releaseBuild.yml

trigger: none

variables:
  AuthenticodeSignType: '400'
  BuildConfiguration: 'Release'
  NuGetPackagePath: '$(System.ArtifactsDirectory)/NuGetRelease'
  PackageRoot: '$(System.ArtifactsDirectory)/Packages'

resources:
  repositories:
  - repository: ComplianceRepo
    type: github
    endpoint: ComplianceGHRepo
    name: PowerShell/compliance

stages:
- stage: Build
  displayName: Build Native Binaries
  dependsOn: []
  jobs:
  - job: BuildWin
    pool:
      vmImage: vs2017-win2016
    displayName: Windows
    strategy:
      matrix:
        x64:
          ARCHITECTURE: x64
        x86:
          ARCHITECTURE: x86
        x64ARM:
          ARCHITECTURE: x64_arm
        x64ARM64:
          ARCHITECTURE: x64_arm64
    steps:
    - template: windows-build.yml

  - job: SignWin
    pool: Package ES Standard Build
    displayName: Sign Windows
    variables:
    - group: ESRP
    dependsOn: BuildWin
    strategy:
      matrix:
        x64:
          ARCHITECTURE: x64
        x86:
          ARCHITECTURE: x86
        x64ARM:
          ARCHITECTURE: x64_arm
        x64ARM64:
          ARCHITECTURE: x64_arm64
    steps:
    - template: windows-sign.yml

  - job: BuildLinux
    displayName: Linux
    pool:
      vmImage: ubuntu-16.04
    strategy:
        matrix:
          UbuntuArm:
            LINUX_BUILDNAME: 'ubuntu.16.04-arm'
          CentOS:
            LINUX_BUILDNAME: 'centos.7'
          Alpine:
            LINUX_BUILDNAME: 'alpine'
          UbuntuArm64:
            LINUX_BUILDNAME: 'ubuntu.16.04-arm64'
          AlpineArm:
            LINUX_BUILDNAME: 'alpine-arm'
          AlpineArm64:
            LINUX_BUILDNAME: 'alpine-arm64'
    steps:
    - template: linux.yml

  - job: BuildMac
    displayName: Build Native Binaries on macOS
    pool:
      vmImage: macOS-Latest
    steps:
    - template: mac.yml

  - job: BuildNuGetPkg
    displayName: Build NuGet Package
    dependsOn:
    - SignWin
    - BuildLinux
    - BuildMac
    pool: Package ES Standard Build
    variables:
    - group: ESRP

    steps:
    - template: nuget.yml

- stage: compliance
  displayName: Compliance
  dependsOn: Build
  jobs:
  - job: Compliance_Job
    pool:
      name: Package ES Standard Build
    steps:
    - checkout: self
      clean: true
    - checkout: ComplianceRepo
      clean: true

    - download: current
      artifact: release

    - download: current
      artifact: signed

    - template: setVersion.yml

    - pwsh: |
        Get-ChildItem -Path 'ENV:'
      displayName: Capture environment

    - powershell: |
        $null = New-Item $(PackageRoot) -ItemType Directory -Force -Verbose
        if(-not (Test-Path '$(Pipeline.Workspace)/release' ))
        {
          New-Item -ItemType Directory -Path '$(Pipeline.Workspace)/release' -Force
        }
        Invoke-WebRequest -Uri '$(PSRPBlobUrl)' -OutFile $(Pipeline.Workspace)/release/psrp.zip -Verbose
      displayName: 'Download PSRP package'

    - powershell: 'Get-ChildItem $(Pipeline.Workspace)/release'
      displayName: 'Capture downloaded zips'

    - powershell: |
        $extractedRoot = New-Item $(Pipeline.Workspace)/uncompressed -ItemType Directory -Force -Verbose
        Get-ChildItem $(Pipeline.Workspace)/release/*.zip | ForEach-Object {
            $baseName = $_.BaseName
            if($baseName -match 'x64_arm') {
                Write-Verbose "Skipping expanding file $_.Name" -Verbose
            }
            else {
                $folderPath = Join-Path $extractedRoot $baseName
                Expand-Archive $_.FullName -DestinationPath $folderPath -Force
            }
        }
        Write-Host "Extracted files:"
        Get-ChildItem -Recurse $extractedRoot -File
      displayName: 'Extract All Zips'

    - pwsh: |
        Write-Verbose -Verbose "$(PackageVersion)"
      displayName: 'Write the package version'

    - template: assembly-module-compliance.yml@ComplianceRepo
      parameters:
        # binskim
        AnalyzeTarget: '$(Pipeline.Workspace)/uncompressed/*.dll'
        AnalyzeSymPath: 'SRV*'
        # component-governance
        sourceScanPath: '$(Build.SourcesDirectory)/powershell-native'
        # credscan
        suppressionsFile: ''
        # TermCheck
        optionsRulesDBPath: ''
        optionsFTPath: ''
        # tsa-upload
        codeBaseName: 'PowerShellNative'
        # selections
        softwareName: 'PowerShellNative'
        softwareNameFolder: '$(Pipeline.Workspace)/uncompressed'
        softwareVersion: '$(PackageVersion)'
        APIScan: true # set to false when not using Windows APIs.

- template: publish.yml
  parameters:
    stageName: AzArtifactsFeed
    environmentName: PSNativeAzArtifactApproval
    feedCredential: AzArtifactsFeed

- template: publish.yml
  parameters:
    stageName: NuGet
    environmentName: PSNativeNuGetApproval
    feedCredential: PowerShellNuGetOrgPush