azure-pipelines-official.yml

# Branches that trigger a build on commit
trigger:
  branches:
    include:
    - main
    - rel/*
    exclude:
    - rel/15.*
    - rel/16.*
    - rel/17.0
    - rel/17.1
    - rel/17.2
    - rel/17.3
    - rel/17.4
    - rel/17.5
    - rel/17.6

# Branch(es) that trigger(s) build(s) on PR
pr:
  branches:
    include:
    - main
    - rel/*
  paths:
    exclude:
      - .github/*
      - .devcontainer/*
      - docs/*
      - .markdownlint.json
      - .markdownlintignore
      - CODE_OF_CONDUCT.md
      - CONTRIBUTING.md
      - README.md
      - SECURITY.md

parameters:
- name: isRTM
  displayName: "Produce RTM version?"
  type: boolean
  default: False
- name: SDLEnabled
  displayName: "Run SDL validation"
  type: boolean
  default: False
# This option should be used with caution. This is useful for unblocking circular deps issue with testanywhere
- name: SkipTests
  displayName: "Skip tests"
  type: boolean
  default: False
- name: codeQLForce
  displayName: "Try collecting CodeQL before default CodeQL cadence"
  type: boolean
  default: False

- name: otherOsPools
  type: object
  default:
  - name: $(DncEngInternalBuildPool)
    image: 1es-ubuntu-2204
    os: linux
  - name: Azure Pipelines
    image: macos-14
    os: macOS

variables:
  - template: /eng/common/templates-official/variables/pool-providers.yml@self
  # Cannot use key:value syntax in root defined variables
  - name: _TeamName
    value: TestPlatformTeam
  - name: Codeql.Enabled
    value: true
  - name: _RunAsInternal
    value: True
  - name: _RunAsPublic
    value: False
  - name: _ReleaseVersionKind
    value: ''
  # Publish Logs seems to depend on this name of variable, so we define it
  # even when we don't use matrix.
  - name: _BuildConfig
    value: Release

  - ${{ if eq(parameters.isRTM, True) }}:
    - name: _ReleaseVersionKind
      value: release

  # Set to 0 to force CodeQL scan without waiting 72 from last attempt (even if it failed).
  # This is only a hint for the tool, it might reject to run it if it already has up to date data.
  # See the Starting Code QL step for details.
  - ${{ if eq(parameters.codeQLForce, True) }}:
    - name: Codeql.Cadence 
      value: 0

  # Group gives access to $microsoft-symbol-server-pat and $symweb-symbol-server-pat
  - group: DotNet-Symbol-Server-Pats
  # Group gives access to $dn-bot-devdiv-drop-rw-code-rw and dn-bot-dnceng-build-rw-code-rw
  - group: DotNet-VSTS-Infra-Access
  - name: _DevDivDropAccessToken
    value: $(dn-bot-devdiv-drop-rw-code-rw)
  - name: _SignType
    value: real
  - name: _SignArgs
    value: /p:DotNetSignType=$(_SignType) /p:TeamName=$(_TeamName) /p:Sign=$(_Sign)
  - name: _Sign
    value: True
  - name: VisualStudioDropName
    value: Products/$(System.TeamProject)/$(Build.DefinitionName)/$(Build.SourceBranchName)/$(Build.BuildNumber)
  - name: _InternalBuildArgs
    value: /p:DotNetSignType=$(_SignType)
      /p:TeamName=$(_TeamName)
      /p:DotNetFinalVersionKind=$(_ReleaseVersionKind)
      /p:DotNetPublishUsingPipelines=true
      /p:DotNetSymbolServerTokenMsdl=$(microsoft-symbol-server-pat)
      /p:DotNetSymbolServerTokenSymWeb=$(symweb-symbol-server-pat)
      /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
      /p:VisualStudioDropName=$(VisualStudioDropName)
      /p:GenerateSbom=true

resources:
  repositories:
  - repository: 1ESPipelineTemplates
    type: git
    name: 1ESPipelineTemplates/1ESPipelineTemplates
    ref: refs/tags/release

extends:
  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
  parameters:
    sdl:
      policheck:
        enabled: true
      tsa:
        enabled: true
    pool:
      name: $(DncEngInternalBuildPool)
      image: windows.vs2026preview.scout.amd64
      os: windows
    settings:
      networkIsolationPolicy: Permissive,CFSClean
    customBuildTags:
    - ES365AIMigrationTooling
    stages:
    - stage: build
      displayName: Build
      jobs:

      - template: /eng/common/templates-official/jobs/jobs.yml@self
        parameters:
          enableMicrobuild: true
          enablePublishBuildArtifacts: true
          enablePublishBuildAssets: true
          enablePublishUsingPipelines: true
          enablePublishTestResults: true
          testResultsFormat: 'vstest'
          enableTelemetry: true
          enableSourceBuild: true
          jobs:
          - job: Windows
            timeoutInMinutes: 120
            pool:
              name: $(DncEngInternalBuildPool)
              image: windows.vs2026preview.scout.amd64
              os: windows
            steps:
            # This steps help to understand versions of .NET runtime installed on the machine,
            # which is useful to diagnose some governance issues.
            - task: DotNetCoreCLI@2
              displayName: 'dotnet --info'
              inputs:
                command: custom
                custom: '--info'

            # Restore internal tools required for SBOM generation
            - template: /eng/restore-internal-tools.yml

            - powershell: eng\common\CIBuild.cmd
                -configuration Release
                -prepareMachine
                $(_InternalBuildArgs)
                /p:Test=false
                /p:SourceBranchName=$(Build.SourceBranchName)
              name: Build
              displayName: Build

            - ${{ if eq(parameters.SkipTests, False) }}:
              # -ci is allowing to import some environment variables and some required configurations
              # -nobl avoid overwriting binlog of the main Build
              - script: Test.cmd
                  -configuration Release
                  -ci
                  -nobl
                name: Test
                displayName: Unit Test
                env:
                  DOTNET_ROOT: $(Build.SourcesDirectory)/.dotnet
              # -ci is allowing to import some environment variables and some required configurations
              # -nobl avoid overwriting binlog of the main Build
              - script: Test.cmd
                  -configuration Release
                  -ci
                  -nobl
                  -integrationTest
                  -compatibilityTest
                  -performanceTest
                name: IntegrationTest
                displayName: Integration Test
                env:
                  DOTNET_ROOT: $(Build.SourcesDirectory)/.dotnet

              # This step is only helpful for diagnosing some issues with vstest/test host that would not appear
              # through the console or trx
              - task: 1ES.PublishBuildArtifacts@1
                displayName: 'Publish Test Results folders'
                inputs:
                  PathtoPublish: '$(Build.SourcesDirectory)/artifacts/TestResults/Release'
                  ArtifactName: TestResults
                condition: failed()
              
              # Remove generated test projects from the compatibility matrix because they use older versions of our packages
              # and some of them use dependencies that are now vulnerable.
              # We don't depend on those vulnerable versions anymore, but need to keep restoring them to ensure backwards compatibility.
              - pwsh: |
                  if (Test-Path -LiteralPath "$(Build.SourcesDirectory)/artifacts/tmp/GeneratedTestAssets") {
                    Remove-Item -LiteralPath "$(Build.SourcesDirectory)/artifacts/tmp/GeneratedTestAssets" -Recurse -Force
                  }
                displayName: Remove artifacts/tmp/GeneratedTestAssets

            - task: 1ES.PublishBuildArtifacts@1
              displayName: 'Publish VSSetup'
              inputs:
                PathtoPublish: '$(Build.SourcesDirectory)/artifacts/VSSetup/Release'
                ArtifactName: VSSetupArtifacts

          - ${{ each pool in parameters.otherOsPools }}:
            - job: ${{ pool.os }}
              dependsOn: Windows
              workspace:
                clean: all
              pool:
                name: ${{ pool.name }}
                demands: ImageOverride -equals ${{ pool.image }}
                os: ${{ pool.os }}
                image: ${{ pool.image }}
              steps:
              - checkout: self
                fetchDepth: 1
                clean: true

              # Build but don't pack, packing does not work on non-windows and we want to test what we built on Windows
              # anyway. Because that is what we will publish.
              - script: ./build.sh
                  --configuration Release
                  --ci
                name: Build
                displayName: Build

              # Download the built packages into local package source, as if we built them on this machine.
              - task: DownloadPipelineArtifact@2
                displayName: Download Package Artifacts
                inputs:
                  artifactName: PackageArtifacts
                  targetPath: '$(Build.SourcesDirectory)/artifacts/packages/Release/Shipping'

              - ${{ if eq(parameters.SkipTests, False) }}:
                - script: ./test.sh
                    --configuration Release
                    --ci
                    --integrationTest
                    --performanceTest
                  name: Test
                  displayName: Test
                  env:
                    DOTNET_ROOT: $(Build.SourcesDirectory)/.dotnet
                
                # Remove generated test projects from the compatibility matrix because they use older versions of our packages
                # and some of them use dependencies that are now vulnerable.
                # We don't depend on those vulnerable versions anymore, but need to keep restoring them to ensure backwards compatibility.
                - pwsh: |
                    $generatedAssetsPath = "$(Build.SourcesDirectory)/artifacts/tmp/GeneratedTestAssets"
                    if (Test-Path -LiteralPath $generatedAssetsPath) {
                      Remove-Item -LiteralPath $generatedAssetsPath -Recurse -Force
                    }
                  displayName: Remove artifacts/tmp/GeneratedTestAssets

                # This step is only helpful for diagnosing some issues with vstest/test host that would not appear
                # through the console or trx
                - task: 1ES.PublishBuildArtifacts@1
                  displayName: 'Publish Test Results folders'
                  inputs:
                    PathtoPublish: '$(Build.SourcesDirectory)/artifacts/TestResults/Release'
                    ArtifactName: TestResults
                  condition: failed()
          
          - job: Publish
            dependsOn:
              - ${{ each pool in parameters.otherOsPools }}:
                - ${{ pool.os }}
            pool:
                name: $(DncEngInternalBuildPool)
                image: windows.vs2026preview.scout.amd64
                os: windows
            steps:
              # The template job needs a log, otherwise it writes a warning. We can disable log uploading only for
              # the whole stage, which is not what we want to do. So we write an empty file instead.
              - pwsh: 'New-Item -Type file -Force "$(Build.SourcesDirectory)/artifacts/log/Release/empty.log"'
                name: 'Add_empty_logfile'
              # Download the built packages into local package source, as if we built them on this machine.
              - task: DownloadPipelineArtifact@2
                displayName: Download Package Artifacts
                inputs:
                  artifactName: PackageArtifacts
                  targetPath: '$(Build.SourcesDirectory)/artifacts/packages/Release/Shipping'

              - task: DownloadPipelineArtifact@2
                displayName: Download VSSetup Artifacts
                inputs:
                  artifactName: VSSetupArtifacts
                  targetPath: '$(Build.SourcesDirectory)/artifacts/VSSetup/Release'

              - ${{ if eq(parameters.isRTM, False) }}:
                - task: NuGetAuthenticate@1
                  displayName: 'NuGet Authenticate to dotnet-tools and test-tools feeds'

                - task:  1ES.PublishNuget@1
                  displayName: 'Publish NuGet packages to dotnet-tools feed'
                  inputs:
                    packageParentPath: '$(Build.SourcesDirectory)/artifacts/packages/Release'
                    packagesToPush: '$(Build.SourcesDirectory)/artifacts/packages/Release/**/*.nupkg;!$(Build.SourcesDirectory)/artifacts/packages/Release/**/*.symbols.nupkg'
                    publishVstsFeed: 'public/dotnet-tools'
                
                - task:  1ES.PublishNuget@1
                  displayName: 'Publish NuGet packages to test-tools feed'
                  inputs:
                    packageParentPath: '$(Build.SourcesDirectory)/artifacts/packages/Release'
                    packagesToPush: '$(Build.SourcesDirectory)/artifacts/packages/Release/**/*.nupkg;!$(Build.SourcesDirectory)/artifacts/packages/Release/**/*.symbols.nupkg'
                    publishVstsFeed: 'public/test-tools'

              # Publishes setup VSIXes to a drop.
              # Note: The insertion tool looks for the display name of this task in the logs.
              - task: 1ES.MicroBuildVstsDrop@1
                displayName: Upload VSTS Drop
                inputs:
                  dropName: $(VisualStudioDropName)
                  dropFolder: 'artifacts\VSSetup\Release\Insertion'
                  accessToken: $(_DevDivDropAccessToken)
                condition: succeeded()

              - task: 1ES.PublishBuildArtifacts@1
                displayName: Publish Artifact VSSetup
                inputs:
                  PathtoPublish: 'artifacts\VSSetup\Release'
                  ArtifactName: 'VSSetup'
                condition: succeeded()

      - ${{ if eq(variables['Build.SourceBranchName'], 'main') }}:
        - template: /eng/common/templates-official/job/onelocbuild.yml@self
          parameters:
            GitHubOrg: microsoft
            MirrorRepo: vstest
            LclSource: lclFilesfromPackage
            LclPackageId: 'LCL-JUNO-PROD-VSTEST'

    - template: eng/common/templates-official/post-build/post-build.yml@self
      parameters:
        # Temporarily skip validation until infra issues are resolved, based on advice from Arcade.
        enableSigningValidation: false