Use shared pipelines (#716)

Author: bwateratmsft

.azure-pipelines/common/build.yml

@@ -1,9 +1,10 @@
-{
-    "tool": "Credential Scanner",
-    "suppressions": [
-        {
-            "folder": "node_modules\\",
-            "_justification": "No need to scan external node modules."
-        }
-    ]
-}
+// More info at https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/cred-bot-trinity/credential-risk-exposure-defense/troubleshoot_guides/local-suppressions
+{
+    "tool": "Credential Scanner",
+    "suppressions": [
+        {
+            "folder": "node_modules\\",
+            "_justification": "No need to scan external node modules."
+        }
+    ]
+}

.azure-pipelines/common/lint.yml

@@ -1,10 +1,11 @@
 <PoliCheckExclusions>
+    <!-- More info at https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/sdl-azdo-extension/policheck-build-task#excluding-files-or-folders-from-the-policheck-scan -->
     <!--Each of these exclusions is a folder name -if \[name]\exists in the file path, it will be skipped -->
-    <Exclusion Type="FolderPathFull">NODE_MODULES|DIST</Exclusion>
+    <Exclusion Type="FolderPathFull">NODE_MODULES|BACKUPTEMPLATES|.VSCODE-TEST|DIST</Exclusion>
     <!--Each of these exclusions is a folder name -if any folder or file starts with "\[name]", it will be skipped -->
     <!--<Exclusion Type="FolderPathStart">ABC|XYZ</Exclusion>-->
     <!--Each of these file types will be completely skipped for the entire scan -->
     <!--<Exclusion Type="FileType">.ABC|.XYZ</Exclusion>-->
     <!--The specified file names will be skipped during the scan regardless which folder they are in -->
-    <!--<Exclusion Type="FileName">ABC.TXT|XYZ.CS</Exclusion>-->
+    <Exclusion Type="FileName">NOTICE.HTML</Exclusion>
 </PoliCheckExclusions>

.azure-pipelines/common/package.yml

@@ -5,52 +5,29 @@ variables:
     ENABLE_LONG_RUNNING_TESTS: true
     ENABLE_COMPLIANCE: true
 
-jobs:
-- job: Windows
-  pool:
-    vmImage: windows-latest
-  steps:
-  - template: common/build.yml
-  - template: common/package.yml
-  - template: common/lint.yml
-  - template: compliance/compliance.yml # Only works on Windows
-  - template: common/test.yml
-
-- job: Linux
-  pool:
-    vmImage: ubuntu-latest
-  steps:
-  - template: common/build.yml
-  - template: common/package.yml
-  - template: common/sbom.yml # Only generate on linux
-  - template: common/lint.yml
-  - template: common/test.yml
-  variables:
-    Codeql.Enabled: $[in(variables['Build.Reason'], 'Schedule')] # Enable CodeQL only on scheduled builds because it is slow
-
-- job: macOS
-  pool:
-    vmImage: macOS-latest
-  steps:
-  - template: common/build.yml
-  - template: common/package.yml
-  - template: common/lint.yml
-  - template: common/test.yml
-
+# Trigger the build whenever `main` or `rel/*` is updated
 trigger:
-  branches:
-    include:
-    - '*'
-
-pr:
-  branches:
-    include:
-    - '*'
+  - main
+  - rel/*
 
+# Scheduled nightly build
 schedules:
-- cron: "30 9 * * *"
-  displayName: Nightly at 2:30 PT
-  always: true # Run even when there are no code changes
-  branches:
-    include:
-    - main
+  - cron: "30 9 * * *"
+    displayName: Nightly at 2:30 PT
+    always: true # Run even when there are no code changes
+    branches:
+      include:
+        - main
+
+# Grab the base templates from https://github.com/microsoft/vscode-azuretools/tree/main/azure-pipelines
+resources:
+  repositories:
+    - repository: templates
+      type: github
+      name: microsoft/vscode-azuretools
+      ref: main
+      endpoint: GitHub
+
+# Use those templates
+extends:
+  template: azure-pipelines/jobs.yml@templates