SecretStore-Official.yml

#################################################################################
#                               OneBranch Pipelines                             #
# This pipeline was created by EasyStart from a sample located at:              #
#   https://aka.ms/obpipelines/easystart/samples                                #
# Documentation:  https://aka.ms/obpipelines                                    #
# Yaml Schema:    https://aka.ms/obpipelines/yaml/schema                        #
# Retail Tasks:   https://aka.ms/obpipelines/tasks                              #
# Support:        https://aka.ms/onebranchsup                                   #
#################################################################################

trigger:
- main

schedules:
- cron: '23 16 * * 4'
  displayName: Weekly CodeQL
  branches:
    include:
    - main
  always: true

parameters:
- name: debug
  displayName: Enable debug output
  type: boolean
  default: false

variables:
  system.debug: ${{ parameters.debug }}
  BuildConfiguration: Release
  WindowsContainerImage: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
  DOTNET_NOLOGO: true
  DOTNET_GENERATE_ASPNET_CERTIFICATE: false

resources:
  repositories:
    - repository: templates
      type: git
      name: OneBranch.Pipelines/GovernedTemplates
      ref: refs/heads/main

extends:
  # https://aka.ms/obpipelines/templates
  template: v2/OneBranch.Official.CrossPlat.yml@templates
  parameters:
    globalSdl: # https://aka.ms/obpipelines/sdl
      asyncSdl:
        enabled: true
        forStages: [build]
    featureFlags:
      EnableCDPxPAT: false
      WindowsHostVersion:
        Version: 2022
        Network: Netlock
    stages:
    - stage: build
      jobs:
      - job: main
        displayName: Build package
        pool:
          type: windows
        variables:
          ob_outputDirectory: $(Build.SourcesDirectory)/out
        steps:
          - pwsh: |
              [xml]$xml = Get-Content Directory.Build.props
              $version = $xml.Project.PropertyGroup.ModuleVersion
              Write-Output "##vso[task.setvariable variable=version;isOutput=true]$version"
            name: package
            displayName: Get version from project properties
          - task: onebranch.pipeline.version@1
            displayName: Set OneBranch version
            inputs:
              system: Custom
              customVersion: $(package.version)
          - task: UseDotNet@2
            displayName: Use .NET SDK
            inputs:
              packageType: sdk
              useGlobalJson: true
          - pwsh: ./tools/installPSResources.ps1 -PSRepository CFS
            displayName: Install PSResources
          - pwsh: Invoke-Build -Configuration $(BuildConfiguration) -Task Build, Test
            displayName: Build
          - task: onebranch.pipeline.signing@1
            displayName: Sign 1st-party files in module
            inputs:
              command: sign
              signing_profile: external_distribution
              search_root: $(Build.SourcesDirectory)/module
              files_to_sign: |
                Microsoft.*.dll;
                **/Microsoft.*.psd1;
                **/Microsoft.*.psm1;
          - task: ArchiveFiles@2
            displayName: Zip module
            inputs:
              rootFolderOrFile: $(Build.SourcesDirectory)/module
              includeRootFolder: false
              archiveType: zip
              archiveFile: out/SecretStore-v$(package.version).zip
          - pwsh: Invoke-Build -Configuration $(BuildConfiguration) Package
            displayName: Package module
          - task: onebranch.pipeline.signing@1
            displayName: Sign NuGet package
            inputs:
              command: sign
              signing_profile: external_distribution
              search_root: $(Build.SourcesDirectory)/out
              files_to_sign: |
                *.nupkg
    - stage: release
      dependsOn: build
      condition: eq(variables['Build.Reason'], 'Manual')
      variables:
        version: $[ stageDependencies.build.main.outputs['package.version'] ]
        drop: $(Pipeline.Workspace)/drop_build_main
      jobs:
      - job: github
        displayName: Publish draft to GitHub
        pool:
          type: windows
        variables:
          ob_outputDirectory: $(Build.SourcesDirectory)/out
        steps:
        - download: current
          displayName: Download artifacts
        - task: GitHubRelease@1
          displayName: Create GitHub release
          inputs:
            gitHubConnection: GitHub
            repositoryName: PowerShell/SecretStore
            assets: |
              $(drop)/Microsoft.PowerShell.SecretStore.$(version).nupkg
              $(drop)/SecretStore-v$(version).zip
            tagSource: userSpecifiedTag
            tag: v$(version)
            isDraft: true
            addChangeLog: false
            releaseNotesSource: inline
            releaseNotesInline: "<!-- TODO: Generate release notes on GitHub! -->"
      - job: validation
        displayName: Manual validation
        pool:
          type: agentless
        timeoutInMinutes: 1440
        steps:
        - task: ManualValidation@0
          displayName: Wait 24 hours for validation
          inputs:
            notifyUsers: $(Build.RequestedForEmail)
            instructions: Please validate the release and then publish it!
            timeoutInMinutes: 1440
      - job: publish
        dependsOn: validation
        displayName: Publish to PowerShell Gallery
        pool:
          type: windows
        variables:
          ob_outputDirectory: $(Build.SourcesDirectory)/out
        steps:
        - download: current
          displayName: Download artifacts
        - task: NuGetCommand@2
          displayName: Publish module to PowerShell Gallery
          inputs:
            command: push
            packagesToPush: $(drop)/Microsoft.PowerShell.SecretStore.$(version).nupkg
            nuGetFeedType: external
            publishFeedCredentials: PowerShellGallery