Skip to content

Commit 92878df

Browse files
scbeddscbedd
authored
Publish openapi-diff Using ERSP (#337)
* use 1es templates for artifact scanning * publish using esrp
1 parent 415a884 commit 92878df

7 files changed

Lines changed: 255 additions & 61 deletions

File tree

‎CONTRIBUTING.md‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -141,10 +141,9 @@ npm list -g oad # Should denote no packages installed
141141

142142
## Publish the package
143143

144-
- Ensure you bumped the package version in `openapi-diff` `package.json`.
145-
- Verify [`public.openapi-diff`] passed.
146-
- Use [`js - tools to npm - publish (@azure)`] to publish the package to the public `npm` feed.
147-
- Verify in [`@azure/oad` versions] the package was published.
144+
- Ensure you bumped the package version in [`openapi-diff`] `package.json`.
145+
- Queue a run of the [`openapi-diff-build`] and approve the 'publish' stage.
146+
- Verify in [`@azure/oad` versions] the package was published on npmjs.org.
148147
- Save it to `openapi-platform` feed via [upstream feeds of `openapi-platform`].
149148
- To make `openapi-alps` use the newly published package:
150149
- Ensure that you update the minimum package version in relevant `package.json` files and then run `rush update` and commit the changes.
@@ -160,7 +159,7 @@ npm list -g oad # Should denote no packages installed
160159
[`dotnet test`]: https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-test
161160
[`npm link`]: https://docs.npmjs.com/cli/v10/commands/npm-link
162161
[the cache]: https://docs.npmjs.com/cli/v10/configuring-npm/folders#cache
163-
[`js - tools to npm - publish (@azure)`]: https://dev.azure.com/azure-sdk/internal/_release?definitionId=24&_a=releases&view=mine
162+
[`openapi-diff-build`]: https://dev.azure.com/azure-sdk/internal/_build/index?definitionId=7030
164163
[`public.openapi-diff`]: https://dev.azure.com/azure-sdk/public/_build?definitionId=135&_a=summary
165164
[upstream feeds of `openapi-platform`]: https://devdiv.visualstudio.com/DevDiv/_artifacts/feed/openapi-platform/Npm/@azure%2Foad/upstreams/
166165
[`@azure/oad` versions]: https://www.npmjs.com/package/@azure/oad?activeTab=versions

‎azure-pipelines.yml‎

Lines changed: 85 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,64 +1,93 @@
11
trigger:
22
- main
33

4-
variables:
5-
Codeql.Enabled: true
4+
extends:
5+
template: /eng/1es-redirect.yml
6+
parameters:
7+
stages:
8+
- stage: Build
9+
variables:
10+
- template: /eng/image.yml
11+
jobs:
12+
- job: Build_linux
613

7-
strategy:
8-
matrix:
9-
Linux:
10-
Pool: azsdk-pool-mms-ubuntu-2204-general
11-
OsVmImage: ubuntu-22.04
12-
TargetFolder: drop-linux
13-
Windows:
14-
Pool: azsdk-pool-mms-win-2022-general
15-
OsVmImage: windows-2022
16-
TargetFolder: drop
14+
pool:
15+
name: $(LINUXPOOL)
16+
image: $(LINUXVMIMAGE)
17+
os: linux
1718

18-
pool:
19-
name: $(Pool)
20-
vmImage: $(OSVmImage)
19+
steps:
20+
- template: /eng/test-steps.yml
21+
parameters:
22+
ArtifactName: drop-linux
2123

22-
steps:
23-
- script: npm ci
24-
displayName: npm ci
25-
- script: npm run lint
26-
displayName: lint
27-
- script: npm run prettier
28-
displayName: prettier
29-
- script: npm test
30-
displayName: test
31-
- script: npm pack
32-
displayName: pack
33-
- task: CopyFiles@2
34-
displayName: 'Copy Files to: $(TargetFolder)'
35-
inputs:
36-
Contents: '*.tgz'
37-
TargetFolder: $(TargetFolder)
38-
- task: PublishBuildArtifacts@1
39-
inputs:
40-
pathtoPublish: $(Build.SourcesDirectory)/$(TargetFolder)
41-
artifactName: $(TargetFolder)
24+
- job: Build_Windows
4225

43-
- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2 # CredScan@2
44-
inputs:
45-
toolMajorVersion: 'V2'
46-
condition: and(succeeded(), eq(variables['Agent.OS'],'Windows_NT')) # CredScan only supported on Windows
26+
pool:
27+
name: $(WINDOWSPOOL)
28+
image: $(WINDOWSVMIMAGE)
29+
os: windows
4730

48-
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@1 # PostAnalysis@1
49-
inputs:
50-
AllTools: false
51-
APIScan: false
52-
BinSkim: false
53-
CodesignValidation: false
54-
CredScan: true
55-
FortifySCA: false
56-
FxCop: false
57-
ModernCop: false
58-
PoliCheck: false
59-
RoslynAnalyzers: false
60-
SDLNativeRules: false
61-
Semmle: false
62-
TSLint: false
63-
ToolLogsNotFoundAction: 'Standard'
64-
condition: and(succeeded(), eq(variables['Agent.OS'],'Windows_NT')) # CredScan only supported on Windows
31+
steps:
32+
- template: /eng/test-steps.yml
33+
parameters:
34+
ArtifactName: drop
35+
36+
37+
# only include if running on `internal` build with manual queue, otherwise never include
38+
- ${{ if and(in(variables['Build.Reason'], 'Manual', ''), eq(variables['System.TeamProject'], 'internal'))}}:
39+
- stage: Publish
40+
displayName: Publish
41+
dependsOn: Build_And_Test
42+
43+
jobs:
44+
- deployment: Publish
45+
environment: 'package-publish'
46+
pool:
47+
name: azsdk-pool-mms-ubuntu-2004-general
48+
image: azsdk-pool-mms-ubuntu-2004-1espt
49+
os: linux
50+
51+
strategy:
52+
runOnce:
53+
deploy:
54+
steps:
55+
- checkout: self
56+
submodules: false
57+
58+
- download: current
59+
artifact: drop
60+
timeoutInMinutes: 5
61+
62+
- task: PowerShell@2
63+
inputs:
64+
filePath: '$(Build.SourcesDirectory)/eng/scripts/determine-release-tag.ps1'
65+
failOnStderr: true
66+
pwsh: true
67+
68+
- pwsh: |
69+
Write-Host "Will deploy with tag of $(Tag)"
70+
Get-ChildItem "$(Pipeline.Workspace)/drop" -Recurse -Force `
71+
| Where-Object { $_.Name -like "*.tgz" } `
72+
| Copy-Item -Destination "$(Build.ArtifactStagingDirectory)"
73+
74+
Get-ChildItem "$(Build.ArtifactStagingDirectory)" -Recurse -Force | % { Write-Host $_.FullName }
75+
displayName: Move artifact to $(Build.ArtifactStagingDirectory)
76+
77+
- task: EsrpRelease@7
78+
inputs:
79+
displayName: 'Publish oav to ESRP'
80+
ConnectedServiceName: 'Azure SDK Engineering System'
81+
ClientId: '5f81938c-2544-4f1f-9251-dd9de5b8a81b'
82+
KeyVaultName: 'AzureSDKEngKeyVault'
83+
AuthCertName: 'azure-sdk-esrp-release-auth-certificate'
84+
SignCertName: 'azure-sdk-esrp-release-sign-certificate'
85+
Intent: 'PackageDistribution'
86+
ContentType: 'npm'
87+
FolderLocation: $(Build.ArtifactStagingDirectory)
88+
Owners: ${{ coalesce(variables['Build.RequestedForEmail'], 'azuresdk@microsoft.com') }}
89+
Approvers: 'azuresdk@microsoft.com'
90+
ServiceEndpointUrl: 'https://api.esrp.microsoft.com'
91+
MainPublisher: 'ESRPRELPACMANTEST'
92+
DomainTenantId: '72f988bf-86f1-41af-91ab-2d7cd011db47'
93+
productstate: $(Tag)

‎eng/1es-redirect.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
resources:
2+
repositories:
3+
- repository: 1ESPipelineTemplates
4+
type: git
5+
name: 1ESPipelineTemplates/1ESPipelineTemplates
6+
ref: refs/tags/release
7+
- repository: 1ESPipelineTemplatesCanary
8+
type: git
9+
name: 1ESPipelineTemplates/1ESPipelineTemplates
10+
ref: refs/tags/canary
11+
12+
parameters:
13+
- name: stages
14+
type: stageList
15+
default: []
16+
- name: Use1ESOfficial
17+
type: boolean
18+
default: true
19+
- name: oneESTemplateTag
20+
type: string
21+
default: release
22+
23+
extends:
24+
${{ if and(parameters.Use1ESOfficial, eq(parameters.oneESTemplateTag, 'canary')) }}:
25+
template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplatesCanary
26+
${{ elseif eq(parameters.oneESTemplateTag, 'canary') }}:
27+
template: v1/1ES.Unofficial.PipelineTemplate.yml@1ESPipelineTemplatesCanary
28+
${{ elseif and(parameters.Use1ESOfficial, eq(variables['System.TeamProject'], 'internal')) }}:
29+
template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
30+
${{ else }}:
31+
template: v1/1ES.Unofficial.PipelineTemplate.yml@1ESPipelineTemplates
32+
parameters:
33+
${{ if eq(parameters.oneESTemplateTag, 'canary') }}:
34+
# Enable 1es template team to verify validation has been run on canary
35+
customBuildTags:
36+
- 1ES.PT.Tag-refs/tags/canary
37+
settings:
38+
skipBuildTagsForGitHubPullRequests: true
39+
sdl:
40+
git:
41+
longpaths: true
42+
submodules: false
43+
sourceRepositoriesToScan:
44+
include:
45+
- repository: self
46+
submodule: false
47+
runInSingleJob: true
48+
sourceAnalysisPool:
49+
name: azsdk-pool-mms-win-2022-general
50+
image: azsdk-pool-mms-win-2022-1espt
51+
os: windows
52+
eslint:
53+
enabled: false
54+
justificationForDisabling: "ESLint injected task has failures because it uses an old version of mkdirp. We should not fail for tools not controlled by the repo. See: https://dev.azure.com/azur 19 e-sdk/internal/_build/results?buildId=3556850"
55+
codeql:
56+
compiled:
57+
enabled: false
58+
justificationForDisabling: "CodeQL times our pipelines out by running for 2+ hours before being force canceled."
59+
psscriptanalyzer:
60+
compiled: true
61+
break: true
62+
policy: M365
63+
64+
stages: ${{ parameters.stages }}

‎eng/image.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Default pool image selection. Set as variable so we can override at pipeline level
2+
3+
variables:
4+
- name: LINUXPOOL
5+
value: azsdk-pool-mms-ubuntu-2004-general
6+
- name: WINDOWSPOOL
7+
value: azsdk-pool-mms-win-2022-general
8+
- name: MACPOOL
9+
value: Azure Pipelines
10+
11+
- name: LINUXVMIMAGE
12+
value: azsdk-pool-mms-ubuntu-2004-1espt
13+
- name: LINUXNEXTVMIMAGE
14+
value: ubuntu-22.04
15+
- name: WINDOWSVMIMAGE
16+
value: azsdk-pool-mms-win-2022-1espt
17+
- name: MACVMIMAGE
18+
value: macos-11
19+
20+
# Values required for pool.os field in 1es pipeline templates
21+
- name: LINUXOS
22+
value: linux
23+
- name: WINDOWSOS
24+
value: windows
25+
- name: MACOS
26+
value: macOS

‎eng/publish-1es-artifact.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# This step is used to prevent duplication of artifact publishes when there is an issue that would prevent the overall success of the job.
2+
# Ensuring that we only publish when successful (and two a differently named artifact otherwise) will allow easy retry on a build pipeline
3+
# without running into the "cannot override artifact" failure when we finally do get a passing run.
4+
5+
# ArtifactName - The name of the artifact in the "successful" case.
6+
# ArtifactPath - The path we will be publishing.
7+
# CustomCondition - Used if there is additional logic necessary to prevent attempt of publish.
8+
# SbomEnabled - Set whether to auto-inject 1es pipeline template sbom tasks
9+
10+
parameters:
11+
ArtifactName: ""
12+
ArtifactPath: ""
13+
CustomCondition: true
14+
SbomEnabled: true
15+
16+
steps:
17+
- pwsh: |
18+
if ($env:AGENT_JOBSTATUS -eq "Failed") {
19+
Write-Host "##vso[task.setvariable variable=PublishArtifactName;]${{ parameters.ArtifactName }}-FailedAttempt$(System.JobAttempt)"
20+
} else {
21+
Write-Host "##vso[task.setvariable variable=PublishArtifactName;]${{ parameters.ArtifactName }}"
22+
}
23+
condition: and(succeededOrFailed(), ${{ parameters.CustomCondition }})
24+
displayName: Set Artifact Name $(Agent.JobStatus)
25+
26+
- task: 1ES.PublishPipelineArtifact@1
27+
condition: and(succeededOrFailed(), ${{ parameters.CustomCondition }})
28+
displayName: "Publish ${{ parameters.ArtifactName }} Artifacts"
29+
inputs:
30+
artifactName: "$(PublishArtifactName)"
31+
targetPath: "${{ parameters.ArtifactPath }}"
32+
sbomEnabled: ${{ parameters.SbomEnabled }}

‎eng/scripts/determine-release-tag.ps1‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Read the package.json file
2+
$packageJsonPath = "$PSScriptRoot/../../package.json"
3+
$packageJson = Get-Content $packageJsonPath -Raw | ConvertFrom-Json
4+
5+
# Function to check if a version is non-GA
6+
function Is-NonGA($version) {
7+
return $version -match "-(alpha|beta|rc|pre)"
8+
}
9+
10+
$pkgVersion = $packageJson.version
11+
12+
if (Is-NonGA($pkgVersion)) {
13+
Write-Host "##vso[task.setvariable variable=Tag;]beta"
14+
}
15+
else {
16+
Write-Host "##vso[task.setvariable variable=Tag;]latest"
17+
}
18+

‎eng/test-steps.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
parameters:
2+
- name: ArtifactName
3+
type: string
4+
default: "drop"
5+
6+
steps:
7+
- script: npm ci
8+
displayName: npm ci
9+
- script: npm run lint
10+
displayName: lint
11+
- script: npm run prettier
12+
displayName: prettier
13+
- script: npm test
14+
displayName: test
15+
- script: npm pack
16+
displayName: pack
17+
- task: CopyFiles@2
18+
displayName: "Copy Files to Staging"
19+
inputs:
20+
Contents: "*.tgz"
21+
TargetFolder: $(Build.ArtifactStagingDirectory)
22+
23+
- template: /eng/publish-1es-artifact.yml
24+
parameters:
25+
ArtifactName: ${{ parameters.ArtifactName }}
26+
ArtifactPath: $(Build.ArtifactStagingDirectory)

0 commit comments

Comments
 (0)
⚡