mirror of
https://github.com/aphrody-labs/PowerShell.git
synced 2026-10-17 12:45:47 +00:00
383 lines
12 KiB
YAML
383 lines
12 KiB
YAML
name: UnifiedPackageBuild-$(Build.BuildId)
|
|
trigger:
|
|
branches:
|
|
include:
|
|
- master
|
|
- release*
|
|
pr:
|
|
branches:
|
|
include:
|
|
- master
|
|
- release*
|
|
|
|
parameters:
|
|
- name: ForceAzureBlobDelete
|
|
displayName: Delete Azure Blob
|
|
type: string
|
|
values:
|
|
- true
|
|
- false
|
|
default: false
|
|
|
|
resources:
|
|
repositories:
|
|
- repository: ComplianceRepo
|
|
type: github
|
|
endpoint: ComplianceGHRepo
|
|
name: PowerShell/compliance
|
|
ref: master
|
|
|
|
variables:
|
|
- name: PS_RELEASE_BUILD
|
|
value: 1
|
|
- name: DOTNET_CLI_TELEMETRY_OPTOUT
|
|
value: 1
|
|
- name: POWERSHELL_TELEMETRY_OPTOUT
|
|
value: 1
|
|
- name: nugetMultiFeedWarnLevel
|
|
value: none
|
|
- name: NugetSecurityAnalysisWarningLevel
|
|
value: none
|
|
# Prevents auto-injection of nuget-security-analysis@0
|
|
- name: skipNugetSecurityAnalysis
|
|
value: true
|
|
- name: branchCounterKey
|
|
value: $[format('{0:yyyyMMdd}-{1}', pipeline.startTime,variables['Build.SourceBranch'])]
|
|
- name: branchCounter
|
|
value: $[counter(variables['branchCounterKey'], 1)]
|
|
- name: ForceAzureBlobDelete
|
|
value: ${{ parameters.ForceAzureBlobDelete }}
|
|
- name: Github_Build_Repository_Uri
|
|
value: https://github.com/powershell/powershell
|
|
- name: SBOMGenerator_Formats
|
|
value: spdx:2.2
|
|
- name: BUILDSECMON_OPT_IN
|
|
value: true
|
|
- group: PoolNames
|
|
|
|
stages:
|
|
- stage: prep
|
|
jobs:
|
|
- template: templates/checkAzureContainer.yml
|
|
|
|
- stage: macos
|
|
dependsOn: ['prep']
|
|
jobs:
|
|
- template: templates/mac.yml
|
|
parameters:
|
|
buildArchitecture: x64
|
|
|
|
- template: templates/mac.yml
|
|
parameters:
|
|
buildArchitecture: arm64
|
|
|
|
- stage: linux
|
|
dependsOn: ['prep']
|
|
jobs:
|
|
- template: templates/linux.yml
|
|
parameters:
|
|
buildName: deb
|
|
|
|
- template: templates/linux.yml
|
|
parameters:
|
|
buildName: rpm
|
|
parentJob: build_deb
|
|
|
|
- template: templates/linux.yml
|
|
parameters:
|
|
buildName: fxdependent
|
|
parentJob: build_deb
|
|
|
|
- template: templates/linux.yml
|
|
parameters:
|
|
buildName: alpine
|
|
|
|
- stage: windows
|
|
dependsOn: ['prep']
|
|
jobs:
|
|
- template: templates/windows-hosted-build.yml
|
|
parameters:
|
|
Architecture: x64
|
|
|
|
- template: templates/windows-hosted-build.yml
|
|
parameters:
|
|
Architecture: x64
|
|
BuildConfiguration: minSize
|
|
|
|
- template: templates/windows-hosted-build.yml
|
|
parameters:
|
|
Architecture: x86
|
|
|
|
- template: templates/windows-hosted-build.yml
|
|
parameters:
|
|
Architecture: arm
|
|
|
|
- template: templates/windows-hosted-build.yml
|
|
parameters:
|
|
Architecture: arm64
|
|
|
|
- template: templates/windows-hosted-build.yml
|
|
parameters:
|
|
Architecture: fxdependent
|
|
|
|
- template: templates/windows-hosted-build.yml
|
|
parameters:
|
|
Architecture: fxdependentWinDesktop
|
|
|
|
- stage: SignFiles
|
|
displayName: Sign files
|
|
dependsOn: ['windows', 'linux', 'macos']
|
|
jobs:
|
|
- template: templates/mac-file-signing.yml
|
|
parameters:
|
|
buildArchitecture: x64
|
|
|
|
- template: templates/mac-file-signing.yml
|
|
parameters:
|
|
buildArchitecture: arm64
|
|
|
|
- job: SignFilesWinLinux
|
|
pool:
|
|
name: $(windowsPool)
|
|
demands:
|
|
- ImageOverride -equals PSMMS2019-Secure
|
|
displayName: Sign files
|
|
|
|
variables:
|
|
- group: ESRP
|
|
- name: runCodesignValidationInjection
|
|
value: false
|
|
- name: NugetSecurityAnalysisWarningLevel
|
|
value: none
|
|
- name: repoFolder
|
|
value: PowerShell
|
|
- name: repoRoot
|
|
value: $(Agent.BuildDirectory)\$(repoFolder)
|
|
- name: complianceRepoFolder
|
|
value: compliance
|
|
|
|
strategy:
|
|
matrix:
|
|
linux-x64:
|
|
runtime: linux-x64
|
|
unsignedBuildArtifactContainer: pwshLinuxBuild.tar.gz
|
|
unsignedBuildArtifactName: pwshLinuxBuild.tar.gz
|
|
signedBuildArtifactName: pwshLinuxBuild.tar.gz
|
|
signedArtifactContainer: authenticode-signed
|
|
linux-x64-Alpine:
|
|
runtime: linux-x64-Alpine
|
|
unsignedBuildArtifactContainer: pwshLinuxBuildAlpine.tar.gz
|
|
unsignedBuildArtifactName: pwshLinuxBuild.tar.gz
|
|
signedBuildArtifactName: pwshLinuxBuildAlpine.tar.gz
|
|
signedArtifactContainer: authenticode-signed
|
|
linux-arm32:
|
|
runtime: linux-arm32
|
|
unsignedBuildArtifactContainer: pwshLinuxBuildArm32.tar.gz
|
|
unsignedBuildArtifactName: pwshLinuxBuildArm32.tar.gz
|
|
signedBuildArtifactName: pwshLinuxBuildArm32.tar.gz
|
|
signedArtifactContainer: authenticode-signed
|
|
linux-arm64:
|
|
runtime: linux-arm64
|
|
unsignedBuildArtifactContainer: pwshLinuxBuildArm64.tar.gz
|
|
unsignedBuildArtifactName: pwshLinuxBuildArm64.tar.gz
|
|
signedBuildArtifactName: pwshLinuxBuildArm64.tar.gz
|
|
signedArtifactContainer: authenticode-signed
|
|
linux-fxd:
|
|
runtime: linux-fxd
|
|
unsignedBuildArtifactContainer: pwshLinuxBuildFxdependent.tar.gz
|
|
unsignedBuildArtifactName: pwshLinuxBuild.tar.gz
|
|
signedBuildArtifactName: pwshLinuxBuildFxdependent.tar.gz
|
|
signedArtifactContainer: authenticode-signed
|
|
linux-mariner:
|
|
runtime: linux-mariner
|
|
unsignedBuildArtifactContainer: pwshMarinerBuildAmd64.tar.gz
|
|
unsignedBuildArtifactName: pwshMarinerBuildAmd64.tar.gz
|
|
signedBuildArtifactName: pwshMarinerBuildAmd64.tar.gz
|
|
signedArtifactContainer: authenticode-signed
|
|
linux-arm64-mariner:
|
|
runtime: linux-arm64-mariner
|
|
unsignedBuildArtifactContainer: pwshMarinerBuildArm64.tar.gz
|
|
unsignedBuildArtifactName: pwshMarinerBuildArm64.tar.gz
|
|
signedBuildArtifactName: pwshMarinerBuildArm64.tar.gz
|
|
signedArtifactContainer: authenticode-signed
|
|
linux-minsize:
|
|
runtime: linux-minsize
|
|
unsignedBuildArtifactContainer: pwshLinuxBuildMinSize.tar.gz
|
|
unsignedBuildArtifactName: pwshLinuxBuildMinSize.tar.gz
|
|
signedBuildArtifactName: pwshLinuxBuildMinSize.tar.gz
|
|
signedArtifactContainer: authenticode-signed
|
|
win-x64:
|
|
runtime: win-x64
|
|
unsignedBuildArtifactContainer: results
|
|
unsignedBuildArtifactName: '**/*-symbols-win-x64.zip'
|
|
signedBuildArtifactName: '-symbols-win-x64-signed.zip'
|
|
signedArtifactContainer: results
|
|
win-x86:
|
|
runtime: win-x86
|
|
unsignedBuildArtifactContainer: results
|
|
unsignedBuildArtifactName: '**/*-symbols-win-x86.zip'
|
|
signedBuildArtifactName: '-symbols-win-x86-signed.zip'
|
|
signedArtifactContainer: results
|
|
win-arm32:
|
|
runtime: win-arm32
|
|
unsignedBuildArtifactContainer: results
|
|
unsignedBuildArtifactName: '**/*-symbols-win-arm32.zip'
|
|
signedBuildArtifactName: '-symbols-win-arm32-signed.zip'
|
|
signedArtifactContainer: results
|
|
win-arm64:
|
|
runtime: win-arm64
|
|
unsignedBuildArtifactContainer: results
|
|
unsignedBuildArtifactName: '**/*-symbols-win-arm64.zip'
|
|
signedBuildArtifactName: '-symbols-win-arm64-signed.zip'
|
|
signedArtifactContainer: results
|
|
win-x64-gc:
|
|
runtime: win-x64-gc
|
|
unsignedBuildArtifactContainer: results
|
|
unsignedBuildArtifactName: '**/*-symbols-win-x64-gc.zip'
|
|
signedBuildArtifactName: '-symbols-win-x64-gc-signed.zip'
|
|
signedArtifactContainer: results
|
|
win-fxdependent:
|
|
runtime: win-fxdependent
|
|
unsignedBuildArtifactContainer: results
|
|
unsignedBuildArtifactName: '**/*-symbols-win-fxdependent.zip'
|
|
signedBuildArtifactName: '-symbols-win-fxdependent-signed.zip'
|
|
signedArtifactContainer: results
|
|
win-fxdependentWinDesktop:
|
|
runtime: win-fxdependentWinDesktop
|
|
unsignedBuildArtifactContainer: results
|
|
unsignedBuildArtifactName: '**/*-symbols-win-fxdependentWinDesktop.zip'
|
|
signedBuildArtifactName: '-symbols-win-fxdependentWinDesktop-signed.zip'
|
|
signedArtifactContainer: results
|
|
steps:
|
|
- template: templates/sign-build-file.yml
|
|
|
|
- stage: mac_packaging
|
|
displayName: macOS packaging
|
|
dependsOn: ['SignFiles']
|
|
jobs:
|
|
- template: templates/mac-package-build.yml
|
|
parameters:
|
|
buildArchitecture: x64
|
|
|
|
- template: templates/mac-package-build.yml
|
|
parameters:
|
|
buildArchitecture: arm64
|
|
|
|
- stage: linux_packaging
|
|
displayName: Linux Packaging
|
|
dependsOn: ['SignFiles']
|
|
jobs:
|
|
- template: templates/linux-packaging.yml
|
|
parameters:
|
|
buildName: deb
|
|
|
|
- template: templates/linux-packaging.yml
|
|
parameters:
|
|
buildName: rpm
|
|
uploadDisplayName: Upload and Sign
|
|
|
|
- template: templates/linux-packaging.yml
|
|
parameters:
|
|
buildName: alpine
|
|
|
|
- template: templates/linux-packaging.yml
|
|
parameters:
|
|
buildName: fxdependent
|
|
|
|
- stage: win_packaging
|
|
displayName: Windows Packaging
|
|
dependsOn: ['SignFiles']
|
|
jobs:
|
|
- template: templates/windows-packaging.yml
|
|
parameters:
|
|
Architecture: x64
|
|
parentJob: build_windows_x64_release
|
|
|
|
- template: templates/windows-packaging.yml
|
|
parameters:
|
|
Architecture: x64
|
|
BuildConfiguration: minSize
|
|
parentJob: build_windows_x64_minSize
|
|
|
|
- template: templates/windows-packaging.yml
|
|
parameters:
|
|
Architecture: x86
|
|
parentJob: build_windows_x86_release
|
|
|
|
- template: templates/windows-packaging.yml
|
|
parameters:
|
|
Architecture: arm
|
|
parentJob: build_windows_arm_release
|
|
|
|
- template: templates/windows-packaging.yml
|
|
parameters:
|
|
Architecture: arm64
|
|
parentJob: build_windows_arm64_release
|
|
|
|
- template: templates/windows-packaging.yml
|
|
parameters:
|
|
Architecture: fxdependent
|
|
parentJob: build_windows_fxdependent_release
|
|
|
|
- template: templates/windows-packaging.yml
|
|
parameters:
|
|
Architecture: fxdependentWinDesktop
|
|
parentJob: build_windows_fxdependentWinDesktop_release
|
|
|
|
- stage: package_signing
|
|
displayName: Package Signing
|
|
dependsOn: ['mac_packaging', 'linux_packaging', 'win_packaging']
|
|
jobs:
|
|
- template: templates/windows-package-signing.yml
|
|
|
|
- template: templates/mac-package-signing.yml
|
|
parameters:
|
|
buildArchitecture: x64
|
|
|
|
- template: templates/mac-package-signing.yml
|
|
parameters:
|
|
buildArchitecture: arm64
|
|
|
|
# This is done late so that we dont use resources before the big signing and packaging tasks.
|
|
- stage: compliance
|
|
dependsOn: ['package_signing']
|
|
jobs:
|
|
- template: templates/compliance.yml
|
|
|
|
- stage: nuget_and_json
|
|
displayName: NuGet Packaging and Build Json
|
|
dependsOn: [package_signing]
|
|
jobs:
|
|
- template: templates/nuget.yml
|
|
- template: templates/json.yml
|
|
|
|
- stage: test_and_release_artifacts
|
|
displayName: Test and Release Artifacts
|
|
dependsOn: ['prep']
|
|
jobs:
|
|
- template: templates/testartifacts.yml
|
|
|
|
- job: release_json
|
|
displayName: Create and Upload release.json
|
|
pool:
|
|
name: $(windowsPool)
|
|
demands:
|
|
- ImageOverride -equals PSMMS2019-Secure
|
|
steps:
|
|
- checkout: self
|
|
clean: true
|
|
- template: templates/SetVersionVariables.yml
|
|
parameters:
|
|
ReleaseTagVar: $(ReleaseTagVar)
|
|
|
|
- powershell: |
|
|
$metadata = Get-Content '$(Build.SourcesDirectory)/tools/metadata.json' -Raw | ConvertFrom-Json
|
|
$LTS = $metadata.LTSRelease.Package
|
|
@{ ReleaseVersion = "$(Version)"; LTSRelease = $LTS } | ConvertTo-Json | Out-File "$(Build.StagingDirectory)\release.json"
|
|
Get-Content "$(Build.StagingDirectory)\release.json"
|
|
Write-Host "##vso[artifact.upload containerfolder=metadata;artifactname=metadata]$(Build.StagingDirectory)\release.json"
|
|
displayName: Create and upload release.json file to build artifact
|
|
retryCountOnTaskFailure: 2
|
|
|
|
- template: /tools/releaseBuild/azureDevOps/templates/step/finalize.yml
|