Update with OneESPT parameter

microsoft · Mar 4, 2024 · be0a459 · be0a459
1 parent 94a6292
commit be0a459
Show file tree

Hide file tree

Showing 17 changed files with 120 additions and 33 deletions.
diff --git a/build/yaml/jobs/binaries.yaml b/build/yaml/jobs/binaries.yaml
@@ -9,6 +9,7 @@ parameters:
   SignType: None
   Configuration: Both
   IsMicroBuildInternal: false
+  OneESPT: false
 
 jobs:
 # Windows Binaries
@@ -17,6 +18,7 @@ jobs:
     IndexSources: ${{ parameters.IndexSources }}
     SignType: ${{ parameters.SignType }}
     IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }}
+    OneESPT: ${{ parameters.OneESPT }}
     # Filter out Tests for Signed Builds
     ${{ if and( or( eq(parameters.Configuration, 'Both'), eq(parameters.Configuration, 'Release') ), notIn(parameters.SignType, '', 'None') )}}:
       CopyFilters: |
@@ -58,6 +60,7 @@ jobs:
   parameters:
     SignType: ${{ parameters.SignType }}
     IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }}
+    OneESPT: ${{ parameters.OneESPT }}
     MatrixStrategy:
       ${{ if or( eq(parameters.Configuration, 'Both'), eq(parameters.Configuration, 'Release') )}}:
         Alpine_Release_x64:

diff --git a/build/yaml/jobs/codeanalysis/buildanalyzer.yaml b/build/yaml/jobs/codeanalysis/buildanalyzer.yaml
@@ -7,6 +7,7 @@ parameters:
   Platform: AnyCPU
   Analyzer: csharp
   PublishReport: true
+  OneESPT: false
 
 jobs:
 - job: BuildAnalyzer_${{ parameters.Analyzer }}_${{ parameters.Platform }}
@@ -47,12 +48,15 @@ jobs:
       BinLogCategory: CodeAnalysis
 
   - template: ../../steps/codeanalysis/${{ parameters.Analyzer }}.yaml
+    parameters:
+      OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq(parameters.Platform, 'AnyCPU') }}:
     - template: ../../steps/azuredevops/publishbuildartifacts.yaml
       parameters:
         PathToPublish: '$(Build.ArtifactStagingDirectory)\logs'
         ArtifactName: 'logs'
+        OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq(parameters.PublishReport, true) }}:
     - template: ../../steps/codeanalysis/publishreports.yaml

diff --git a/build/yaml/jobs/linux/binaries.yaml b/build/yaml/jobs/linux/binaries.yaml
@@ -7,10 +7,12 @@ parameters:
   SignType: None
   IsMicroBuildInternal: false
   MatrixStrategy: {}
+  OneESPT: false
 
 jobs:
 - job: Linux
   displayName: Linux
+  OneESPT: false
 
   strategy:
     matrix:
@@ -31,11 +33,14 @@ jobs:
     clean: true
 
   - template: ../../steps/linux/binaries.yaml
+    parameters:
+      OneESPT: ${{ parameters.OneESPT }}
 
   - template: ../../steps/azuredevops/publishbuildartifacts.yaml
     parameters:
       PathToPublish: '$(Build.SourcesDirectory)/out/Linux/bin/$(Platform).$(Configuration)'
       ArtifactName: 'binaries-linux-$(Distro)-$(Configuration)'
+      OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq('true', parameters.IsMicroBuildInternal) }}:
     - template: ../../steps/microbuild/cleanup.yaml
diff --git a/build/yaml/jobs/linux/packages.yaml b/build/yaml/jobs/linux/packages.yaml
@@ -7,6 +7,7 @@ parameters:
   SignType: None
   IsMicroBuildInternal: false
   MatrixStrategy: {}
+  OneESPT: false
 
 jobs:
 - job: Linux_Packages
@@ -38,6 +39,8 @@ jobs:
         SignType: ${{ parameters.SignType }}
 
   - template: ../../steps/linux/packages.yaml
+    parameters:
+      OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq('true', parameters.IsMicroBuildInternal) }}:
     - template: ../../steps/microbuild/codesignverify.yaml
@@ -48,16 +51,19 @@ jobs:
     parameters:
       PathToPublish: '$(Build.ArtifactStagingDirectory)\logs'
       ArtifactName: 'logs'
+      OneESPT: ${{ parameters.OneESPT }}
 
   - template: ../../steps/azuredevops/publishbuildartifacts.yaml
     parameters:
       PathToPublish: '$(Build.ArtifactStagingDirectory)\bin\$(Configuration)'
       ArtifactName: 'packages-linux-$(Distro)-$(Configuration)'
+      OneESPT: ${{ parameters.OneESPT }}
 
   - template: ../../steps/azuredevops/publishbuildartifacts.yaml
     parameters:
       PathToPublish: '$(Build.ArtifactStagingDirectory)\bin\$(Configuration)'
       ArtifactName: 'packages-all'
+      OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq('true', parameters.IsMicroBuildInternal) }}:
     - template: ../../steps/microbuild/cleanup.yaml

diff --git a/build/yaml/jobs/packages.yaml b/build/yaml/jobs/packages.yaml
@@ -8,13 +8,15 @@ parameters:
   SignType: None
   Configuration: Both
   IsMicroBuildInternal: false
+  OneESPT: false
 
 jobs:
 # Windows Packages
 - template: windows/packages.yaml
   parameters:
     SignType: ${{ parameters.SignType }}
     IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }}
+    OneESPT: ${{ parameters.OneESPT }}
     MatrixStrategy:
       ${{ if or( eq(parameters.Configuration, 'Both'), eq(parameters.Configuration, 'Release') )}}:
         Release_x86:
@@ -46,6 +48,7 @@ jobs:
   parameters:
     SignType: ${{ parameters.SignType }}
     IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }}
+    OneESPT: ${{ parameters.OneESPT }}
     MatrixStrategy:
       ${{ if or( eq(parameters.Configuration, 'Both'), eq(parameters.Configuration, 'Release') )}}:
         Alpine_Release_x64:

diff --git a/build/yaml/jobs/postpackage.yaml b/build/yaml/jobs/postpackage.yaml
@@ -6,6 +6,7 @@
 jobs:
 - job: PostPackage
   displayName: PostPackage
+  OneESPT: false
 
   variables:
     Packaging.EnableSBOMSigning: true
@@ -34,5 +35,6 @@ jobs:
     parameters:
       PathToPublish: '$(Build.ArtifactStagingDirectory)\_manifest'
       ArtifactName: 'SBOM-manifest'
+      OneESPT: ${{ parameters.OneESPT }}
 
   - template: ../steps/microbuild/cleanup.yaml
diff --git a/build/yaml/jobs/windows/binaries.yaml b/build/yaml/jobs/windows/binaries.yaml
@@ -12,6 +12,7 @@ parameters:
   MatrixStrategy: {}
   CopyFilters: |
     **
+  OneESPT: false
 
 jobs:
 - job: Windows
@@ -27,6 +28,7 @@ jobs:
       demands:
       - msbuild
       - vstest
+      - DiskSizeGiB -equals 20
     ${{ if not(eq('true', parameters.IsMicroBuildInternal)) }}:
       vmImage: windows-2022
 
@@ -47,6 +49,7 @@ jobs:
   - template: ../../steps/windows/binaries.yaml
     parameters:
       IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }}
+      OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq('true', parameters.IsMicroBuildInternal) }}:
     - template: ../../steps/microbuild/codesignverify.yaml
@@ -63,6 +66,7 @@ jobs:
       parameters:
         PathToPublish: '$(Build.ArtifactStagingDirectory)\logs'
         ArtifactName: 'logs'
+        OneESPT: ${{ parameters.OneESPT }}
 
     - task: CopyFiles@2
       displayName: 'Copy Files to: $(Build.ArtifactStagingDirectory)\bin\$(Configuration)Filtered'
@@ -77,6 +81,7 @@ jobs:
       parameters:
         PathToPublish: '$(Build.ArtifactStagingDirectory)\bin\$(Configuration)Filtered'
         ArtifactName: 'binaries-windows-$(Configuration)'
+        OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq('true', parameters.IsMicroBuildInternal) }}:
     - template: ../../steps/microbuild/cleanup.yaml

diff --git a/build/yaml/jobs/windows/packages.yaml b/build/yaml/jobs/windows/packages.yaml
@@ -7,6 +7,7 @@ parameters:
   SignType: None
   IsMicroBuildInternal: false
   MatrixStrategy: {}
+  OneESPT: false
 
 jobs:
 - job: Windows_Packages
@@ -21,6 +22,7 @@ jobs:
       demands:
       - msbuild
       - vstest
+      - DiskSizeGiB -equals 20
     ${{ if not(eq('true', parameters.IsMicroBuildInternal)) }}:
       vmImage: windows-2022
 
@@ -43,6 +45,7 @@ jobs:
   - template: ../../steps/windows/packages.yaml
     parameters:
       WindowsBinRoot: $(Build.ArtifactStagingDirectory)\binaries-windows-$(Configuration)
+      OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq('true', parameters.IsMicroBuildInternal) }}:
     - template: ../../steps/microbuild/codesignverify.yaml
@@ -53,6 +56,7 @@ jobs:
     parameters:
       PathToPublish: '$(Build.ArtifactStagingDirectory)\logs'
       ArtifactName: 'logs'
+      OneESPT: ${{ parameters.OneESPT }}
 
   - task: CopyFiles@2
     displayName: 'Copy Packages'
@@ -75,11 +79,13 @@ jobs:
     parameters:
       PathToPublish: '$(Build.ArtifactStagingDirectory)\packages'
       ArtifactName: 'packages-windows-$(Configuration)'
+      OneESPT: ${{ parameters.OneESPT }}
 
   - template: ../../steps/azuredevops/publishbuildartifacts.yaml
     parameters:
       PathToPublish: '$(Build.ArtifactStagingDirectory)\packages'
       ArtifactName: 'packages-all'
+      OneESPT: ${{ parameters.OneESPT }}
 
   - ${{ if eq('true', parameters.IsMicroBuildInternal) }}:
     - template: ../../steps/microbuild/cleanup.yaml

diff --git a/build/yaml/jobs/windows/tests.yaml b/build/yaml/jobs/windows/tests.yaml
@@ -22,6 +22,7 @@ jobs:
       demands:
       - msbuild
       - vstest
+      - DiskSizeGiB -equals 20
     ${{ if not(eq('true', parameters.IsMicroBuildInternal)) }}:
       vmImage: windows-2022
 

diff --git a/build/yaml/pipelines/ci.yaml b/build/yaml/pipelines/ci.yaml
@@ -19,6 +19,7 @@ stages:
     parameters:
       IndexSources: true
       Configuration: Both
+      OneESPT: false
 
 - stage: Test
   dependsOn: Build
@@ -34,4 +35,5 @@ stages:
   # Packages (Windows & Linux)
   - template: ../jobs/packages.yaml
     parameters:
-      Configuration: Both
+      Configuration: Both
+      OneESPT: false
diff --git a/build/yaml/pipelines/codeanalysis.yaml b/build/yaml/pipelines/codeanalysis.yaml
@@ -22,6 +22,7 @@ stages:
   - template: ../jobs/windows/binaries.yaml
     parameters:
       IsMicroBuildInternal: true
+      OneESPT: false
       MatrixStrategy:
         Release_x86:
           Configuration: 'Release'
@@ -57,6 +58,7 @@ stages:
     parameters:
       Platform: AnyCPU
       Analyzer: csharp
+      OneESPT: false
 
 - stage: Run_Semmle_Analyzers
   displayName: Code Analysis (Build Time C++ CodeQL)
@@ -67,11 +69,13 @@ stages:
     parameters:
       Platform: x64
       Analyzer: cpp
+      OneESPT: false
 
   - template: ../jobs/codeanalysis/buildanalyzer.yaml
     parameters:
       Platform: x86
       Analyzer: cpp
+      OneESPT: false
 
 - stage: Run_PreFast_Analyzers
   displayName: Code Analysis (Build Time C++ PreFast)
@@ -83,10 +87,12 @@ stages:
       Platform: x64
       Analyzer: prefast
       PublishReport: false
+      OneESPT: false
 
   - template: ../jobs/codeanalysis/buildanalyzer.yaml
     parameters:
       Platform: x86
       Analyzer: prefast
       PublishReport: false
+      OneESPT: false
 
diff --git a/build/yaml/pipelines/pr.yaml b/build/yaml/pipelines/pr.yaml
@@ -18,6 +18,7 @@ stages:
   - template: ../jobs/binaries.yaml
     parameters:
       Configuration: Both
+      OneESPT: false
 
 - stage: Test
   dependsOn: Build
@@ -33,4 +34,5 @@ stages:
   # Packages (Windows & Linux)
   - template: ../jobs/packages.yaml
     parameters:
-      Configuration: Both
+      Configuration: Both
+      OneESPT: false
diff --git a/build/yaml/pipelines/signed.yaml b/build/yaml/pipelines/signed.yaml
@@ -11,26 +11,49 @@ name: $(date:yyyyMMdd)$(rev:rr)
 variables:
   TeamName: ClrInstrumentationEngine
 
-stages:
-- stage: Build
-  jobs:
-  # Binaries (Windows & Linux)
-  - template: ../jobs/binaries.yaml
-    parameters:
-      IndexSources: true
-      SignType: $(SignType) # NOTE this string won't be replaced until runtime
-      Configuration: Release
-      IsMicroBuildInternal: true
+resources:
+  repositories:
+  - repository: MicroBuildTemplate
+    type: git
+    name: 1ESPipelineTemplates/MicroBuildTemplate
+    ref: refs/tags/release
 
-- stage: Package
-  jobs:
-  # Packages (Windows & Linux)
-  - template: ../jobs/packages.yaml
-    parameters:
-      SignType: $(SignType) # NOTE this string won't be replaced until runtime
-      Configuration: Release
-      IsMicroBuildInternal: true
+extends:
+  template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
+  parameters:
+    pool:
+      name: VSEngSS-Microbuild2022-1ES
+      os: (Windows
+    sdl:
+      sourceAnalysisPool:
+        name: VSEngSS-MicroBuild2022-1ES
+        os: windows 
+      binskim:
+        scanOutputDirectoryOnly: true # BinSkim will complain about VC.Tools not being Spectre compliant, but we use that for builds. This toggles for BinSkim to only scan the output files/folders.
+    stages:
+    - stage: Build
+      jobs:
+      # Binaries (Windows & Linux)
+      - template: ../jobs/binaries.yaml
+        parameters:
+          IndexSources: true
+          SignType: $(SignType) # NOTE this string won't be replaced until runtime
+          Configuration: Release
+          IsMicroBuildInternal: true
+          OneESPT: true
 
-- stage: PostPackage
-  jobs:
-  - template: ../jobs/postpackage.yaml
+    - stage: Package
+      jobs:
+      # Packages (Windows & Linux)
+      - template: ../jobs/packages.yaml
+        parameters:
+          SignType: $(SignType) # NOTE this string won't be replaced until runtime
+          Configuration: Release
+          IsMicroBuildInternal: true
+          OneESPT: true
+
+    - stage: PostPackage
+      jobs:
+      - template: ../jobs/postpackage.yaml
+        parameters:
+          OneESPT: true