Skip to content

Commit 79103ae

Browse files
vmorozvmoroz
committed
Fix tagging and improve security (#15860)
1 parent 1a1d30f commit 79103ae

6 files changed

Lines changed: 79 additions & 47 deletions

File tree

‎.ado/build-template.yml‎

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,9 @@ extends:
112112
# 1. Detect whether this is a release build or a developer build
113113
- pwsh: |
114114
$param = '${{ parameters.isReleaseBuild }}'
115-
$buildReason = '$(Build.Reason)'
116-
$sourceMessage = '$(Build.SourceVersionMessage)'
117-
$prSourceBranch = '$(System.PullRequest.SourceBranch)'
115+
$buildReason = $env:BUILD_REASON
116+
$sourceMessage = $env:SOURCE_MESSAGE
117+
$prSourceBranch = $env:PR_SOURCE_BRANCH
118118
119119
if ($param -eq 'true') {
120120
$isRelease = $true
@@ -144,6 +144,10 @@ extends:
144144
Write-Host "##vso[task.setvariable variable=isReleaseBuild]$isRelease"
145145
name: detectScenario
146146
displayName: Detect build scenario
147+
env:
148+
BUILD_REASON: $(Build.Reason)
149+
SOURCE_MESSAGE: $(Build.SourceVersionMessage)
150+
PR_SOURCE_BRANCH: $(System.PullRequest.SourceBranch)
147151
148152
# 2. Full checkout (needed for beachball bump on developer builds;
149153
# harmless ~1 min overhead on release builds where bump is skipped)
@@ -178,14 +182,18 @@ extends:
178182
condition: and(succeeded(), eq(variables['detectScenario.isReleaseBuild'], 'False'))
179183

180184
# 5. Beachball check (Developer PR only)
181-
- script: npx beachball check --branch origin/$(BeachBallBranchName) --verbose --changehint "##vso[task.logissue type=error]Run 'yarn change' from root of repo to generate a change file."
185+
- pwsh: npx beachball check --branch "origin/$env:BEACHBALL_BRANCH" --verbose --changehint "##vso[task.logissue type=error]Run 'yarn change' from root of repo to generate a change file."
182186
displayName: Check for change files
183187
condition: and(succeeded(), eq(variables['detectScenario.isReleaseBuild'], 'False'), eq(variables['Build.Reason'], 'PullRequest'))
188+
env:
189+
BEACHBALL_BRANCH: $(BeachBallBranchName)
184190

185191
# 6. Bump versions via prepare-release (Developer builds only)
186-
- script: npx prepare-release --bump-only --branch $(BeachBallBranchName) --no-color
192+
- pwsh: npx prepare-release --bump-only --branch $env:BEACHBALL_BRANCH --no-color
187193
displayName: Bump versions (prepare-release --bump-only)
188194
condition: and(succeeded(), eq(variables['detectScenario.isReleaseBuild'], 'False'))
195+
env:
196+
BEACHBALL_BRANCH: $(BeachBallBranchName)
189197

190198
# 7. Read version and set pipeline variables (always)
191199
- template: .ado/templates/set-version-vars.yml@self
@@ -470,13 +478,17 @@ extends:
470478

471479
# Tag the source commit when a RELEASE build succeeds (CI only)
472480
- ${{ if eq(parameters.buildEnvironment, 'Continuous') }}:
473-
- script: |
474-
TAG_NAME="react-native-windows_v$(npmVersion)"
475-
echo "Creating tag $TAG_NAME on $(Build.SourceVersion)"
476-
git -c http.extraheader="AUTHORIZATION: bearer $(System.AccessToken)" tag "$TAG_NAME" "$(Build.SourceVersion)"
477-
git -c http.extraheader="AUTHORIZATION: bearer $(System.AccessToken)" push origin "$TAG_NAME"
481+
- pwsh: |
482+
$tag = "react-native-windows_v$(npmVersion)"
483+
Write-Host "Creating tag $tag on $(Build.SourceVersion)"
484+
$authHeader = "AUTHORIZATION: bearer $env:SYSTEM_ACCESSTOKEN"
485+
Write-Host "##vso[task.setsecret]$authHeader"
486+
git -c http.extraheader="$authHeader" tag $tag "$(Build.SourceVersion)"
487+
git -c http.extraheader="$authHeader" push origin $tag
478488
displayName: Tag release sources
479489
condition: and(succeeded(), startsWith(variables['Build.SourceVersionMessage'], 'RELEASE:'))
490+
env:
491+
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
480492
481493
templateContext:
482494
sdl:

‎.ado/prepare-release-bot.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,10 +70,13 @@ jobs:
7070
- pwsh: Write-Host "##vso[task.setvariable variable=TargetBranch]${{ parameters.targetBranch }}"
7171
displayName: Set target branch from parameter
7272
- ${{ else }}:
73-
- pwsh: Write-Host "##vso[task.setvariable variable=TargetBranch]$(Build.SourceBranchName)"
73+
- pwsh: Write-Host "##vso[task.setvariable variable=TargetBranch]$env:SOURCE_BRANCH_NAME"
7474
displayName: Set target branch from source
75+
env:
76+
SOURCE_BRANCH_NAME: $(Build.SourceBranchName)
7577

76-
- script: npx prepare-release --branch $(TargetBranch) --no-color
78+
- pwsh: npx prepare-release --branch $env:TARGET_BRANCH --no-color
7779
displayName: Prepare Release
7880
env:
7981
GH_TOKEN: $(GitHubOAuthToken)
82+
TARGET_BRANCH: $(TargetBranch)

‎.ado/release.yml‎

Lines changed: 41 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -55,27 +55,44 @@ extends:
5555
steps:
5656
- checkout: none
5757

58-
- script: |
59-
echo == Build Variables ==
60-
echo Build.Reason: $(Build.Reason)
61-
echo Build.SourceBranch: $(Build.SourceBranch)
62-
echo Build.SourceVersion: $(Build.SourceVersion)
63-
echo Build.SourceVersionMessage: $(Build.SourceVersionMessage)
64-
echo Build.BuildNumber: $(Build.BuildNumber)
65-
echo Build.BuildId: $(Build.BuildId)
66-
echo Build.DefinitionName: $(Build.DefinitionName)
67-
echo Build.Repository.Name: $(Build.Repository.Name)
68-
echo System.TeamProject: $(System.TeamProject)
69-
echo.
70-
echo == Pipeline Resource: Publish ==
71-
echo Publish.runName: $(resources.pipeline.Publish.runName)
72-
echo Publish.runID: $(resources.pipeline.Publish.runID)
73-
echo Publish.sourceBranch: $(resources.pipeline.Publish.sourceBranch)
74-
echo Publish.sourceCommit: $(resources.pipeline.Publish.sourceCommit)
75-
echo Publish.pipelineID: $(resources.pipeline.Publish.pipelineID)
76-
echo Publish.requestedFor: $(resources.pipeline.Publish.requestedFor)
77-
echo Publish.requestedForID: $(resources.pipeline.Publish.requestedForID)
58+
- pwsh: |
59+
Write-Host "== Build Variables =="
60+
Write-Host "Build.Reason: $env:BUILD_REASON"
61+
Write-Host "Build.SourceBranch: $env:BUILD_SOURCEBRANCH"
62+
Write-Host "Build.SourceVersion: $env:BUILD_SOURCEVERSION"
63+
Write-Host "Build.SourceVersionMessage: $env:BUILD_SOURCEVERSIONMESSAGE"
64+
Write-Host "Build.BuildNumber: $env:BUILD_BUILDNUMBER"
65+
Write-Host "Build.BuildId: $env:BUILD_BUILDID"
66+
Write-Host "Build.DefinitionName: $env:BUILD_DEFINITIONNAME"
67+
Write-Host "Build.Repository.Name: $env:BUILD_REPOSITORY_NAME"
68+
Write-Host "System.TeamProject: $env:SYSTEM_TEAMPROJECT"
69+
Write-Host ""
70+
Write-Host "== Pipeline Resource: Publish =="
71+
Write-Host "Publish.runName: $env:PUBLISH_RUNNAME"
72+
Write-Host "Publish.runID: $env:PUBLISH_RUNID"
73+
Write-Host "Publish.sourceBranch: $env:PUBLISH_SOURCEBRANCH"
74+
Write-Host "Publish.sourceCommit: $env:PUBLISH_SOURCECOMMIT"
75+
Write-Host "Publish.pipelineID: $env:PUBLISH_PIPELINEID"
76+
Write-Host "Publish.requestedFor: $env:PUBLISH_REQUESTEDFOR"
77+
Write-Host "Publish.requestedForID: $env:PUBLISH_REQUESTEDFORID"
7878
displayName: Log all pipeline variables
79+
env:
80+
BUILD_REASON: $(Build.Reason)
81+
BUILD_SOURCEBRANCH: $(Build.SourceBranch)
82+
BUILD_SOURCEVERSION: $(Build.SourceVersion)
83+
BUILD_SOURCEVERSIONMESSAGE: $(Build.SourceVersionMessage)
84+
BUILD_BUILDNUMBER: $(Build.BuildNumber)
85+
BUILD_BUILDID: $(Build.BuildId)
86+
BUILD_DEFINITIONNAME: $(Build.DefinitionName)
87+
BUILD_REPOSITORY_NAME: $(Build.Repository.Name)
88+
SYSTEM_TEAMPROJECT: $(System.TeamProject)
89+
PUBLISH_RUNNAME: $(resources.pipeline.Publish.runName)
90+
PUBLISH_RUNID: $(resources.pipeline.Publish.runID)
91+
PUBLISH_SOURCEBRANCH: $(resources.pipeline.Publish.sourceBranch)
92+
PUBLISH_SOURCECOMMIT: $(resources.pipeline.Publish.sourceCommit)
93+
PUBLISH_PIPELINEID: $(resources.pipeline.Publish.pipelineID)
94+
PUBLISH_REQUESTEDFOR: $(resources.pipeline.Publish.requestedFor)
95+
PUBLISH_REQUESTEDFORID: $(resources.pipeline.Publish.requestedForID)
7996
8097
- pwsh: |
8198
$buildReason = $env:BUILD_REASON
@@ -255,11 +272,11 @@ extends:
255272
steps:
256273
- task: NuGetToolInstaller@1
257274
displayName: 'Use NuGet'
258-
- task: CmdLine@2
275+
- pwsh: nuget.exe SetApiKey $env:NUGET_API_KEY
259276
displayName: NuGet SetApiKey (nuget.org)
260-
inputs:
261-
script: nuget.exe SetApiKey $(nugetorg-apiKey-push)
262-
workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget
277+
workingDirectory: $(Pipeline.Workspace)/ReactWindows-final-nuget
278+
env:
279+
NUGET_API_KEY: $(nugetorg-apiKey-push)
263280
- script: dir /S "$(Pipeline.Workspace)\ReactWindows-final-nuget"
264281
displayName: Show directory contents
265282
- script: nuget.exe push .\Microsoft.ReactNative.*.nupkg -Source https://api.nuget.org/v3/index.json -SkipDuplicate -NoSymbol -NonInteractive -Verbosity Detailed

‎.ado/templates/compute-beachball-branch-name.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
11
steps:
22
- pwsh: |
3-
Write-Host "Setting BeachBallBranchName to $(System.PullRequest.TargetBranch)"
4-
Write-Host "##vso[task.setvariable variable=BeachBallBranchName]$(System.PullRequest.TargetBranch)"
3+
Write-Host "Setting BeachBallBranchName to $env:PR_TARGET_BRANCH"
4+
Write-Host "##vso[task.setvariable variable=BeachBallBranchName]$env:PR_TARGET_BRANCH"
55
displayName: Set BeachBallBranchName for Pull Request
66
condition: ${{ eq(variables['Build.Reason'], 'PullRequest') }}
7+
env:
8+
PR_TARGET_BRANCH: $(System.PullRequest.TargetBranch)
79
810
- pwsh: |
9-
Write-Host "Setting BeachBallBranchName to $(Build.SourceBranchName)"
10-
Write-Host "##vso[task.setvariable variable=BeachBallBranchName]$(Build.SourceBranchName)"
11+
Write-Host "Setting BeachBallBranchName to $env:SOURCE_BRANCH_NAME"
12+
Write-Host "##vso[task.setvariable variable=BeachBallBranchName]$env:SOURCE_BRANCH_NAME"
1113
displayName: Set BeachBallBranchName for CI
1214
condition: ${{ ne(variables['Build.Reason'], 'PullRequest') }}
15+
env:
16+
SOURCE_BRANCH_NAME: $(Build.SourceBranchName)

‎.ado/templates/verdaccio-start.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,10 @@ steps:
1717
- template: compute-beachball-branch-name.yml
1818

1919
- ${{ if eq(parameters.beachballPublish, true) }}:
20-
- script: npx beachball bump --branch origin/$(BeachBallBranchName) --no-push --yes --verbose --changehint "Run `yarn change` from root of repo to generate a change file."
20+
- pwsh: npx beachball bump --branch "origin/$env:BEACHBALL_BRANCH" --no-push --yes --verbose --changehint "Run 'yarn change' from root of repo to generate a change file."
2121
displayName: Beachball bump versions
22+
env:
23+
BEACHBALL_BRANCH: $(BeachBallBranchName)
2224

2325
- script: node .ado/scripts/npmPack.js --clean --no-color
2426
displayName: Pack all workspace packages

‎.ado/variables/shared.yml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,4 @@
11
variables:
2-
# Task auto-injection configuration
3-
Codeql.SkipTaskAutoInjection: true
4-
NugetSecurityAnalysisWarningLevel: 'warn'
5-
runCodesignValidationInjection: false
6-
skipComponentGovernanceDetection: true
7-
82
# Enables `chalk` to show colored output to Azure Pipelines
93
FORCE_COLOR: 3
104

0 commit comments

Comments
 (0)