azure-pipelines.yml

#
# See https://docs.microsoft.com/azure/devops/pipelines/yaml-schema for details
#

schedules:
- cron: 0 9 * * 1
  displayName: "Run CodeQL3000 weekly, Monday at 2:00 AM PDT"
  branches:
    include:
    - main
  always: true

parameters:
# Parameter below is ignored in public builds.
#
# Choose whether to run the CodeQL3000 tasks.
# Manual builds align w/ official builds unless this parameter is true.
- name: runCodeQL3000
  default: false
  displayName: Run CodeQL3000 tasks
  type: boolean

variables:
  - name: _TeamName
    value: AspNetCore
  - name: DOTNET_SKIP_FIRST_TIME_EXPERIENCE
    value: true
  - name: _PublishUsingPipelines
    value: true
  - name: _BuildConfig
    value: Release
  - name: runCodeQL3000
    value: ${{ and(ne(variables['System.TeamProject'], 'public'), or(eq(variables['Build.Reason'], 'Schedule'), and(eq(variables['Build.Reason'], 'Manual'), eq(parameters.runCodeQL3000, 'true')))) }}

    # used for post-build phases, internal builds only
  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
    - group: AspNetKatana-SDLValidation-Params

# CI and PR triggers
trigger:
  batch: true
  branches:
    include:
    - main
    - release/*
    - internal/release/*

pr:
  autoCancel: false
  branches:
    include:
    - '*'

stages:
- stage: build
  displayName: Build
  jobs:
  - template: /eng/common/templates/jobs/jobs.yml
    parameters:
      enableMicrobuild: ${{ ne(variables.runCodeQL3000, 'true') }}
      enablePublishBuildArtifacts: true
      enablePublishTestResults: ${{ ne(variables.runCodeQL3000, 'true') }}
      enablePublishBuildAssets: ${{ ne(variables.runCodeQL3000, 'true') }}
      enablePublishUsingPipelines: ${{ variables._PublishUsingPipelines }}
      enableTelemetry: true
      mergeTestResults: true
      jobs:
      - job: Windows
        pool:
          ${{ if eq(variables['System.TeamProject'], 'public') }}:
            name: NetCore-Svc-Public
            demands: ImageOverride -equals 1es-windows-2019-open
          ${{ if ne(variables['System.TeamProject'], 'public') }}:
            name: NetCore1ESPool-Svc-Internal
            demands: ImageOverride -equals 1es-windows-2019
        ${{ if eq(variables.runCodeQL3000, 'true') }}:
          # Component governance and SBOM creation are not needed here. Disable what Arcade would inject.
          disableComponentGovernance: true
          enableSbom: false
        variables:
        # Only enable publishing in official builds.
        - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
          # Publish-Build-Assets provides: MaestroAccessToken, BotAccount-dotnet-maestro-bot-PAT
          - group: Publish-Build-Assets
          - name: _OfficialBuildArgs
            value: /p:DotNetSignType=$(_SignType)
                   /p:TeamName=$(_TeamName)
                   /p:DotNetPublishUsingPipelines=$(_PublishUsingPipelines)
                   /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
          - name: _SignType
            value: real
        # else
        - ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
          - name: _OfficialBuildArgs
            value: ''
          - name: _SignType
            value: test
        # Rely on task Arcade injects, not auto-injected build step.
        - skipComponentGovernanceDetection: true
        - ${{ if eq(variables.runCodeQL3000, 'true') }}:
          - Codeql.SourceRoot: src
          - _AdditionalBuildArgs: /p:Test=false /p:Sign=false /p:Pack=false /p:Publish=false /p:UseSharedCompilation=false
          # Security analysis is included in normal runs. Disable its auto-injection.
          - skipNugetSecurityAnalysis: true
          # Do not let CodeQL3000 Extension gate scan frequency.
          - Codeql.Cadence: 0
          # Enable CodeQL3000 unconditionally so it may be run on any branch.
          - Codeql.Enabled: true
          # CodeQL3000 needs this plumbed along as a variable to enable TSA.
          - Codeql.TSAEnabled: ${{ eq(variables['Build.Reason'], 'Schedule') }}
          # Default expects tsaoptions.json under SourceRoot.
          - Codeql.TSAOptionsPath: '$(Build.SourcesDirectory)/.config/tsaoptions.json'

        steps:
        - checkout: self
          clean: true
        - ${{ if eq(variables.runCodeQL3000, 'true') }}:
          - task: CodeQL3000Init@0
            displayName: CodeQL Initialize
          - script: "echo ##vso[build.addbuildtag]CodeQL3000"
            displayName: 'Set CI CodeQL3000 tag'
            condition: ne(variables.CODEQL_DIST,'')
        - script: eng\common\cibuild.cmd -configuration $(_BuildConfig) -prepareMachine $(_OfficialBuildArgs) $(_AdditionalBuildArgs)
          displayName: Build and Publish
        - ${{ if eq(variables.runCodeQL3000, 'true') }}:
          - task: CodeQL3000Finalize@0
            displayName: CodeQL Finalize
        - ${{ else }}:
          - task: PublishBuildArtifacts@1
            displayName: Upload TestResults
            condition: always()
            continueOnError: true
            inputs:
              pathtoPublish: artifacts/TestResults/$(_BuildConfig)/
              artifactName: $(Agent.Os)_$(Agent.JobName) TestResults
              artifactType: Container
              parallel: true
          - task: PublishBuildArtifacts@1
            displayName: Upload package artifacts
            condition: and(succeeded(), eq(variables['system.pullrequest.isfork'], false), eq(variables['_BuildConfig'], 'Release'))
            inputs:
              pathtoPublish: artifacts/packages/
              artifactName: artifacts
              artifactType: Container
              parallel: true

- ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), ne(variables.runCodeQL3000, 'true')) }}:
  - template: eng\common\templates\post-build\post-build.yml
    parameters:
      publishingInfraVersion: 3
      # Symbol validation isn't being very reliable lately. This should be enabled back
      # once this issue is resolved: https://github.com/dotnet/arcade/issues/2871
      enableSymbolValidation: false
      # It's a private repo in github so this won't pass until we create an internal mirror
      enableSourceLinkValidation: false
      enableSigningValidation: false
      enableNugetValidation: false
      # This is to enable SDL runs part of Post-Build Validation Stage
      SDLValidationParameters:
        enable: true
        continueOnError: false
        params: ' -SourceToolsList @("policheck","credscan")
        -TsaInstanceURL $(_TsaInstanceURL)
        -TsaProjectName $(_TsaProjectName)
        -TsaNotificationEmail $(_TsaNotificationEmail)
        -TsaCodebaseAdmin $(_TsaCodebaseAdmin)
        -TsaBugAreaPath $(_TsaBugAreaPath)
        -TsaIterationPath $(_TsaIterationPath)
        -TsaRepositoryName "AspNetKatana"
        -TsaCodebaseName "AspNetKatana"
        -TsaPublish $True
        '