build-test.yml

parameters:
  artifactTargetFramework: ''
  jobTitle: ''

jobs:
- job: ${{ parameters.jobTitle }}
  condition: eq(variables['LinuxPackageBuildTag'], '')
  timeoutInMinutes: "180"
  pool:
    name: 1es-pool-azfunc
    image: 1es-windows-2022
    os: windows

  variables:
    devops_buildNumber: $[counter(format('1'), 6100)]
    DEVOPS_REPO_BRANCH: $[coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranchName'])]
    DEVOPS_REPO_COMMIT: $(Build.SourceVersion)
  steps:
  - pwsh: . "tools/start-emulators.ps1" -NoWait
    displayName: "Start emulators (NoWait)"
  - pwsh: |
      $simulateReleaseBuild = $null
      if (-not([bool]::TryParse($env:SimulateReleaseBuild, [ref] $simulateReleaseBuild)))
      {
          throw "SimulateReleaseBuild can only be set to true or false."
      }

      $isReleaseBuild = $false
      if ($env:BuildSourceBranchName -like "release_4.0*" -or $simulateReleaseBuild)
      {
          $isReleaseBuild = $true
      }
      Write-Host "Setting IsReleaseBuild to $isReleaseBuild because the branch name is $env:BuildSourceBranchName and SimulateReleaseBuild is $env:SimulateReleaseBuild"
      Write-Host "##vso[task.setvariable variable=IsReleaseBuild]$isReleaseBuild"
      Write-Host "IsReleaseBuild: $isReleaseBuild"
    displayName: 'Set IsReleaseBuild variable'
    env:
      BuildSourceBranchName: $(Build.SourceBranchName)
      SimulateReleaseBuild: $(SimulateReleaseBuild)
  - pwsh: |
      $isIntegrationBuild = $false
      if ($env:INTEGRATIONBUILDNUMBER -like "PreRelease*-*")
      {
          $isIntegrationBuild = $true
      }
      Write-Host "##vso[task.setvariable variable=IsIntegrationBuild]$isIntegrationBuild"
      Write-Host "IsIntegrationBuild: $isIntegrationBuild"
    displayName: 'Set IsIntegrationBuild variable'
  - pwsh: |
      Write-Host "Target branch: '$(DEVOPS_REPO_BRANCH)'"
    displayName: Set up environment variables
  - task: NodeTool@0
    inputs:
      versionSpec: '18.x'
  - pwsh: |
      Import-Module ".\pipelineUtilities.psm1" -Force
      Install-Dotnet
    displayName: 'Install .NET 6.0 and 3.1'
  - pwsh: |
      Import-Module ".\pipelineUtilities.psm1" -Force
      Install-SBOMUtil -SBOMUtilSASUrl $env:SBOMUtilSASUrl
    env:
      SBOMUtilSASUrl: $(SBOMUtilSASUrl)
    condition: eq(variables['IsReleaseBuild'], 'true')
    displayName: 'Install SBOM ManifestTool'
  - task: NuGetToolInstaller@1
    inputs:
      versionSpec:
    displayName: Install Nuget tool
  - task: AzureCLI@2
    displayName: Login via Azure CLI to acquire access token
    inputs:
      azureSubscription: $(E2ETestServiceConnectionName)
      scriptType: ps
      scriptLocation: inlineScript
      signType: inline
      inlineScript: |
        # acquire access token from Azure CLI and export it to AZURE_MANAGEMENT_ACCESS_TOKEN
        $accessToken = (az account get-access-token --query "accessToken" | % { $_.Trim('"') })
        echo "##vso[task.setvariable variable=azure_management_access_token]$accessToken"
  - pwsh: |
      .\validateWorkerVersions.ps1
    displayName: 'Validate worker versions'
    condition: ne(variables['skipWorkerVersionValidation'], 'true')
  - pwsh: |
      .\check-vulnerabilities.ps1
    displayName: "Check for security vulnerabilities"
  - pwsh: |
      .\build.ps1
    env:
      AzureBlobSigningConnectionString: $(AzureBlobSigningConnectionString)
      BuildArtifactsStorage: $(BuildArtifactsStorage)
      IsReleaseBuild: $(IsReleaseBuild)
      ArtifactTargetFramework: ${{ parameters.artifactTargetFramework }}
      DURABLE_STORAGE_CONNECTION: $(DURABLE_STORAGE_CONNECTION)
      TELEMETRY_INSTRUMENTATION_KEY: $(TELEMETRY_INSTRUMENTATION_KEY)
      IntegrationBuildNumber: $(INTEGRATIONBUILDNUMBER)
    displayName: 'Executing build script'

  - template: ci/sign-files.yml@eng
    parameters:
      displayName: 'Authenticode signing (dll)'
      folderPath: '$(Build.Repository.LocalPath)\artifacts\ToSign\Authenticode\'
      pattern: '*.dll, *.exe'
      signType: inline
      inlineOperation: |
        [
            {
              "KeyCode": "CP-230012",
              "OperationCode": "SigntoolSign",
              "Parameters": {
                "OpusName": "Microsoft",
                "OpusInfo": "http://www.microsoft.com",
                "FileDigest": "/fd \"SHA256\"",
                "PageHash": "/NPH",
                "TimeStamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
              },
              "ToolName": "sign",
              "ToolVersion": "1.0"
            },
            {
              "KeyCode": "CP-230012",
              "OperationCode": "SigntoolVerify",
              "Parameters": {},
              "ToolName": "sign",
              "ToolVersion": "1.0"
            }
        ]

  - task: PublishTestResults@2
    inputs:
      testResultsFormat: 'VSTest'
      testResultsFiles: '**/*.trx'
      failTaskOnFailedTests: true
    condition: succeededOrFailed()

  - template: ci/sign-files.yml@eng
    parameters:
      displayName: 'Third party signing (dll)'
      folderPath: '$(Build.Repository.LocalPath)\artifacts\ToSign\ThirdParty\'
      pattern: '*.dll, *.exe'
      signType: inline
      inlineOperation: |
        [
          {
              "KeyCode": "CP-231522",
              "OperationCode": "SigntoolSign",
              "Parameters": {
                  "OpusName": "Microsoft",
                  "OpusInfo": "http://www.microsoft.com",
                  "Append": "/as",
                  "FileDigest": "/fd \"SHA256\"",
                  "PageHash": "/NPH",
                  "TimeStamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
              },
              "ToolName": "sign",
              "ToolVersion": "1.0"
          },
          {
              "KeyCode": "CP-231522",
              "OperationCode": "SigntoolVerify",
              "Parameters": {},
              "ToolName": "sign",
              "ToolVersion": "1.0"
          }
        ]

  - template: ci/sign-files.yml@eng
    parameters:
      displayName: 'Mac signing'
      folderPath: '$(Build.Repository.LocalPath)\artifacts\ToSign\Mac\'
      pattern: '*.zip'
      signType: inline
      inlineOperation: |
        [
          {
              "KeyCode" : "CP-401337-Apple",
              "OperationCode" : "MacAppDeveloperSign",
              "Parameters" : {},
              "ToolName" : "sign",
              "ToolVersion" : "1.0"
          }
        ]

  - pwsh: |
      .\repackageBinaries.ps1
    displayName: Repackage signed binaries
    env:
      AzureBlobSigningConnectionString: $(AzureBlobSigningConnectionString)
      BuildArtifactsStorage: $(BuildArtifactsStorage)
      DURABLE_STORAGE_CONNECTION: $(DURABLE_STORAGE_CONNECTION)
      TELEMETRY_INSTRUMENTATION_KEY: $(TELEMETRY_INSTRUMENTATION_KEY)
    condition: and(succeeded(), eq(variables['IsReleaseBuild'], 'true'))
  - task: DotNetCoreCLI@2
    inputs:
      command: 'run'
      workingDirectory: '.\build'
      arguments: 'TestSignedArtifacts --signTest'
    displayName: 'Verify signed binaries'
    condition: and(succeeded(), eq(variables['IsReleaseBuild'], 'true'))

  - pwsh: |
      .\generateMsiFiles.ps1
    env:
      AzureBlobSigningConnectionString: $(AzureBlobSigningConnectionString)
      BuildArtifactsStorage: $(BuildArtifactsStorage)
      DURABLE_STORAGE_CONNECTION: $(DURABLE_STORAGE_CONNECTION)
      TELEMETRY_INSTRUMENTATION_KEY: $(TELEMETRY_INSTRUMENTATION_KEY)
    displayName: 'Generate MSI files'
    condition: and(succeeded(), eq(variables['IsReleaseBuild'], 'true'))

  - template: ci/sign-files.yml@eng
    parameters:
      displayName: 'MSI Code Signing'
      folderPath: '$(Build.Repository.LocalPath)\artifacts'
      pattern: '*.msi'
      signType: inline
      inlineOperation: |
        [
            {
              "KeyCode": "CP-230012",
              "OperationCode": "SigntoolSign",
              "Parameters": {
                "OpusName": "Microsoft",
                "OpusInfo": "http://www.microsoft.com",
                "FileDigest": "/fd \"SHA256\"",
                "PageHash": "/NPH",
                "TimeStamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
              },
              "ToolName": "sign",
              "ToolVersion": "1.0"
            },
            {
              "KeyCode": "CP-230012",
              "OperationCode": "SigntoolVerify",
              "Parameters": {},
              "ToolName": "sign",
              "ToolVersion": "1.0"
            }
        ]

  - pwsh: |
      .\generateSha.ps1
    displayName: 'Generate sha files'

  - pwsh: |
      Move-Item -Path '$(Build.Repository.LocalPath)\artifacts\Azure.Functions.Cli.*' -Destination '$(Build.ArtifactStagingDirectory)'
      Move-Item -Path '$(Build.Repository.LocalPath)\artifacts\func-cli*.msi' -Destination '$(Build.ArtifactStagingDirectory)'
      Move-Item -Path '$(Build.Repository.LocalPath)\artifacts\Microsoft.Azure.Functions.CoreTools*.nupkg' -Destination '$(Build.ArtifactStagingDirectory)'
      if ($env:IntegrationBuildNumber -like "PreRelease*-*")
      {
          $sourcePath = Join-Path '$(Build.Repository.LocalPath)\artifacts' 'integrationTestsBuildManifest.json'
          Move-Item -Path $sourcePath -Destination '$(Build.ArtifactStagingDirectory)'
      }
    env:
      IntegrationBuildNumber: $(INTEGRATIONBUILDNUMBER)
    displayName: 'Move artifacts'
  - task: 1ES.PublishPipelineArtifact@1
    inputs:
      targetPath: '$(Build.ArtifactStagingDirectory)'
      artifactName: 'drop-${{ parameters.artifactTargetFramework }}'
      artifactType: 'pipeline'
  - pwsh: |
      .\uploadContentToStorageAccount.ps1 -StorageAccountName $env:IntegrationTestsStorageAccountName -StorageAccountKey $env:IntegrationTestsStorageAccountKey -SourcePath '$(Build.ArtifactStagingDirectory)'
    env:
      IntegrationTestsStorageAccountName: $(IntegrationTestsStorageAccountName)
      IntegrationTestsStorageAccountKey: $(IntegrationTestsStorageAccountKey)
    displayName: 'Upload Core Tools build to the storage account for Integration Tests'
    condition: eq(variables.IsIntegrationBuild, 'true')