msi-steps.yml

parameters:
  BuildToPackage: current
  DoFreethreaded: false
  SigningCertificate: ''
  Artifacts: []

steps:
  - template: ./checkout.yml

  - powershell: |
      $d = (.\PCbuild\build.bat -V) | %{ if($_ -match '\s+(\w+):\s*(.+)\s*$') { @{$Matches[1] = $Matches[2];} }};
      Write-Host "##vso[task.setvariable variable=SigningDescription]Python $($d.PythonVersion)"
    displayName: 'Update signing description'
    condition: and(succeeded(), not(variables['SigningDescription']))

  - ${{ each a in parameters.Artifacts }}:
    - task: DownloadPipelineArtifact@2
      displayName: 'Download artifact: ${{ a.artifact }}'
      inputs:
        ${{ if eq(parameters.BuildToPackage, 'current') }}:
          buildType: current
        ${{ else }}:
          buildType: specific
          buildVersionToDownload: specific
          project: $(resources.pipeline.build_to_package.projectId)
          pipeline: $(resources.pipeline.build_to_package.pipelineId)
          runId: $(resources.pipeline.build_to_package.runID)
        artifact: ${{ a.artifact }}
        ${{ if a.target }}:
          targetPath: ${{ a.target }}
        ${{ else }}:
          targetPath: $(Pipeline.Workspace)\${{ a.artifact }}

    # Assuming we'll always run the amd64 build
    - ${{ if eq(a.artifact, 'bin_amd64') }}:
      - powershell: >
          copy
          "${env:TARGET_PATH}\Activate.ps1"
          "$(Build.SourcesDirectory)\Lib\venv\scripts\common\Activate.ps1"
          -Force
          -Verbose
        displayName: 'Copy signed files into sources'
        env:
          ${{ if a.target }}:
            TARGET_PATH: ${{ a.target }}
          ${{ else }}:
            TARGET_PATH: $(Pipeline.Workspace)\${{ a.artifact }}

  - script: |
      call PCbuild\find_python.bat "%PYTHON%"
      call Tools\msi\get_externals.bat
      call PCbuild\find_msbuild.bat
      echo ##vso[task.setvariable variable=PYTHON]%PYTHON%
      echo ##vso[task.setvariable variable=MSBUILD]%MSBUILD%
      %PYTHON% -m ensurepip
    displayName: 'Get external dependencies'
    env:
      PYTHON: $(Build.BinariesDirectory)\win32\python.exe
      PYTHONHOME: $(Build.SourcesDirectory)

  - powershell: |
      ("/p:Py_OutDir=" + $env:BUILD_BINARIESDIRECTORY) | Out-File msbuild.rsp -Encoding UTF8
      "/p:BuildForRelease=true" | Out-File msbuild.rsp -Append -Encoding UTF8
      Write-Host "##vso[task.setvariable variable=ResponseFile]$(gi msbuild.rsp)"
      gc msbuild.rsp
    displayName: 'Generate response file'

  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
    - powershell: |
        "/p:IncludeFreethreaded=true" | Out-File "$(ResponseFile)" -Append -Encoding UTF8
        gc "$(ResponseFile)"
      displayName: 'Add Include_freethreaded to response file'

  - ${{ if parameters.SigningCertificate }}:
    - template: sign-files.yml
      parameters:
        Include: ''
        ExportCommand: SignCommand
        SigningCertificate: ${{ parameters.SigningCertificate }}
        # WiX is struggling with WIF authentication and sign.exe right now,
        # so we still rely on the client secret for legacy builds.
        # We disable the service connection here to skip the login steps.
        AzureServiceConnectionName: ''

    - powershell: |
        $cmd = $env:SignCommand -replace '"', '\"'
        "/p:_SignCommand=""$cmd""" | Out-File $env:ResponseFile -Append -Encoding UTF8
      displayName: 'Inject sign command into response file'
      env:
        SignCommand: $(SignCommand)
        ResponseFile: $(ResponseFile)

  - script: |
      %MSBUILD% Tools\msi\launcher\launcher.wixproj "@$(ResponseFile)"
    displayName: 'Build launcher installer'
    env:
      Platform: x86
      # Only need the variable here for msi.props to detect
      SigningCertificate: ${{ parameters.SigningCertificate }}
      ${{ if parameters.SigningCertificate }}:
        AZURE_TENANT_ID: $(TrustedSigningTenantId)
        AZURE_CLIENT_ID: $(TrustedSigningClientId)
        AZURE_CLIENT_SECRET: $(TrustedSigningClientSecret)

  - ${{ each b in parameters.Bundles }}:
    - script: |
        %MSBUILD% Tools\msi\bundle\releaselocal.wixproj /t:Rebuild /p:RebuildAll=true "@$(ResponseFile)"
      displayName: 'Build ${{ b.bundle }} installer'
      env:
        Platform: ${{ b.Platform }}
        PYTHON: ${{ b.PythonForBuild }}\python.exe
        PythonForBuild: ${{ b.PythonForBuild }}\python.exe
        PYTHONHOME: $(Build.SourcesDirectory)
        ${{ if b.TclTkArtifact }}:
          TclTkLibraryDir: $(Pipeline.Workspace)\${{ b.TclTkArtifact }}
        # Only need the variable here for msi.props to detect
        SigningCertificate: ${{ parameters.SigningCertificate }}
        ${{ if parameters.SigningCertificate }}:
          AZURE_TENANT_ID: $(TrustedSigningTenantId)
          AZURE_CLIENT_ID: $(TrustedSigningClientId)
          AZURE_CLIENT_SECRET: $(TrustedSigningClientSecret)

  - powershell: |
      del $env:ResponseFile -ErrorAction Continue
    displayName: 'Remove response file (always runs)'
    condition: ne(variables['ResponseFile'], '')
    env:
      ResponseFile: $(ResponseFile)

  - ${{ each b in parameters.Bundles }}:
    - task: CopyFiles@2
      displayName: 'Assemble artifact: msi (${{ b.bundle }})'
      inputs:
        sourceFolder: $(Build.BinariesDirectory)\${{ b.bundle }}\en-us
        targetFolder: $(Build.ArtifactStagingDirectory)\msi\${{ b.bundle }}
        contents: |
          *.msi
          *.cab
          *.exe

  - powershell: |
      git clone $(Build.Repository.Uri) -b $(Build.SourceBranchName) --single-branch --no-checkout "$(Pipeline.Workspace)\release-tools"
      git -C "$(Pipeline.Workspace)\release-tools" checkout $(Build.SourceVersion)
    displayName: 'Clone the python/release-tools repository'

  - powershell: >
      & $(${env:Python}.Trim('"'))
      "$(Pipeline.Workspace)\release-tools\sbom.py"
      "--cpython-source-dir=$(Build.SourcesDirectory)"
      $(gci -r "$(Build.ArtifactStagingDirectory)\msi\**\python-*.exe")
    workingDirectory: $(Build.BinariesDirectory)
    condition: and(succeeded(), not(variables['SkipSBOM']))
    displayName: 'Create SBOMs for binaries'
    env:
      PYTHON: $(Build.BinariesDirectory)\win32\python.exe
      PYTHONHOME: $(Build.SourcesDirectory)

  - task: CopyFiles@2
    displayName: 'Layout Artifact: sbom'
    condition: and(succeeded(), not(variables['SkipSBOM']))
    inputs:
      sourceFolder: $(Build.ArtifactStagingDirectory)\msi
      targetFolder: $(Build.ArtifactStagingDirectory)\sbom
      flatten: true
      flattenFolders: true
      contents: |
        **\*.spdx.json

  - publish: '$(Build.ArtifactStagingDirectory)\msi'
    artifact: msi
    displayName: 'Publish MSI'

  - task: PublishBuildArtifacts@1
    displayName: 'Publish Artifact: sbom'
    condition: and(succeeded(), not(variables['SkipSBOM']))
    inputs:
      PathtoPublish: '$(Build.ArtifactStagingDirectory)\sbom'
      ArtifactName: sbom