azure-pipelines.yml

parameters:
  - name: IsFinalBuild
    type: boolean
    default: false

variables:
  - name: IsFinalBuild
    value: ${{ parameters.IsFinalBuild }}
  - name: _BuildConfig
    value: Release
  - name: _TeamName
    value: AspNetCore
  - name: DOTNET_SKIP_FIRST_TIME_EXPERIENCE
    value: true
  - name: _PublishUsingPipelines
    value: true
  - name: _DotNetArtifactsCategory
    value: ASPNETENTITYFRAMEWORK6
  - group: DotNet-MSRC-Storage
  - name: _InternalRuntimeDownloadArgs
    value: /p:DotNetRuntimeSourceFeed=https://dotnetclimsrc.blob.core.windows.net/dotnet /p:DotNetRuntimeSourceFeedKey=$(dotnetclimsrc-read-sas-token-base64)
  - template: /eng/common/templates-official/variables/pool-providers.yml@self
trigger:
  batch: true
  branches:
    include:
      - main
      - release/*
      - internal/release/6.*
pr: ['*']
resources:
  repositories:
    - repository: 1ESPipelineTemplates
      type: git
      name: 1ESPipelineTemplates/1ESPipelineTemplates
      ref: refs/tags/release
extends:
  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
  parameters:
    featureFlags:
      autoBaseline: false
      usePrefastVersion3: true
    sdl:
      createAdoIssuesForJustificationsForDisablement: false
      sourceAnalysisPool:
        name: $(DncEngInternalBuildPool)
        image: 1es-windows-2022
        os: windows
      baseline:
        baselineFile: $(Build.SourcesDirectory)\.config\guardian\.gdnbaselines
      binskim:
        scanOutputDirectoryOnly: true
        preReleaseVersion: '4.3.1'
        analyzeTargetGlob: +:f|artifacts/bin/**/*.dll;+:f|artifacts/bin/**/*.exe;
      env:
        GDN_EXTRACT_TOOLS: "binskim"
        GDN_EXTRACT_TARGETS: true
        GDN_EXTRACT_FILTER: "f|**\\*.zip;f|**\\*.nupkg;f|**\\*.vsix;f|**\\*.cspkg;f|**\\*.sfpkg;f|**\\*.package"
      policheck:
        enabled: true
      tsa:
        enabled: true
      settings:
        networkIsolationPolicy: Permissive,CFSClean,CFSClean2
    customBuildTags:
    - ES365AIMigrationTooling
    stages:
    - stage: build
      displayName: Build
      jobs:
      - template: /eng/common/templates-official/jobs/jobs.yml@self
        parameters:
          enableMicrobuild: true
          enablePublishBuildArtifacts: true
          enablePublishBuildAssets: true
          enablePublishTestResults: true
          enablePublishUsingPipelines: ${{ variables._PublishUsingPipelines }}
          enableTelemetry: true
          helixRepo: dotnet/ef6
          # WORKAROUND: BinSkim requires the folder to exist prior to scanning.
          preSteps:
            - powershell: New-Item -ItemType Directory -Path $(Build.SourcesDirectory)/artifacts/bin -Force
              displayName: Create artifacts/bin directory
          jobs:
          - job: Windows
            pool:
              name: $(DncEngInternalBuildPool)
              demands: ImageOverride -equals 1es-windows-2022
              os: windows
            timeoutInMinutes: 240
            variables:
              - _AdditionalBuildArgs: ''
              - _InternalBuildArgs: ''
              - ${{ if notin(variables['Build.Reason'], 'PullRequest') }}:
                - _SignType: real
                - _Sign: true
                - _InternalBuildArgs: /p:DotNetSignType=$(_SignType) /p:TeamName=$(_TeamName) /p:OfficialBuildId=$(BUILD.BUILDNUMBER) /p:DotNetPublishUsingPipelines=$(_PublishUsingPipelines) /p:DotNetArtifactsCategory=$(_DotNetArtifactsCategory)
                - ${{ if eq(parameters.IsFinalBuild, true) }}:
                  - _AdditionalBuildArgs: /p:StabilizePackageVersion=true
              # Ignore test and infrastructure code.
              - Codeql.SourceRoot: src
              # CodeQL3000 needs this plumbed along as a variable to enable TSA.
              - Codeql.TSAEnabled: true
              # Default expects tsaoptions.json under SourceRoot.
              - Codeql.TSAOptionsPath: '$(Build.SourcesDirectory)/.config/tsaoptions.json'
            steps:
              - powershell: >
                  Get-ChildItem -ErrorAction SilentlyContinue -Recurse 'C:\Program Files\Microsoft SQL Server\sqlcmd.exe' | Sort-Object -Property @{Expression={$_.FullName.Length}; Descending=$true},@{Expression={$_.FullName}; Descending=$true} | Select-Object -First 1 | Foreach-Object {Write-Host "##vso[task.prependpath]$($_.DirectoryName)"}
                displayName: Add SqlCmd to path
              - script: tools\CleanMSSQLLocalDB.cmd
                displayName: Cleanup LocalDB databases
              - task: NuGetCommand@2
                displayName: 'Clear NuGet caches'
                condition: succeeded()
                inputs:
                  command: custom
                  arguments: 'locals all -clear'
              - task: PowerShell@2
                displayName: Setup Private Feeds Credentials
                inputs:
                  filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
                  arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token
                env:
                  Token: $(dn-bot-dnceng-artifact-feeds-rw)
              - script: eng\common\cibuild.cmd -configuration $(_BuildConfig) -prepareMachine $(_InternalBuildArgs) $(_InternalRuntimeDownloadArgs) $(_AdditionalBuildArgs)
                name: Build
              - script: "echo ##vso[build.addbuildtag]release-candidate"
                condition: and(succeeded(), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['IsFinalBuild'], 'true'))
            templateContext:
              outputs:
              - output: pipelineArtifact
                displayName: Upload TestResults
                condition: always()
                path: artifacts/TestResults/$(_BuildConfig)/
                artifact: $(Agent.Os)_$(Agent.JobName)$(System.JobAttempt) TestResults
              - output: pipelineArtifact
                displayName: Upload PackageArtifacts
                condition: and(succeeded(), notin(variables['Build.Reason'], 'PullRequest'))
                path: artifacts/packages/$(_BuildConfig)/Shipping
                artifact: PackageArtifactsSbom
    - ${{ if notin(variables['Build.Reason'], 'PullRequest') }}:
      - template: /eng/common/templates-official/post-build/post-build.yml@self
        parameters:
          publishingInfraVersion: 3
          enableSigningValidation: false
          enableNugetValidation: false
          enableSourceLinkValidation: false
          publishAssetsImmediately: true