Skip to content

Commit 8a59f0b

Browse files
gathogojrgathogojr
committed
Add YAML-based pipelines and use managed identity
1 parent a040d26 commit 8a59f0b

1 file changed

Lines changed: 168 additions & 0 deletions

File tree

‎.pipelines/RESTier-CI.yml‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
trigger:
2+
- main
3+
4+
# name below is overridden by Set Build Name step
5+
name: 1.0.0-CI-$(Date:yyyyMMdd)$(Rev:.r)
6+
7+
variables:
8+
BuildConfiguration: Release
9+
10+
stages:
11+
12+
# ============================================================
13+
# Build stage
14+
# ============================================================
15+
- stage: Build
16+
displayName: Build and Pack Restier
17+
jobs:
18+
- job: Build
19+
pool:
20+
vmImage: windows-latest
21+
steps:
22+
- checkout: self
23+
24+
# --- Set Build Name ---
25+
- powershell: |
26+
$buildName = "1.2.0-CI-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
27+
Write-Host "##vso[build.updatebuildnumber]$buildName"
28+
displayName: Set Build Name
29+
30+
# --- SDKs ---
31+
# .slnx CLI support starting in 9.0.200
32+
- task: UseDotNet@2
33+
displayName: Use .NET SDK 10.x
34+
inputs:
35+
packageType: sdk
36+
version: 10.0.100
37+
38+
# --- Restore & Build ---
39+
- task: DotNetCoreCLI@2
40+
displayName: dotnet restore
41+
inputs:
42+
command: restore
43+
projects: 'src/RESTier.slnx'
44+
feedsToUse: config
45+
nugetConfigPath: 'NuGet.Config'
46+
47+
- task: DotNetCoreCLI@2
48+
displayName: dotnet build
49+
inputs:
50+
command: build
51+
projects: |
52+
**/*.csproj
53+
!**/Microsoft.Restier.Samples.*.*.csproj
54+
arguments: >
55+
--configuration $(BuildConfiguration)
56+
--no-restore
57+
58+
# --- Pack ---
59+
- powershell: |
60+
$projects = @(
61+
"src/Microsoft.Restier.Core/Microsoft.Restier.Core.csproj",
62+
"src/Microsoft.Restier.EntityFramework/Microsoft.Restier.EntityFramework.csproj",
63+
"src/Microsoft.Restier.EntityFrameworkCore/Microsoft.Restier.EntityFrameworkCore.csproj",
64+
"src/Microsoft.Restier.AspNet/Microsoft.Restier.AspNet.csproj",
65+
"src/Microsoft.Restier.AspNetCore/Microsoft.Restier.AspNetCore.csproj",
66+
"src/Microsoft.Restier.AspNetCore.Swagger/Microsoft.Restier.AspNetCore.Swagger.csproj",
67+
"src/Microsoft.Restier.Breakdance/Microsoft.Restier.Breakdance.csproj"
68+
)
69+
foreach ($proj in $projects) {
70+
dotnet pack $proj `
71+
--configuration $(BuildConfiguration) `
72+
--no-build `
73+
--output "$(Build.ArtifactStagingDirectory)/Packages" `
74+
/p:PackageVersion="$(Build.BuildNumber)" `
75+
/p:SymbolPackageFormat=snupkg
76+
}
77+
displayName: dotnet pack
78+
79+
# --- Validate packages ---
80+
- powershell: |
81+
if (-not (Get-ChildItem "$(Build.ArtifactStagingDirectory)/Packages" -Filter *.nupkg)) {
82+
throw "No nupkg produced"
83+
}
84+
if (-not (Get-ChildItem "$(Build.ArtifactStagingDirectory)/Packages" -Filter *.snupkg)) {
85+
throw "No snupkg produced"
86+
}
87+
displayName: Validate Packages
88+
89+
# --- Publish unsigned packages ---
90+
- task: PublishPipelineArtifact@1
91+
displayName: 'Publish Artifact: _unsignedPackages'
92+
inputs:
93+
targetPath: '$(Build.ArtifactStagingDirectory)/Packages'
94+
artifact: _unsignedPackages
95+
96+
# ============================================================
97+
# Code signing stage
98+
# ============================================================
99+
- stage: CodeSign
100+
displayName: Code Sign Packages
101+
dependsOn: Build
102+
condition: and(succeeded('Build'), not(eq(variables['Build.Reason'], 'PullRequest')))
103+
jobs:
104+
- deployment: CodeSign
105+
displayName: Code Signing
106+
pool:
107+
vmImage: windows-latest
108+
environment: Code Sign - Approvals
109+
strategy:
110+
runOnce:
111+
deploy:
112+
steps:
113+
# --- Download unsigned packages ---
114+
- task: DownloadPipelineArtifact@2
115+
displayName: Download Unsigned Packages
116+
inputs:
117+
artifact: _unsignedPackages
118+
path: $(Pipeline.Workspace)/Packages
119+
120+
# --- Install dotnet sign tool ---
121+
- task: DotNetCoreCLI@2
122+
displayName: Install SignTool
123+
inputs:
124+
command: custom
125+
custom: tool
126+
arguments: install --tool-path . --prerelease sign
127+
128+
# --- Code signing using Azure Key Vault ---
129+
- task: AzureCLI@2
130+
displayName: Code Signing - RESTier Packages
131+
inputs:
132+
azureSubscription: Code Signing
133+
scriptType: pscore
134+
scriptLocation: inlineScript
135+
inlineScript: |
136+
.\sign code azure-key-vault `
137+
"**/*.nupkg" `
138+
--base-directory "$(Pipeline.Workspace)/Packages" `
139+
--output "$(Build.ArtifactStagingDirectory)/SignedPackages" `
140+
--publisher-name "OData Labs" `
141+
--description "RESTier" `
142+
--description-url "https://github.com/OData/RESTier" `
143+
--azure-key-vault-certificate "$(SignKeyVaultCertificate)" `
144+
--azure-key-vault-url "$(SignKeyVaultUrl)"
145+
146+
# --- Copy snupkg ---
147+
- task: CopyFiles@2
148+
displayName: Copy snupkg into SignedPackages
149+
inputs:
150+
SourceFolder: '$(Pipeline.Workspace)/Packages'
151+
Contents: '*.snupkg'
152+
TargetFolder: '$(Build.ArtifactStagingDirectory)/SignedPackages'
153+
OverWrite: true
154+
155+
# --- Validate signing completeness ---
156+
157+
- powershell: |
158+
$in = (Get-ChildItem "$(Pipeline.Workspace)/Packages" -Filter *.nupkg).Count
159+
$out = (Get-ChildItem "$(Build.ArtifactStagingDirectory)/SignedPackages" -Filter *.nupkg).Count
160+
if ($in -ne $out) { throw "Signing incomplete" }
161+
displayName: Validate Signed Packages
162+
163+
# --- Publish signed artifacts ---
164+
- task: PublishPipelineArtifact@1
165+
displayName: 'Publish Artifact: drop'
166+
inputs:
167+
targetPath: '$(Build.ArtifactStagingDirectory)'
168+
artifact: drop

0 commit comments

Comments
 (0)
⚡