119 lines
4.2 KiB
YAML
119 lines
4.2 KiB
YAML
|
# Release pipeline
|
||
|
|
# Variable 'prerelease' was defined in the Variables tab
|
||
|
|
# Variable 'prereleaseTag' was defined in the Variables tab
|
||
|
|
# Variable 'publishVersion' was defined in the Variables ta
|
||
|
|
|
||
|
|
pr: none
|
||
|
|
trigger: none
|
||
|
|
|
||
|
|
variables:
|
||
|
|
- group: "Github and NPM secrets"
|
||
|
|
- group: InfoSec-SecurityResults
|
||
|
|
- name: tags
|
||
|
|
value: production,externalfacing
|
||
|
|
|
||
|
|
jobs:
|
||
|
|
# These steps have to run on a windows machine,
|
||
|
|
# and therefore unfortunately can't be integrated in the regular steps
|
||
|
|
- job: Compliance
|
||
|
|
displayName: Compliance checks
|
||
|
|
pool: uifabric-windows-2019-small
|
||
|
|
workspace:
|
||
|
|
clean: all
|
||
|
|
steps:
|
||
|
|
- task: UseDotNet@2
|
||
|
|
condition: succeededOrFailed()
|
||
|
|
displayName: "Use .NET Core sdk 3.x"
|
||
|
|
inputs:
|
||
|
|
version: 3.x
|
||
|
|
steps:
|
||
|
|
|
||
|
|
- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@3
|
||
|
|
condition: succeededOrFailed()
|
||
|
|
displayName: "🧭 Run Credential Scanner"
|
||
|
|
inputs:
|
||
|
|
debugMode: false
|
||
|
|
|
||
|
|
- task: securedevelopmentteam.vss-secure-development-tools.build-task-eslint.ESLint@1
|
||
|
|
condition: succeededOrFailed()
|
||
|
|
displayName: "🧭 Run ESLint"
|
||
|
|
|
||
|
|
- task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
|
||
|
|
displayName: "🧭 Publish Guardian Artifacts - All Tools"
|
||
|
|
inputs:
|
||
|
|
ArtifactType: M365
|
||
|
|
condition: succeededOrFailed()
|
||
|
|
|
||
|
|
- task: AssetRetention@3
|
||
|
|
displayName: 🧭 Arrow Retention
|
||
|
|
inputs:
|
||
|
|
ArrowServiceConnection: "Arrow_uifabric_uifabric_PROD"
|
||
|
|
AssetGroupName: "$(System.TeamProject)_$(Build.DefinitionName)"
|
||
|
|
AssetNumber: "$(Build.BuildId)"
|
||
|
|
IsShipped: false
|
||
|
|
DropsToRetain: "CodeAnalysisLogs"
|
||
|
|
condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
|
||
|
|
|
||
|
|
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
|
||
|
|
displayName: "🧭 Guardian Break"
|
||
|
|
inputs:
|
||
|
|
GdnBreakPolicyMinSev: Warning
|
||
|
|
GdnBreakAllTools: true
|
||
|
|
GdnBreakGdnToolESLint: true
|
||
|
|
GdnBreakGdnToolESLintSeverity: Warning
|
||
|
|
GdnBreakPolicy: M365
|
||
|
|
condition: succeededOrFailed()
|
||
|
|
|
||
|
|
- job: Release
|
||
|
|
dependsOn: Compliance
|
||
|
|
pool: "1ES-Host-Ubuntu"
|
||
|
|
workspace:
|
||
|
|
clean: all
|
||
|
|
steps:
|
||
|
|
# For multiline scripts, we want the whole task to fail if any line of the script fails.
|
||
|
|
# ADO doesn't have bash configured this way by default. To fix we override the SHELLOPTS built-in variable.
|
||
|
|
# https://www.gnu.org/software/bash/manual/html_node/The-Set-Builtin.html
|
||
|
|
# The options below include ADO defaults (braceexpand:hashall:interactive-comments) plus
|
||
|
|
# errexit:errtrace for better error behavior.
|
||
|
|
- script: |
|
||
|
|
echo "##vso[task.setvariable variable=shellopts]braceexpand:hashall:interactive-comments:errexit:errtrace"
|
||
|
|
displayName: Force exit on error (bash)
|
||
|
|
|
||
|
|
- script: |
|
||
|
|
git checkout --track "origin/${BUILD_SOURCEBRANCH//refs\/heads\/}"
|
||
|
|
git pull
|
||
|
|
displayName: Re-attach HEAD
|
||
|
|
|
||
|
|
- task: NodeTool@0
|
||
|
|
inputs:
|
||
|
|
versionSpec: "16.x"
|
||
|
|
checkLatest: true
|
||
|
|
displayName: "Install Node.js"
|
||
|
|
|
||
|
|
- script: npm install
|
||
|
|
displayName: Install dependencies
|
||
|
|
|
||
|
|
- script: |
|
||
|
|
git config user.name "Fluent UI Build"
|
||
|
|
git config user.email "fluentui-internal@service.microsoft.com"
|
||
|
|
git remote set-url origin https://$(githubUser):$(githubPAT)@github.com/microsoft/use-disposable.git
|
||
|
|
displayName: Authenticate git for pushes
|
||
|
|
|
||
|
|
- script: |
|
||
|
|
echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > .npmrc
|
||
|
|
displayName: Write .npmrc
|
||
|
|
|
||
|
|
- script: |
|
||
|
|
npm run release -- $(publishVersion) --ci
|
||
|
|
displayName: Publish (official)
|
||
|
|
condition: eq(variables.prerelease, false)
|
||
|
|
env:
|
||
|
|
NPM_TOKEN: $(npmToken)
|
||
|
|
|
||
|
|
- script: |
|
||
|
|
npm run release -- $(publishVersion) --preRelease $(prereleaseTag) --ci
|
||
|
|
displayName: Publish (prerelease)
|
||
|
|
condition: eq(variables.prerelease, true)
|
||
|
|
env:
|
||
|
|
NPM_TOKEN: $(npmToken)
|