Skip to content

Commit d370779

Browse files
PaulHiginPaulHigin
authored
Add auto yaml (PowerShell#380)
1 parent 39f1718 commit d370779

3 files changed

Lines changed: 376 additions & 40 deletions

File tree

‎.ci/ci.yml‎

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -29,29 +29,10 @@ stages:
2929
vmImage: windows-latest
3030

3131
steps:
32-
- powershell: |
33-
$powerShellPath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'powershell'
34-
Invoke-WebRequest -Uri https://raw.githubusercontent.com/PowerShell/PowerShell/master/tools/install-powershell.ps1 -outfile ./install-powershell.ps1
35-
./install-powershell.ps1 -Destination $powerShellPath
36-
$vstsCommandString = "vso[task.setvariable variable=PATH]$powerShellPath;$env:PATH"
37-
Write-Host "sending " + $vstsCommandString
38-
Write-Host "##$vstsCommandString"
39-
displayName: Install PowerShell Core
40-
41-
- task: UseDotNet@2
42-
displayName: 'Install .NET Core 3.1.401 sdk'
43-
inputs:
44-
packageType: sdk
45-
version: 3.1.401
46-
47-
- task: NuGetToolInstaller@1
48-
displayName: 'Install NuGet 5.6.0'
49-
inputs:
50-
checkLatest: false
51-
version: 5.6.0
5232

5333
- pwsh: |
5434
Get-ChildItem -Path env:
35+
Get-ChildItem -Path env:
5536
displayName: Capture environment for build
5637
condition: succeededOrFailed()
5738

‎.ci/ci_auto.yml‎

Lines changed: 368 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,368 @@
1+
name: $(BuildDefinitionName)-$(date:yyMM).$(date:dd)$(rev:rrr)
2+
trigger: none
3+
pr: none
4+
5+
schedules:
6+
# Use https://crontab.guru/#0_8_*_*_* to compute crontab expression
7+
# Run signed build, with limited signing cert, every day at 9 am
8+
- cron: 0 9 * * *
9+
branches:
10+
include:
11+
- refs/heads/master
12+
always: true
13+
14+
variables:
15+
- group: ESRP
16+
17+
resources:
18+
repositories:
19+
- repository: ComplianceRepo
20+
type: github
21+
endpoint: ComplianceGHRepo
22+
name: PowerShell/compliance
23+
24+
stages:
25+
- stage: Build
26+
displayName: Build PowerShellGet Module Package
27+
jobs:
28+
- job: BuildPkg
29+
displayName: Build Package
30+
pool:
31+
name: 1ES
32+
demands:
33+
- ImageOverride -equals MMS2019
34+
35+
steps:
36+
37+
- pwsh: |
38+
Get-ChildItem -Path env:
39+
Get-ChildItem -Path env:
40+
displayName: Capture environment for build
41+
condition: succeededOrFailed()
42+
43+
- pwsh: |
44+
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
45+
if (Test-Path -Path $modulePath) {
46+
Write-Verbose -Verbose "Deleting existing temp module path: $modulePath"
47+
Remove-Item -Path $modulePath -Recurse -Force -ErrorAction Ignore
48+
}
49+
if (! (Test-Path -Path $modulePath)) {
50+
Write-Verbose -Verbose "Creating new temp module path: $modulePath"
51+
$null = New-Item -Path $modulePath -ItemType Directory
52+
}
53+
displayName: Create temporary module path
54+
55+
- pwsh: |
56+
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
57+
Write-Verbose -Verbose "Install PowerShellGet V3 to temp module path"
58+
Save-Module -Name PowerShellGet -Path $modulePath -MinimumVersion 3.0.0-beta10 -AllowPrerelease -Force
59+
Write-Verbose -Verbose "Install PlatyPS to temp module path"
60+
Save-Module -Name "platyPS" -Path $modulePath -Force
61+
Write-Verbose -Verbose "Install PSScriptAnalyzer to temp module path"
62+
Save-Module -Name "PSScriptAnalyzer" -Path $modulePath -RequiredVersion 1.18.0 -Force
63+
Write-Verbose -Verbose "Install Pester 5.X to temp module path"
64+
Save-Module -Name "Pester" -MinimumVersion 5.0 -Path $modulePath -Repository PSGallery -Force
65+
Write-Verbose -Verbose "Install PSPackageProject to temp module path"
66+
Save-Module -Name PSPackageProject -Path $modulePath -Force
67+
displayName: Install PSPackageProject and dependencies
68+
69+
- pwsh: |
70+
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
71+
$env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
72+
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
73+
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
74+
Import-Module -Name $modPath -Force
75+
#
76+
# First build for netstandard2.0 framework
77+
$(Build.SourcesDirectory)/build.ps1 -Build -Clean -BuildConfiguration Release -BuildFramework 'netstandard2.0'
78+
# Next build for net472 framework
79+
$(Build.SourcesDirectory)/build.ps1 -Build -BuildConfiguration Release -BuildFramework 'net472'
80+
displayName: Build and publish artifact
81+
82+
- pwsh: |
83+
$signSrcPath = "$($config.BuildOutputPath)"
84+
$vstsCommandString = "vso[task.setvariable variable=signSrcPath]${signSrcPath}"
85+
Write-Host "sending " + $vstsCommandString
86+
Write-Host "##$vstsCommandString"
87+
#
88+
$outSignPath = "$($config.BuildOutputPath)"
89+
$vstsCommandString = "vso[task.setvariable variable=signOutPath]${outSignPath}"
90+
Write-Host "sending " + $vstsCommandString
91+
Write-Host "##$vstsCommandString"
92+
displayName: Create fake source and output variables for signing template and no signing
93+
condition: succeeded()
94+
95+
- pwsh: |
96+
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
97+
$env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
98+
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
99+
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
100+
Import-Module -Name $modPath -Force
101+
102+
$config = Get-PSPackageProjectConfiguration
103+
104+
# Created files signing directory
105+
$srcPath = "$($config.BuildOutputPath)\$($config.ModuleName)"
106+
$createdSignSrcPath = "$($config.BuildOutputPath)\CreatedFiles"
107+
if (! (Test-Path -Path $createdSignSrcPath)) {
108+
$null = New-Item -Path $createdSignSrcPath -ItemType Directory -Verbose
109+
}
110+
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "PowerShellGet.psd1") -Dest $createdSignSrcPath -Force -Verbose
111+
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "PSModule.psm1") -Dest $createdSignSrcPath -Force -Verbose
112+
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "DscResources") -Dest $createdSignSrcPath -Recurse -Force -Verbose
113+
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "Modules") -Dest $createdSignSrcPath -Recurse -Force -Verbose
114+
115+
$net472Path = Join-Path -Path $createdSignSrcPath -ChildPath "net472"
116+
if (! (Test-Path -Path $net472Path)) {
117+
$null = New-Item -Path $net472Path -ItemType Directory -Verbose
118+
}
119+
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "net472\PowerShellGet.*") -Dest $net472Path -Force -Verbose
120+
121+
$netStandardPath = Join-Path -Path $createdSignSrcPath -ChildPath "netstandard2.0"
122+
if (! (Test-Path -Path $netStandardPath)) {
123+
$null = New-Item -Path $netStandardPath -ItemType Directory -Verbose
124+
}
125+
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "netstandard2.0\PowerShellGet.*") -Dest $netStandardPath -Force -Verbose
126+
127+
$signOutPath = "$($config.SignedOutputPath)\$($config.ModuleName)"
128+
if (! (Test-Path -Path $signOutPath)) {
129+
$null = New-Item -Path $signOutPath -ItemType Directory
130+
}
131+
132+
# Set signing src path variable
133+
$vstsCommandString = "vso[task.setvariable variable=signSrcPath]${createdSignSrcPath}"
134+
Write-Host "sending " + $vstsCommandString
135+
Write-Host "##$vstsCommandString"
136+
137+
$outSignPath = "$($config.SignedOutputPath)\$($config.ModuleName)"
138+
if (! (Test-Path -Path $outSignPath)) {
139+
$null = New-Item -Path $outSignPath -ItemType Directory -Verbose
140+
}
141+
142+
# Set signing out path variable
143+
$vstsCommandString = "vso[task.setvariable variable=signOutPath]${outSignPath}"
144+
Write-Host "sending " + $vstsCommandString
145+
Write-Host "##$vstsCommandString"
146+
displayName: Set up for module created files code signing
147+
condition: succeeded()
148+
149+
- pwsh: |
150+
Get-ChildItem -Path env:
151+
Get-ChildItem -Path . -Recurse -Directory
152+
displayName: Capture environment for code signing
153+
condition: succeededOrFailed()
154+
155+
- template: EsrpSign.yml@ComplianceRepo
156+
parameters:
157+
buildOutputPath: $(signSrcPath)
158+
signOutputPath: $(signOutPath)
159+
certificateId: "CP-460906"
160+
shouldSign: $(ShouldSign)
161+
pattern: |
162+
**\*.dll
163+
**\*.psd1
164+
**\*.psm1
165+
**\*.ps1xml
166+
**\*.mof
167+
useMinimatch: true
168+
169+
- pwsh: |
170+
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
171+
$env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
172+
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
173+
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
174+
Import-Module -Name $modPath -Force
175+
176+
$config = Get-PSPackageProjectConfiguration
177+
178+
$signOutPath = "$($config.SignedOutputPath)\$($config.ModuleName)"
179+
if (! (Test-Path -Path $signOutPath)) {
180+
$null = New-Item -Path $signOutPath -ItemType Directory
181+
}
182+
183+
# Third party files signing directory
184+
$srcPath = "$($config.BuildOutputPath)\$($config.ModuleName)"
185+
$thirdPartySignSrcPath = "$($config.BuildOutputPath)\ThirdParty"
186+
if (! (Test-Path -Path $thirdPartySignSrcPath)) {
187+
$null = New-Item -Path $thirdPartySignSrcPath -ItemType Directory -Verbose
188+
}
189+
190+
# Net472 directory
191+
$net472Path = Join-Path -Path $thirdPartySignSrcPath -ChildPath "net472"
192+
if (! (Test-Path -Path $net472Path)) {
193+
$null = New-Item -Path $net472Path -ItemType Directory -Verbose
194+
}
195+
Get-ChildItem -Path (Join-Path -Path $srcPath -ChildPath "net472") -Filter '*.dll' | Foreach-Object {
196+
if ($_.Name -ne 'PowerShellGet.dll') {
197+
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
198+
if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notlike '*Microsoft*' -or $sig.SignerCertificate.Issuer -notlike '*Microsoft Code Signing PCA*') {
199+
# Copy for third party signing
200+
Copy-Item -Path $_.FullName -Dest $net472Path -Force -Verbose
201+
}
202+
}
203+
}
204+
205+
# NetStandard directory
206+
$netStandardPath = Join-Path -Path $thirdPartySignSrcPath -ChildPath "netstandard2.0"
207+
if (! (Test-Path -Path $netStandardPath)) {
208+
$null = New-Item -Path $netStandardPath -ItemType Directory -Verbose
209+
}
210+
Get-ChildItem -Path (Join-Path -Path $srcPath -ChildPath "netstandard2.0") -Filter '*.dll' | Foreach-Object {
211+
if ($_.Name -ne 'PowerShellGet.dll') {
212+
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
213+
if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notlike '*Microsoft*' -or $sig.SignerCertificate.Issuer -notlike '*Microsoft Code Signing PCA*') {
214+
# Copy for third party signing
215+
Copy-Item -Path $_.FullName -Dest $netStandardPath -Force -Verbose
216+
}
217+
}
218+
}
219+
220+
# Set signing src path variable
221+
$vstsCommandString = "vso[task.setvariable variable=signSrcPath]${thirdPartySignSrcPath}"
222+
Write-Host "sending " + $vstsCommandString
223+
Write-Host "##$vstsCommandString"
224+
225+
# Set signing out path variable
226+
$vstsCommandString = "vso[task.setvariable variable=signOutPath]${signOutPath}"
227+
Write-Host "sending " + $vstsCommandString
228+
Write-Host "##$vstsCommandString"
229+
displayName: Set up for module third party files code signing
230+
condition: succeeded()
231+
232+
- template: EsrpSign.yml@ComplianceRepo
233+
parameters:
234+
buildOutputPath: $(signSrcPath)
235+
signOutputPath: $(signOutPath)
236+
certificateId: "CP-231522"
237+
pattern: |
238+
**\*.dll
239+
useMinimatch: true
240+
241+
- pwsh: |
242+
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
243+
$env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
244+
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
245+
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
246+
Import-Module -Name $modPath -Force
247+
248+
$config = Get-PSPackageProjectConfiguration
249+
250+
$srcPath = "$($config.BuildOutputPath)\$($config.ModuleName)"
251+
$signOutPath = "$($config.SignedOutputPath)\$($config.ModuleName)"
252+
if (! (Test-Path -Path $signOutPath)) {
253+
$null = New-Item -Path $signOutPath -ItemType Directory
254+
}
255+
256+
# en-US
257+
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "en-US") -Dest $signOutPath -Recurse
258+
259+
# Net472 directory
260+
$net472SignedOutPath = Join-Path -Path $signOutPath -ChildPath "net472"
261+
if (! (Test-Path -Path $net472SignedOutPath)) {
262+
$null = New-Item -Path $net472SignedOutPath -ItemType Directory -Verbose
263+
}
264+
Get-ChildItem -Path (Join-Path -Path $srcPath -ChildPath "net472") -Filter '*.dll' | Foreach-Object {
265+
if ($_.Name -ne 'PowerShellGet.dll') {
266+
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
267+
if ($sig.Status -eq 'Valid' -and ($sig.SignerCertificate.Subject -like '*Microsoft*' -and $sig.SignerCertificate.Issuer -like '*Microsoft Code Signing PCA*')) {
268+
# Copy already signed files directly to output
269+
Copy-Item -Path $_.FullName -Dest $net472SignedOutPath -Force -Verbose
270+
}
271+
}
272+
}
273+
274+
# NetStandard directory
275+
$netStandardSignedOutPath = Join-Path -Path $signOutPath -ChildPath "netstandard2.0"
276+
if (! (Test-Path -Path $netStandardSignedOutPath)) {
277+
$null = New-Item -Path $netStandardSignedOutPath -ItemType Directory -Verbose
278+
}
279+
Get-ChildItem -Path (Join-Path -Path $srcPath -ChildPath "netstandard2.0") -Filter '*.dll' | Foreach-Object {
280+
if ($_.Name -ne 'PowerShellGet.dll') {
281+
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
282+
if ($sig.Status -eq 'Valid' -and ($sig.SignerCertificate.Subject -like '*Microsoft*' -and $sig.SignerCertificate.Issuer -like '*Microsoft Code Signing PCA*')) {
283+
# Copy already signed files directly to output
284+
Copy-Item -Path $_.FullName -Dest $netStandardSignedOutPath -Force -Verbose
285+
}
286+
}
287+
}
288+
displayName: Copy already properly signed third party files
289+
condition: succeeded()
290+
291+
- pwsh: |
292+
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
293+
$env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
294+
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
295+
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
296+
Import-Module -Name $modPath -Force
297+
#
298+
$config = Get-PSPackageProjectConfiguration
299+
$artifactName = "$($config.ModuleName)"
300+
$srcModulePath = Resolve-Path -Path "$($config.SignedOutputPath)/$($config.ModuleName)"
301+
Get-ChildItem $srcModulePath
302+
Write-Host "##vso[artifact.upload containerfolder=$artifactName;artifactname=$artifactName;]$srcModulePath"
303+
#
304+
$(Build.SourcesDirectory)/build.ps1 -Publish -Signed
305+
displayName: Create signed module artifact
306+
307+
- stage: Compliance
308+
displayName: Compliance
309+
dependsOn: Build
310+
jobs:
311+
- job: ComplianceJob
312+
pool:
313+
name: 1ES
314+
demands:
315+
- ImageOverride -equals MMS2019
316+
317+
steps:
318+
- checkout: self
319+
clean: true
320+
- checkout: ComplianceRepo
321+
clean: true
322+
- download: current
323+
artifact: 'PowerShellGet'
324+
- template: assembly-module-compliance.yml@ComplianceRepo
325+
parameters:
326+
# binskim
327+
AnalyzeTarget: '$(Pipeline.Workspace)/PowerShellGet/netstandard2.0/PowerShellGet.dll'
328+
AnalyzeSymPath: 'SRV*'
329+
# component-governance
330+
sourceScanPath: '$(Build.SourcesDirectory)'
331+
# credscan
332+
suppressionsFile: ''
333+
# TermCheck
334+
optionsRulesDBPath: ''
335+
optionsFTPath: ''
336+
# tsa-upload
337+
codeBaseName: 'PowerShellGet_210306'
338+
# selections
339+
APIScan: false # set to false when not using Windows APIs
340+
341+
- stage: Test
342+
displayName: Test Package
343+
dependsOn: Build
344+
jobs:
345+
- template: test.yml
346+
parameters:
347+
jobName: TestPkgWin
348+
displayName: PowerShell Core on Windows
349+
imageName: windows-latest
350+
351+
- template: test.yml
352+
parameters:
353+
jobName: TestPkgWinPS
354+
displayName: Windows PowerShell on Windows
355+
imageName: windows-latest
356+
powershellExecutable: powershell
357+
358+
# - template: test.yml
359+
# parameters:
360+
# jobName: TestPkgUbuntu16
361+
# displayName: PowerShell Core on Ubuntu 16.04
362+
# imageName: ubuntu-16.04
363+
364+
# - template: test.yml
365+
# parameters:
366+
# jobName: TestPkgWinMacOS
367+
# displayName: PowerShell Core on macOS
368+
# imageName: macOS-10.14

0 commit comments

Comments
 (0)