168+
- pwsh: |
169+
Get-ChildItem -Recurse $(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed/${{artifact.safeName}}
170+
workingDirectory: $(Pipeline.Workspace)
171+
displayName: Output Visible Artifacts
172+
- template: /eng/common/pipelines/templates/steps/publish-blobs.yml
173+
parameters:
174+
FolderForUpload: '$(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed/${{artifact.safeName}}'
175+
TargetLanguage: 'android'
176+
ArtifactLocation: $(Pipeline.Workspace)/${{parameters.ArtifactName}}-signed/${{artifact.safeName}}

‎eng/pipelines/templates/steps/gpg-sign-and-flatten.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
parameters:
2+
ArtifactDirectory: not-specified
3+
OutputDirectory: not-specified
4+
FlattenedESRPDirectory: not-specified
5+
GroupID:
6+
ArtifactID:
7+
GPGExecutablePath: $(Pipeline.Workspace)/azure-sdk-build-tools/tools/gpg/bin/gpg.exe
8+
JavaRepoRoot: $(Pipeline.Workspace)/azure-sdk-for-java
9+
10+
steps:
11+
- task: PowerShell@2
12+
displayName: 'Gpg sign and hash packages'
13+
inputs:
14+
pwsh: true
15+
workingDirectory: $(Agent.BuildDirectory)
16+
filePath: ${{ parameters.JavaRepoRoot }}/eng/scripts/SignAndHash-MavenPackages.ps1
17+
arguments: >
18+
-Path ${{ parameters.ArtifactDirectory }}
19+
-DestinationPath ${{ parameters.OutputDirectory }}
20+
-GroupIDFilter "${{ parameters.GroupID }}"
21+
-ArtifactIDFilter "${{ parameters.ArtifactID }}"
22+
-GPGExecutablePath ${{ parameters.GPGExecutablePath }}
23+
-InformationAction Continue
24+
# ESRP needs to have the output folder flattened in order to do a bulk publish
25+
# The flattened folder is only used by ESRP
26+
- task: PowerShell@2
27+
displayName: 'Flatten output folder for ESRP'
28+
inputs:
29+
pwsh: true
30+
workingDirectory: $(Agent.BuildDirectory)
31+
filePath: ${{ parameters.JavaRepoRoot }}/eng/scripts/Flatten-MavenPackageFolder.ps1
32+
arguments: >
33+
-SignedDirectory ${{ parameters.OutputDirectory }}
34+
-FlattenedDirectory ${{ parameters.FlattenedESRPDirectory }}
35+
-InformationAction Continue

‎eng/pipelines/templates/steps/java-dev-feed-publishing.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
parameters:
2+
ArtifactDirectory: not-specified
3+
OutputDirectory: not-specified
4+
RepositoryUrl: not-specified
5+
GroupID:
6+
ArtifactID:
7+
GPGExecutablePath: $(Pipeline.Workspace)/azure-sdk-build-tools/tools/gpg/bin/gpg.exe
8+
JavaRepoRoot: $(Pipeline.Workspace)/azure-sdk-for-java
9+
ShouldPublish: true
10+
11+
steps:
12+
- ${{if eq(parameters.Target, 'JavaDevFeed')}}:
13+
- task: PowerShell@2
14+
displayName: 'Publish to Java Dev Feed'
15+
inputs:
16+
pwsh: true
17+
workingDirectory: $(Agent.BuildDirectory)
18+
filePath: ${{ parameters.JavaRepoRoot }}/eng/scripts/Publish-MavenPackages.ps1
19+
arguments: >
20+
-ArtifactDirectory ${{ parameters.ArtifactDirectory }}
21+
-GroupIDFilter "${{ parameters.GroupID }}"
22+
-ArtifactIDFilter "${{ parameters.ArtifactID }}"
23+
-RepositoryUrl ${{ parameters.RepositoryUrl }}
24+
-RepositoryUsername nobody
25+
-RepositoryPassword $(System.AccessToken)
26+
-GPGExecutablePath ${{ parameters.GPGExecutablePath }}
27+
-ShouldPublish:$${{parameters.ShouldPublish}}
28+
-InformationAction Continue
29+
30+
- ${{if eq(parameters.Target, 'AndroidDevFeed')}}:
31+
- task: PowerShell@2
32+
displayName: 'Publish to Android Public Dev Feed'
33+
inputs:
34+
pwsh: true
35+
workingDirectory: $(Agent.BuildDirectory)
36+
filePath: ${{ parameters.JavaRepoRoot }}/eng/scripts/Publish-MavenPackages.ps1
37+
arguments: >
38+
-ArtifactDirectory ${{ parameters.ArtifactDirectory }}
39+
-GroupIDFilter "${{ parameters.GroupID }}"
40+
-ArtifactIDFilter "${{ parameters.ArtifactID }}"
41+
-RepositoryUrl https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-android/maven/v1
42+
-RepositoryUsername nobody
43+
-RepositoryPassword $(System.AccessToken)
44+
-GPGExecutablePath ${{ parameters.GPGExecutablePath }}
45+
-ShouldPublish:$${{parameters.ShouldPublish}}
46+
-InformationAction Continue

‎eng/pipelines/templates/steps/java-esrp-publishing.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
parameters:
2+
# This is the flattened
3+
FlattenedDirectory: not-specified
4+
ShouldPublish: true
5+
6+
steps:
7+
- ${{if eq(parameters.ShouldPublish, 'true')}}:
8+
- task: EsrpRelease@9
9+
displayName: 'Publish to ESRP'
10+
inputs:
11+
ConnectedServiceName: Azure SDK PME Managed Identity
12+
Usemanagedidentity: true
13+
DomainTenantId: 975f013f-7f24-47e8-a7d3-abc4752bf346
14+
ClientId: 5f81938c-2544-4f1f-9251-dd9de5b8a81b
15+
KeyVaultName: kv-azuresdk-codesign
16+
SignCertName: azure-sdk-esrp-release-certificate
17+
Intent: 'PackageDistribution'
18+
ContentType: 'Maven'
19+
FolderLocation: ${{ parameters.FlattenedDirectory }}
20+
Owners: ${{ coalesce(variables['Build.RequestedForEmail'], '[email protected]') }}
21+
Approvers: ${{ coalesce(variables['Build.RequestedForEmail'], '[email protected]') }}
22+
ServiceEndpointUrl: 'https://api.esrp.microsoft.com'
23+
MainPublisher: 'ESRPRELPACMANTEST'

0 commit comments

Comments
 (0)