Skip to content

Commit ed8737d

Browse files
Justin ChungCopilot
Justin Chung
and
Copilot
committed
Fix Linux pool/image pairing in 1ES NonOfficial scaffold
Build #684757 (the first ADO build of the new 1ES scaffold) was cancelled at the prep stage with: Remote machine provider issue: Failed to request agent. Exception Image PSMMSAzureLinux3.0-Secure doesn't exist in pool PowerShell1ES Root cause: PowerShell1ES (the team-owned 1ES managed pool, id 108, 35 agents) only carries MMS2022 (Windows Server 2022). It does NOT have any Linux image deployed. The original scaffold tentatively assumed PSMMSAzureLinux3.0-Secure was present based on a partial read of the CloudTest.png inventory; build #684757 disproved that assumption. Fix: * prep/SetVars (Stages.yml) -> PowerShell1ES + MMS2022 + os: windows SetVars only runs pwsh to compute version variables; no Linux-specific tooling is required. Using the proven Windows pairing from the apiscan POC also avoids gating prep on a second pool authorization on first run. * linux.yml build job -> Azure-Pipelines-1ESPT-ExDShared + ubuntu-latest + os: linux * testartifacts.yml nonwin job -> same Azure-Pipelines-1ESPT-ExDShared is the E+D org's shared 1ES PT-managed Linux pool (24 D2ads_v5 agents, 8 GiB RAM, 75 GiB temp storage, Ubuntu 22.04 LTS with the full Microsoft-hosted dev tooling). It is the documented standard fallback per the 1ES PT migration guide. If/when a team-owned Linux image lands on PowerShell1ES (would need a PsImageFactory PR similar to the unmerged addAzureCLI PR that put MMS2022 there), swap the pool: block in 2 places: templates/linux.yml build job and templates/testartifacts.yml nonwin job. Also updates the POOL/IMAGE STRATEGY comment in the entry pipeline and drops the now-resolved "Confirm Linux pool/image mapping" TODO. All 4 modified files validated with ConvertFrom-Yaml; no stale pairing references remain in code (only in comments documenting the lesson). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 0da97e8 commit ed8737d

4 files changed

Lines changed: 32 additions & 17 deletions

File tree

‎.pipelines/1ES/PowerShell-Coordinated_Packages-NonOfficial.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,17 @@
3333
# need their own pool/templateContext translations).
3434
#
3535
# POOL/IMAGE STRATEGY:
36-
# - Windows jobs -> PowerShell1ES + MMS2022 (1ES-maintained, proven in apiscan POC)
37-
# - Linux jobs -> PowerShell1ES + PSMMSAzureLinux3.0-Secure (closest match to
38-
# the OneBranch container `mcr.microsoft.com/onebranch/azurelinux/build:3.0`).
39-
# ⚠ Verify with team that PowerShell1ES pool carries this image.
40-
# If not, fall back to `1ES-Linux-Ubuntu-2204` Microsoft-hosted pool.
41-
# - macOS jobs -> Azure Pipelines + vmImage macOS-latest (no team-owned macOS image
42-
# exists in the CloudTest inventory; macOS jobs MUST use the
36+
# - Windows jobs -> PowerShell1ES + MMS2022 (team-owned 1ES managed pool;
37+
# confirmed working in apiscan-gen-notice POC and SDL
38+
# Sources Analysis job on build #684757).
39+
# - Linux jobs -> Azure-Pipelines-1ESPT-ExDShared + ubuntu-latest
40+
# (E+D shared 1ES PT-managed pool, Ubuntu 22.04 with
41+
# Microsoft-hosted standard tooling). Build #684757
42+
# proved PowerShell1ES does NOT carry a Linux image —
43+
# `PSMMSAzureLinux3.0-Secure` is not deployed there.
44+
# Swap to a team-owned Linux pool if/when one lands.
45+
# - macOS jobs -> Azure Pipelines + vmImage macOS-latest (no team-owned
46+
# macOS image exists; macOS jobs MUST use the
4347
# Microsoft-hosted Azure Pipelines shared pool).
4448
#
4549
# CODEQL POLICY:
@@ -61,7 +65,6 @@
6165
# - Stub signing: every onebranch.pipeline.signing@1 call replaced with a
6266
# `pwsh: Write-Host "TODO: ESRP sign ..."` placeholder. Pipeline runs end-to-end
6367
# but produces UNSIGNED artifacts — strictly for validating the migration scaffold.
64-
# - Confirm Linux pool/image mapping (PowerShell1ES + PSMMSAzureLinux3.0-Secure).
6568
# - Once Unofficial green, build Official sibling with real ESRP signing.
6669

6770
trigger: none

‎.pipelines/1ES/templates/linux.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,16 @@ parameters:
55

66
# 1ES PT translation of /.pipelines/templates/linux.yml.
77
# Two jobs:
8-
# 1. build_<JobName> — Linux pool (PowerShell1ES + PSMMSAzureLinux3.0-Secure)
8+
# 1. build_<JobName> — Linux pool (Azure-Pipelines-1ESPT-ExDShared + ubuntu-latest)
99
# 2. sign_<JobName> — Windows pool (PowerShell1ES + MMS2022), STUBBED ESRP signing.
1010
#
11+
# POOL CHOICE (Linux): Azure-Pipelines-1ESPT-ExDShared is the E+D org's shared
12+
# 1ES PT-managed Linux pool (24 D2ads_v5 agents, Ubuntu 22.04 with full
13+
# Microsoft-hosted tooling). The team-owned PowerShell1ES pool does NOT currently
14+
# carry a Linux image (build #684757 confirmed `PSMMSAzureLinux3.0-Secure` is
15+
# not deployed there). If/when a team-owned Linux image lands on PowerShell1ES,
16+
# swap the `pool:` block below.
17+
#
1118
# Notes
1219
# -----
1320
# - CodeQL3000Init / CodeQL3000Finalize tasks DROPPED. 1ES PT auto-injects CodeQL
@@ -22,8 +29,8 @@ jobs:
2229
displayName: Build_Linux_${{ parameters.Runtime }}_${{ parameters.BuildConfiguration }}
2330
condition: succeeded()
2431
pool:
25-
name: PowerShell1ES
26-
image: PSMMSAzureLinux3.0-Secure
32+
name: Azure-Pipelines-1ESPT-ExDShared
33+
image: ubuntu-latest
2734
os: linux
2835
variables:
2936
- name: NugetSecurityAnalysisWarningLevel

‎.pipelines/1ES/templates/stages/PowerShell-Coordinated_Packages-Stages.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,14 @@ stages:
1818
- job: SetVars
1919
displayName: Set Variables
2020
# OneBranch: pool: { type: linux } (alias for an internal Linux container pool).
21-
# 1ES PT requires explicit name/image/os. We use PowerShell1ES + PSMMSAzureLinux3.0-Secure
22-
# because the original SetVars only needs a shell — no special Linux tooling.
21+
# 1ES PT requires explicit name/image/os. SetVars only runs pwsh to compute
22+
# version variables — no Linux-specific tooling required — so we use the
23+
# proven Windows pairing (PowerShell1ES + MMS2022) from the apiscan POC.
24+
# This also avoids gating prep on a second pool authorization on first run.
2325
pool:
2426
name: PowerShell1ES
25-
image: PSMMSAzureLinux3.0-Secure
26-
os: linux
27+
image: MMS2022
28+
os: windows
2729

2830
variables:
2931
- name: ob_outputDirectory # kept verbatim: build.psm1 reads $env:OB_OUTPUTDIRECTORY literally

‎.pipelines/1ES/templates/testartifacts.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,12 @@ jobs:
9696
value: '$(Build.SourcesDirectory)/PowerShell'
9797
displayName: Build non-windows test artifacts
9898
condition: succeeded()
99+
# POOL CHOICE: Azure-Pipelines-1ESPT-ExDShared is the E+D shared 1ES PT
100+
# Linux pool (Ubuntu 22.04). PowerShell1ES has no Linux image deployed (see
101+
# linux.yml header). Swap to a team-owned Linux pool here if one lands.
99102
pool:
100-
name: PowerShell1ES
101-
image: PSMMSAzureLinux3.0-Secure
103+
name: Azure-Pipelines-1ESPT-ExDShared
104+
image: ubuntu-latest
102105
os: linux
103106

104107
templateContext:

0 commit comments

Comments
 (0)