ci: lock container images

microsoft · Dec 5, 2023 · 0a0f9ba · 0a0f9ba
1 parent 4ded39c
commit 0a0f9ba
Show file tree

Hide file tree

Showing 2 changed files with 54 additions and 20 deletions.
diff --git a/build/azure-pipelines/alpine/product-build-alpine.yml b/build/azure-pipelines/alpine/product-build-alpine.yml
@@ -1,3 +1,11 @@
+parameters:
+  - name: VSCODE_BUILD_ALPINE
+    type: boolean
+    default: false
+  - name: VSCODE_BUILD_ALPINE_ARM64
+    type: boolean
+    default: false
+
 steps:
   - task: NodeTool@0
     inputs:
@@ -72,25 +80,47 @@ steps:
     displayName: Install build dependencies
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
 
-  - script: |
-      set -e
-      for i in {1..5}; do # try 5 times
-        yarn --frozen-lockfile --check-files && break
-        if [ $i -eq 3 ]; then
-          echo "Yarn failed too many times" >&2
-          exit 1
-        fi
-        echo "Yarn failed $i, trying again..."
-      done
-    env:
-      npm_config_arch: $(NPM_ARCH)
-      ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-      GITHUB_TOKEN: "$(github-distro-mixin-password)"
-      VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME: vscodehub.azurecr.io/vscode-linux-build-agent:alpine-$(VSCODE_ARCH)
-      VSCODE_HOST_MOUNT: "/mnt/vss/_work/1/s"
-    displayName: Install build dependencies
-    condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
+  - ${{ if eq(parameters.VSCODE_BUILD_ALPINE_ARM64, true) }}:
+    - script: |
+        set -e
+        for i in {1..5}; do # try 5 times
+          yarn --frozen-lockfile --check-files && break
+          if [ $i -eq 3 ]; then
+            echo "Yarn failed too many times" >&2
+            exit 1
+          fi
+          echo "Yarn failed $i, trying again..."
+        done
+      env:
+        npm_config_arch: $(NPM_ARCH)
+        ELECTRON_SKIP_BINARY_DOWNLOAD: 1
+        PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+        GITHUB_TOKEN: "$(github-distro-mixin-password)"
+        VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME: vscodehub.azurecr.io/vscode-linux-build-agent@sha256:9460a68ee75616af694fbfcb44705f3a9e2d2428d1c485cec69d574326db85a6
+        VSCODE_HOST_MOUNT: "/mnt/vss/_work/1/s"
+      displayName: Install dependencies
+      condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
+
+  - ${{ if eq(parameters.VSCODE_BUILD_ALPINE, true) }}:
+    - script: |
+        set -e
+        for i in {1..5}; do # try 5 times
+          yarn --frozen-lockfile --check-files && break
+          if [ $i -eq 3 ]; then
+            echo "Yarn failed too many times" >&2
+            exit 1
+          fi
+          echo "Yarn failed $i, trying again..."
+        done
+      env:
+        npm_config_arch: $(NPM_ARCH)
+        ELECTRON_SKIP_BINARY_DOWNLOAD: 1
+        PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+        GITHUB_TOKEN: "$(github-distro-mixin-password)"
+        VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME: vscodehub.azurecr.io/vscode-linux-build-agent@sha256:363166a7958f99ff581a62d94dec42217c16f1aed00e11875e30a59c178e52f9
+        VSCODE_HOST_MOUNT: "/mnt/vss/_work/1/s"
+      displayName: Install dependencies
+      condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
 
   - script: node build/azure-pipelines/distro/mixin-npm
     displayName: Mixin distro node modules

diff --git a/build/azure-pipelines/product-build.yml b/build/azure-pipelines/product-build.yml
@@ -146,7 +146,7 @@ name: "$(Date:yyyyMMdd).$(Rev:r) (${{ parameters.VSCODE_QUALITY }})"
 resources:
   containers:
     - container: snapcraft
-      image: vscodehub.azurecr.io/vscode-linux-build-agent:snapcraft-x64
+      image: vscodehub.azurecr.io/vscode-linux-build-agent@sha256:ab4a88c4d85e0d7a85acabba59543f7143f575bab2c0b2b07f5b77d4a7e491ff
       endpoint: VSCodeHub
   pipelines:
     - pipeline: vscode-7pm-kick-off
@@ -461,6 +461,8 @@ stages:
               NPM_ARCH: x64
             steps:
               - template: alpine/product-build-alpine.yml
+                parameters:
+                  VSCODE_BUILD_ALPINE: ${{ parameters.VSCODE_BUILD_ALPINE }}
 
         - ${{ if eq(parameters.VSCODE_BUILD_ALPINE_ARM64, true) }}:
           - job: LinuxAlpineArm64
@@ -470,6 +472,8 @@ stages:
               NPM_ARCH: arm64
             steps:
               - template: alpine/product-build-alpine.yml
+                parameters:
+                  VSCODE_BUILD_ALPINE_ARM64: ${{ parameters.VSCODE_BUILD_ALPINE_ARM64 }}
 
   - ${{ if and(eq(parameters.VSCODE_COMPILE_ONLY, false), eq(variables['VSCODE_BUILD_STAGE_MACOS'], true)) }}:
     - stage: macOS