azure-pipelines.yml

variables:
  # Cannot use key:value syntax in root defined variables
  - name: _TeamName
    value: DotNetCore
  - name: _PublishUsingPipelines
    value: true
  - name: _DotNetArtifactsCategory
    value: .NETCore
  - group: SDL_Settings

trigger:
  batch: true
  branches:
    include:
    - main
    - production
pr: none

resources:
  repositories:
  - repository: 1ESPipelineTemplates
    type: git
    name: 1ESPipelineTemplates/1ESPipelineTemplates
    ref: refs/tags/release
extends:
  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
  parameters:
    pool:
      name: NetCore1ESPool-Internal
      image: 1es-windows-2019
      os: windows
    sdl:
      policheck:
        enabled: true
      tsa:
        enabled: true
   
    stages:
    - stage: GitHub_Issue_Verification
      displayName: GitHub Issue Verification
      condition: and(eq(variables['Build.Reason'], 'PullRequest'), notIn(variables['System.PullRequest.TargetBranch'], 'refs/heads/production', 'production'), notIn(variables['System.PullRequest.SourceBranch'], 'refs/heads/production', 'production'))
      jobs:
      - job: VerifyGitHubIssue
        displayName: Verify GitHub Issue Link included in all PRs
        steps:
        - checkout: self
        - powershell: eng/enforce-issue.ps1 -PullRequestNumber $(System.PullRequest.PullRequestNumber) -RepositoryName $(Build.Repository.Name)
          displayName: Enforce GitHub issue link presence

    - stage: build
      dependsOn: []
      displayName: Build
      jobs:
      - template: /eng/common/templates-official/jobs/jobs.yml@self
        parameters:
          enableMicrobuild: false
          enablePublishBuildArtifacts: true
          enablePublishTestResults: false
          enablePublishBuildAssets: true
          enablePublishUsingPipelines: ${{ variables._PublishUsingPipelines }}
          enableTelemetry: true
          jobs:
          - job: Windows_NT
            timeoutInMinutes: 90
            templateContext:
              outputs:
                - output: pipelineArtifact
                  displayName: 'Publish TelemetryApplication'
                  targetPath: $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication
                  artifactName: TelemetryApplication
                - output: pipelineArtifact
                  displayName: 'Publish DotNet.Status.Web'
                  targetPath: $(Build.ArtifactStagingDirectory)/DotNet.Status.Web/package
                  artifactName: DotNetStatus
                - output: pipelineArtifact
                  displayName: 'Publish RolloutScorerAzureFunction'
                  targetPath: $(Build.ArtifactStagingDirectory)/RolloutScorerAzureFunction/package
                  artifactName: RolloutScorer
                - output: pipelineArtifact
                  displayName: 'Publish Release Utilities Artifact'
                  targetPath: $(Build.ArtifactStagingDirectory)\eng
                  artifactName: ReleaseUtilities
                - output: pipelineArtifact
                  displayName: 'Publish Secret Manager Scenario Tests'
                  targetPath: $(Build.SourcesDirectory)\artifacts\bin\Microsoft.DncEng.SecretManager.ScenarioTests\$(_BuildConfig)\net6.0
                  artifactName: Microsoft.DncEng.SecretManager.ScenarioTests
            variables:
            # DotNet-Blob-Feed provides: dotnetfeed-storage-access-key-1
            # DotNet-Symbol-Server-Pats provides: microsoft-symbol-server-pat, symweb-symbol-server-pat
            # Publish-Build-Assets provides: MaestroAccessToken, BotAccount-dotnet-maestro-bot-PAT
            - group: DotNet-Blob-Feed
            - group: DotNet-Symbol-Server-Pats
            - group: Publish-Build-Assets
            - _PublishBlobFeedUrl: https://dotnetfeed.blob.core.windows.net/dotnet-core/index.json
            - _BuildConfig: Release
            - _PublishType: blob
            - _SignType: real
            - _DotNetPublishToBlobFeed: true
            - _InternalBuildArgs: /p:DotNetSignType=$(_SignType)
                /p:TeamName=$(_TeamName)
                /p:DotNetPublishBlobFeedKey=$(dotnetfeed-storage-access-key-1)
                /p:DotNetPublishBlobFeedUrl=$(_PublishBlobFeedUrl)
                /p:DotNetPublishToBlobFeed=$(_DotNetPublishToBlobFeed)
                /p:DotNetPublishUsingPipelines=$(_PublishUsingPipelines)
                /p:DotNetArtifactsCategory=$(_DotNetArtifactsCategory)
                /p:DotNetSymbolServerTokenMsdl=$(microsoft-symbol-server-pat)
                /p:DotNetSymbolServerTokenSymWeb=$(symweb-symbol-server-pat)
                /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
          
            steps:
            - checkout: self
              clean: true

            - task: UseDotNet@2
              displayName: Install Correct .NET Version
              inputs:
                useGlobalJson: true

            - task: UseDotNet@2
              displayName: Install .NET 6
              inputs:
                version: 6.x

            - task: NuGetToolInstaller@0
              inputs:
                versionSpec: 6.1.x

            - task: NodeTool@0
              inputs:
                versionSpec: 12.x

            - task: NuGetCommand@2
              displayName: Restore Packages
              inputs:
                command: restore
                solution: "**/*.sln"
                feedstoUse: config

            - powershell: eng\set-version-parameters.ps1
              displayName: Calculate release version variables

            - powershell: |
                [xml]$manifest = Get-Content src\Telemetry\TelemetryApplication\ApplicationPackageRoot\ApplicationManifest.xml
                $manifest.SelectSingleNode("/*[local-name()='ApplicationManifest']/*[local-name()='Policies']").RemoveAll()
                $manifest.SelectSingleNode("/*[local-name()='ApplicationManifest']/*[local-name()='Principals']").RemoveAll()
                $manifest.Save("src\Telemetry\TelemetryApplication\ApplicationPackageRoot\ApplicationManifest.xml")
                git diff
              displayName: Remove Service Fabric RunAsPolicy from TelemetryApplication

            - script: eng\common\cibuild.cmd
                -configuration $(_BuildConfig)
                -prepareMachine
                $(_InternalBuildArgs)
                /p:Test=false
                /P:Sign=false
              name: Build
              displayName: Build / Publish
              condition: succeeded()
              
            - powershell: |
                $manifestArgs = @()
                Get-ChildItem .vault-config/*.yaml |% {
                  $manifestArgs += @("-m", $_.FullName)
                }
                dotnet run --project src/SecretManager/Microsoft.DncEng.SecretManager -- validate-all -b src @manifestArgs
              displayName: Verify Secret Usages

            - powershell: src\Monitoring\ComponentGovernance\generate-cgmanifest.ps1
              displayName: Generate cgmanifest.json for Grafana

            - task: ComponentGovernanceComponentDetection@0
              inputs:
                # `.packages` directory is used by some tools running during build.
                # By default ComponentDetection scans this directory and sometimes reports
                # vulnerabilities for packages that are not part of the published product.
                # We can ignore this directory because actual vulnerabilities
                # that we are interested in will be found by the tool
                # when scanning .csproj and package.json files.
                ignoreDirectories: '.packages'

            ## Prepare service fabric artifact
            - task: ServiceFabricUpdateManifests@2
              inputs:
                applicationPackagePath: $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication\applicationpackage

            - powershell: |
                robocopy src/Telemetry/TelemetryApplication/PublishProfiles $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication\projectartifacts\PublishProfiles /S *.xml
                robocopy src/Telemetry/TelemetryApplication/ApplicationParameters $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication\projectartifacts\ApplicationParameters /S *.xml
                robocopy src/Telemetry/TelemetryApplication/ApplicationPackageRoot $(Build.ArtifactStagingDirectory)\ServiceFabric\TelemetryApplication\projectartifacts\ApplicationPackageRoot /S *.xml
                exit 0
              displayName: Copy Telemetry Project Artifacts
              
            - script: $(Build.SourcesDirectory)\.dotnet\dotnet publish -o $(Build.ArtifactStagingDirectory)\DotNet.Status.Web\publish -f net6.0
              workingDirectory: src\DotNet.Status.Web\DotNet.Status.Web
              displayName: dotnet publish DotNet.Status.Web

            - task: ArchiveFiles@2
              inputs:
                rootFolderOrFile: $(Build.ArtifactStagingDirectory)/DotNet.Status.Web/publish
                includeRootFolder: false
                archiveType: zip
                archiveFile: $(Build.ArtifactStagingDirectory)/DotNet.Status.Web/package/DotNetStatus.zip
                replaceExistingArchive: true

            - script: $(Build.SourcesDirectory)\.dotnet\dotnet publish -o $(Build.ArtifactStagingDirectory)\RolloutScorerAzureFunction\publish -f net6.0
              workingDirectory: src/RolloutScorer/RolloutScorerAzureFunction
              displayName: dotnet publish RolloutScorerAzureFunction

            - task: ArchiveFiles@2
              inputs:
                rootFolderOrFile: $(Build.ArtifactStagingDirectory)/RolloutScorerAzureFunction/publish
                includeRootFolder: false
                archiveType: zip
                archiveFile: $(Build.ArtifactStagingDirectory)/RolloutScorerAzureFunction/package/RolloutScorer.zip
                replaceExistingArchive: true

            ## Prepare release utilities artifact
            - task: CopyFiles@2
              displayName: Prepare Release Utilities
              inputs:
                sourceFolder: $(Build.SourcesDirectory)\eng
                contents: '*'
                targetFolder: $(Build.ArtifactStagingDirectory)\eng

    - template: /eng/common/templates-official/post-build/post-build.yml@self
      parameters:
        enableSymbolValidation: false
        enableSigningValidation: false
        artifactsPublishingAdditionalParameters: '/p:CheckEolTargetFramework=false'
        symbolPublishingAdditionalParameters: '/p:CheckEolTargetFramework=false'
        # This is to enable SDL runs part of Post-Build Validation Stage
        SDLValidationParameters:
          enable: true
          params: '-SourceToolsList @("policheck","credscan") 
          -TsaInstanceURL $(_TsaInstanceURL)
          -TsaProjectName $(_TsaProjectName)
          -TsaNotificationEmail $(_TsaNotificationEmail)
          -TsaCodebaseAdmin $(_TsaCodebaseAdmin)
          -TsaBugAreaPath $(_TsaBugAreaPath)
          -TsaIterationPath $(_TsaIterationPath)
          -TsaRepositoryName "Dnceng"
          -TsaCodebaseName "Dnceng"
          -TsaPublish $True
          -PoliCheckAdditionalRunConfigParams @("UserExclusionPath < $(Build.SourcesDirectory)/eng/PoliCheckExclusions.xml")'
    - ${{ if in(variables['Build.SourceBranch'], 'refs/heads/main', 'refs/heads/production')}}:
      - template: /eng/deploy.yaml@self
        parameters:
          ${{ if ne(variables['Build.SourceBranch'], 'refs/heads/production') }}:
            DeploymentEnvironment: Staging
            DotNetStatusAppName: dotneteng-status-staging
            DotNetStatusEndpoint: .NET Engineering Deployment Notification - Staging
            PublishProfile: Int
            ServiceConnectionName: NetHelixStaging
            StatusVariableGroup: DotNetStatus Staging
            GrafanaHost: https://dotnet-eng-grafana-staging.westus2.cloudapp.azure.com
            GrafanaKeyVault: dotnet-grafana-staging
            GrafanaVariableGroup: Dotnet-Grafana-Staging
            ServiceConnectionClientId: 57f299da-15de-4117-b8f6-7c10451926f0
            ServiceConnectionId: 7829de7e-fb4e-4118-8370-475d6bc61905
          ${{ else }}:
            DeploymentEnvironment: Production
            DotNetStatusAppName: dotneteng-status
            DotNetStatusEndpoint: .NET Engineering Deployment Notification - Production
            PublishProfile: Prod
            ServiceConnectionName: NetHelix
            StatusVariableGroup: DotNetStatus Production
            GrafanaHost: https://dotnet-eng-grafana.westus2.cloudapp.azure.com
            GrafanaKeyVault: dotnet-grafana
            GrafanaVariableGroup: Dotnet-Grafana-Production
            ServiceConnectionClientId: fc1eb341-aea4-4a11-8f80-d14b8775b2ba
            ServiceConnectionId: 4a511f6f-b538-48e6-a389-207e430634d1