Skip to content

Commit fe1c814

Browse files
TravisEz13TravisEz13
committed
Refactor Windows package build and signing stages in pipeline configuration
1 parent 000c116 commit fe1c814

3 files changed

Lines changed: 470 additions & 9 deletions

File tree

‎.pipelines/PowerShell-Packages-Official.yml‎

Lines changed: 38 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -141,30 +141,59 @@ extends:
141141
parameters:
142142
buildArchitecture: arm64
143143

144-
- stage: windows_package
144+
- stage: windows_package_build
145+
displayName: 'Build Windows Packages (Unsigned)'
145146
dependsOn: [prep]
146147
jobs:
147-
- template: /.pipelines/templates/windows-package-build.yml@self
148+
- template: /.pipelines/templates/packaging/windows/build.yml@self
148149
parameters:
149150
runtime: x64
150151

151-
- template: /.pipelines/templates/windows-package-build.yml@self
152+
- template: /.pipelines/templates/packaging/windows/build.yml@self
152153
parameters:
153154
runtime: arm64
154155

155-
- template: /.pipelines/templates/windows-package-build.yml@self
156+
- template: /.pipelines/templates/packaging/windows/build.yml@self
156157
parameters:
157158
runtime: x86
158159

159-
- template: /.pipelines/templates/windows-package-build.yml@self
160+
- template: /.pipelines/templates/packaging/windows/build.yml@self
160161
parameters:
161162
runtime: fxdependent
162163

163-
- template: /.pipelines/templates/windows-package-build.yml@self
164+
- template: /.pipelines/templates/packaging/windows/build.yml@self
164165
parameters:
165166
runtime: fxdependentWinDesktop
166167

167-
- template: /.pipelines/templates/windows-package-build.yml@self
168+
- template: /.pipelines/templates/packaging/windows/build.yml@self
169+
parameters:
170+
runtime: minsize
171+
172+
- stage: windows_package_sign
173+
displayName: 'Sign Windows Packages'
174+
dependsOn: [windows_package_build]
175+
jobs:
176+
- template: /.pipelines/templates/packaging/windows/sign.yml@self
177+
parameters:
178+
runtime: x64
179+
180+
- template: /.pipelines/templates/packaging/windows/sign.yml@self
181+
parameters:
182+
runtime: arm64
183+
184+
- template: /.pipelines/templates/packaging/windows/sign.yml@self
185+
parameters:
186+
runtime: x86
187+
188+
- template: /.pipelines/templates/packaging/windows/sign.yml@self
189+
parameters:
190+
runtime: fxdependent
191+
192+
- template: /.pipelines/templates/packaging/windows/sign.yml@self
193+
parameters:
194+
runtime: fxdependentWinDesktop
195+
196+
- template: /.pipelines/templates/packaging/windows/sign.yml@self
168197
parameters:
169198
runtime: minsize
170199

@@ -257,11 +286,11 @@ extends:
257286

258287
- stage: msixbundle
259288
displayName: 'Create MSIX Bundle'
260-
dependsOn: [windows_package]
289+
dependsOn: [windows_package_build] # Only depends on unsigned packages
261290
jobs:
262291
- template: /.pipelines/templates/package-create-msix.yml@self
263292

264293
- stage: upload
265-
dependsOn: [mac_package, windows_package, linux_package, nupkg, msixbundle]
294+
dependsOn: [mac_package, windows_package_sign, linux_package, nupkg, msixbundle] # Changed to windows_package_sign for signed packages
266295
jobs:
267296
- template: /.pipelines/templates/uploadToAzure.yml@self

‎.pipelines/templates/packaging/windows/build.yml‎

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
parameters:
2+
runtime: x64
3+
4+
jobs:
5+
- job: build_win_${{ parameters.runtime }}
6+
displayName: Build Windows Packages ${{ parameters.runtime }}
7+
condition: succeeded()
8+
pool:
9+
type: windows
10+
11+
variables:
12+
- name: runCodesignValidationInjection
13+
value: false
14+
- name: ob_sdl_codeSignValidation_enabled
15+
value: false # Skip signing validation in build-only stage
16+
- name: nugetMultiFeedWarnLevel
17+
value: none
18+
- name: NugetSecurityAnalysisWarningLevel
19+
value: none
20+
- name: skipNugetSecurityAnalysis
21+
value: true
22+
- group: DotNetPrivateBuildAccess
23+
- group: certificate_logical_to_actual
24+
- name: ob_outputDirectory
25+
value: '$(Build.ArtifactStagingDirectory)\ONEBRANCH_ARTIFACT'
26+
- name: ob_sdl_binskim_enabled
27+
value: false # Disable for build-only, enable in signing stage
28+
- name: ob_sdl_tsa_configFile
29+
value: $(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
30+
- name: ob_sdl_credscan_suppressionsFile
31+
value: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
32+
- name: Runtime
33+
value: ${{ parameters.runtime }}
34+
- group: msixTools
35+
36+
steps:
37+
- checkout: self
38+
clean: true
39+
env:
40+
ob_restore_phase: true # This ensures checkout is done at the beginning of the restore phase
41+
42+
- pwsh: |
43+
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
44+
displayName: Capture environment
45+
env:
46+
ob_restore_phase: true # This ensures this done in restore phase to workaround signing issue
47+
48+
- template: SetVersionVariables.yml@self
49+
parameters:
50+
ReleaseTagVar: $(ReleaseTagVar)
51+
CreateJson: yes
52+
UseJson: no
53+
54+
- template: shouldSign.yml
55+
56+
- template: cloneToOfficialPath.yml
57+
parameters:
58+
nativePathRoot: '$(Agent.TempDirectory)'
59+
60+
- download: CoOrdinatedBuildPipeline
61+
artifact: drop_windows_build_windows_${{ parameters.runtime }}_release
62+
displayName: Download signed artifacts
63+
condition: ${{ ne(parameters.runtime, 'minSize') }}
64+
env:
65+
ob_restore_phase: true # This ensures this done in restore phase to workaround signing issue
66+
67+
- download: CoOrdinatedBuildPipeline
68+
artifact: drop_windows_build_windows_x64_${{ parameters.runtime }}
69+
displayName: Download minsize signed artifacts
70+
condition: ${{ eq(parameters.runtime, 'minSize') }}
71+
env:
72+
ob_restore_phase: true # This ensures this done in restore phase to workaround signing issue
73+
74+
- pwsh: |
75+
Write-Verbose -Verbose "signed artifacts"
76+
Get-ChildItem "$(Pipeline.Workspace)\CoOrdinatedBuildPipeline\drop_windows_build_windows_${{ parameters.runtime }}_release" -Recurse
77+
displayName: 'Capture Downloaded Artifacts'
78+
# Diagnostics is not critical it passes every time it runs
79+
continueOnError: true
80+
env:
81+
ob_restore_phase: true # This ensures this done in restore phase to workaround signing issue
82+
83+
- template: /.pipelines/templates/install-dotnet.yml@self
84+
85+
- pwsh: |
86+
$msixUrl = '$(makeappUrl)'
87+
Invoke-RestMethod -Uri $msixUrl -OutFile '$(Pipeline.Workspace)\makeappx.zip'
88+
Expand-Archive '$(Pipeline.Workspace)\makeappx.zip' -destination '\' -Force
89+
displayName: Install packaging tools
90+
env:
91+
ob_restore_phase: true # This ensures this done in restore phase to workaround signing issue
92+
93+
- pwsh: |
94+
$runtime = '$(Runtime)'
95+
Write-Verbose -Verbose "runtime = '$(Runtime)'"
96+
97+
$signedFolder = switch ($runtime) {
98+
'x64' { 'Signed-win7-x64' }
99+
'x86' { 'Signed-win7-x86' }
100+
'arm64' { 'Signed-win-arm64' }
101+
'fxdependent' { 'Signed-fxdependent' }
102+
'fxdependentWinDesktop' { 'Signed-fxdependent-win-desktop' }
103+
'minsize' { 'Signed-win7-x64' }
104+
}
105+
106+
Write-Verbose -Message "Init..." -Verbose
107+
108+
$repoRoot = "$env:REPOROOT"
109+
Import-Module "$repoRoot\build.psm1"
110+
Import-Module "$repoRoot\tools\packaging"
111+
112+
Start-PSBootstrap -Scenario Both
113+
114+
Find-Dotnet
115+
116+
$signedFilesPath, $psoptionsFilePath = if ($env:RUNTIME -eq 'minsize') {
117+
"$(Pipeline.Workspace)\CoOrdinatedBuildPipeline\drop_windows_build_windows_x64_${runtime}\$signedFolder"
118+
"$(Pipeline.Workspace)\CoOrdinatedBuildPipeline\drop_windows_build_windows_x64_${runtime}\psoptions\psoptions.json"
119+
}
120+
else {
121+
"$(Pipeline.Workspace)\CoOrdinatedBuildPipeline\drop_windows_build_windows_${runtime}_release\$signedFolder"
122+
"$(Pipeline.Workspace)\CoOrdinatedBuildPipeline\drop_windows_build_windows_${runtime}_release\psoptions\psoptions.json"
123+
}
124+
125+
Write-Verbose -Verbose "signedFilesPath: $signedFilesPath"
126+
Write-Verbose -Verbose "psoptionsFilePath: $psoptionsFilePath"
127+
128+
Write-Verbose -Message "checking pwsh exists in $signedFilesPath" -Verbose
129+
if (-not (Test-Path $signedFilesPath\pwsh.exe)) {
130+
throw "pwsh.exe not found in $signedFilesPath"
131+
}
132+
133+
Write-Verbose -Message "Restoring PSOptions from $psoptionsFilePath" -Verbose
134+
135+
Restore-PSOptions -PSOptionsPath "$psoptionsFilePath"
136+
Get-PSOptions | Write-Verbose -Verbose
137+
138+
$metadata = Get-Content "$repoRoot/tools/metadata.json" -Raw | ConvertFrom-Json
139+
$LTS = $metadata.LTSRelease.Package
140+
141+
if ($LTS) {
142+
Write-Verbose -Message "LTS Release: $LTS"
143+
}
144+
145+
Start-PSBootstrap -Scenario Package
146+
147+
$WindowsRuntime = switch ($runtime) {
148+
'x64' { 'win7-x64' }
149+
'x86' { 'win7-x86' }
150+
'arm64' { 'win-arm64' }
151+
'fxdependent' { 'win7-x64' }
152+
'fxdependentWinDesktop' { 'win7-x64' }
153+
'minsize' { 'win7-x64' }
154+
}
155+
156+
$packageTypes = switch ($runtime) {
157+
'x64' { @('msi', 'zip', 'msix') }
158+
'x86' { @('msi', 'zip', 'msix') }
159+
'arm64' { @('msi', 'zip', 'msix') }
160+
'fxdependent' { 'fxdependent' }
161+
'fxdependentWinDesktop' { 'fxdependent-win-desktop' }
162+
'minsize' { 'min-size' }
163+
}
164+
165+
if (-not (Test-Path $(ob_outputDirectory))) {
166+
New-Item -ItemType Directory -Path $(ob_outputDirectory) -Force
167+
}
168+
169+
Set-Location $repoRoot
170+
171+
Start-PSPackage -Type $packageTypes -SkipReleaseChecks -WindowsRuntime $WindowsRuntime -ReleaseTag $(ReleaseTagVar) -PackageBinPath $signedFilesPath -LTS:$LTS
172+
173+
displayName: 'Build Packages (Unsigned)'
174+
env:
175+
__DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
176+
ob_restore_phase: true # This ensures this done in restore phase to workaround signing issue
177+
178+
# Copy unsigned packages to output directory
179+
- pwsh: |
180+
$runtime = '$(Runtime)'
181+
Write-Verbose -Verbose "runtime = '$(Runtime)'"
182+
183+
$packageTypes = switch ($runtime) {
184+
'x64' { @('msi', 'zip', 'msix') }
185+
'x86' { @('msi', 'zip', 'msix') }
186+
'arm64' { @('msi', 'zip', 'msix') }
187+
'fxdependent' { 'fxdependent' }
188+
'fxdependentWinDesktop' { 'fxdependent-win-desktop' }
189+
'minsize' { 'min-size' }
190+
}
191+
192+
if (-not (Test-Path $(ob_outputDirectory))) {
193+
New-Item -ItemType Directory -Path $(ob_outputDirectory) -Force
194+
}
195+
196+
if ($packageTypes -contains 'msi') {
197+
$msiPkgNameFilter = "powershell-*.msi"
198+
$msiPkgPath = Get-ChildItem -Path $(Pipeline.Workspace) -Filter $msiPkgNameFilter -Recurse -File | Select-Object -ExpandProperty FullName
199+
Write-Verbose -Verbose "unsigned msiPkgPath: $msiPkgPath"
200+
Copy-Item -Path $msiPkgPath -Destination '$(ob_outputDirectory)' -Force -Verbose
201+
}
202+
203+
if ($packageTypes -contains 'zip' -or $packageTypes -contains 'fxdependent' -or $packageTypes -contains 'min-size' -or $packageTypes -contains 'fxdependent-win-desktop') {
204+
$zipPkgNameFilter = "powershell-*.zip"
205+
$zipPkgPath = Get-ChildItem -Path $(Pipeline.Workspace) -Filter $zipPkgNameFilter -Recurse -File | Select-Object -ExpandProperty FullName
206+
Write-Verbose -Verbose "unsigned zipPkgPath: $zipPkgPath"
207+
Copy-Item -Path $zipPkgPath -Destination '$(ob_outputDirectory)' -Force -Verbose
208+
}
209+
210+
if ($packageTypes -contains 'msix') {
211+
$msixPkgNameFilter = "powershell-*.msix"
212+
$msixPkgPath = Get-ChildItem -Path $(Pipeline.Workspace) -Filter $msixPkgNameFilter -Recurse -File | Select-Object -ExpandProperty FullName
213+
Write-Verbose -Verbose "unsigned msixPkgPath: $msixPkgPath"
214+
Copy-Item -Path $msixPkgPath -Destination '$(ob_outputDirectory)' -Force -Verbose
215+
}
216+
displayName: Copy unsigned packages to output directory
217+
218+
- pwsh: |
219+
Get-ChildItem -Path $(ob_outputDirectory) -Recurse
220+
displayName: 'List unsigned artifacts'
221+
env:
222+
ob_restore_phase: true # This ensures this done in restore phase to workaround signing issue

0 commit comments

Comments
 (0)