256 строки
8.1 KiB
YAML
256 строки
8.1 KiB
YAML
resources:
|
|
- repo: self
|
|
|
|
trigger:
|
|
batch: true
|
|
branches:
|
|
include:
|
|
- '*'
|
|
|
|
pr:
|
|
branches:
|
|
include:
|
|
- '*'
|
|
|
|
jobs:
|
|
- job: CredScan
|
|
displayName: "Credential Scan"
|
|
pool:
|
|
name: 'pool-windows-2019'
|
|
steps:
|
|
- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@3
|
|
displayName: 'Run Credential Scanner'
|
|
inputs:
|
|
toolVersion: latest
|
|
suppressionsFile: './scripts/ci/credscan/CredScanSuppressions.json'
|
|
|
|
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
|
|
displayName: 'Post Analysis'
|
|
inputs:
|
|
GdnBreakAllTools: false
|
|
GdnBreakGdnToolCredScan: true
|
|
GdnBreakGdnToolCredScanSeverity: Error
|
|
|
|
- job: PolicyCheck
|
|
displayName: "Policy Check"
|
|
pool:
|
|
name: 'pool-windows-2019'
|
|
steps:
|
|
- task: securedevelopmentteam.vss-secure-development-tools.build-task-policheck.PoliCheck@2
|
|
displayName: 'Run Policy Check'
|
|
inputs:
|
|
targetType: F
|
|
result: PoliCheckResult.xml
|
|
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
|
|
displayName: 'Post Analysis'
|
|
inputs:
|
|
GdnBreakAllTools: false
|
|
GdnBreakGdnToolPoliCheck: true
|
|
GdnBreakGdnToolPoliCheckSeverity: Error
|
|
|
|
- job: CheckLicenseHeader
|
|
displayName: "Check License"
|
|
pool:
|
|
name: 'pool-ubuntu-2004'
|
|
steps:
|
|
- task: UsePythonVersion@0
|
|
displayName: 'Use Python 3.12'
|
|
inputs:
|
|
versionSpec: 3.12
|
|
- template: .azure-pipelines/templates/azdev_setup.yml
|
|
- bash: |
|
|
#!/usr/bin/env bash
|
|
set -ev
|
|
source ./env/bin/activate
|
|
azdev verify license
|
|
|
|
- job: IndexVerify
|
|
displayName: "Verify Extensions Index"
|
|
pool:
|
|
name: 'pool-ubuntu-2004'
|
|
steps:
|
|
- task: UsePythonVersion@0
|
|
displayName: 'Use Python 3.12'
|
|
inputs:
|
|
versionSpec: 3.12
|
|
- bash: |
|
|
#!/usr/bin/env bash
|
|
set -ev
|
|
pip install wheel==0.30.0 requests packaging setuptools
|
|
export CI="ADO"
|
|
python ./scripts/ci/test_index.py -v
|
|
displayName: "Verify Extensions Index"
|
|
|
|
- job: SourceTests
|
|
displayName: "Integration Tests, Build Tests"
|
|
pool:
|
|
name: 'pool-ubuntu-2004'
|
|
strategy:
|
|
matrix:
|
|
Python39:
|
|
python.version: '3.9'
|
|
Python310:
|
|
python.version: '3.10'
|
|
Python311:
|
|
python.version: '3.11'
|
|
Python312:
|
|
python.version: '3.12'
|
|
steps:
|
|
- task: UsePythonVersion@0
|
|
displayName: 'Use Python $(python.version)'
|
|
inputs:
|
|
versionSpec: '$(python.version)'
|
|
- template: .azure-pipelines/templates/azdev_setup.yml
|
|
- bash: pip install wheel==0.30.0
|
|
displayName: 'Install wheel==0.30.0'
|
|
- bash: |
|
|
#!/usr/bin/env bash
|
|
set -ev
|
|
source ./env/bin/activate
|
|
az --version
|
|
python scripts/ci/test_source.py -v
|
|
displayName: 'Run integration test and build test'
|
|
env:
|
|
ADO_PULL_REQUEST_LATEST_COMMIT: HEAD
|
|
ADO_PULL_REQUEST_TARGET_BRANCH: $(System.PullRequest.TargetBranch)
|
|
|
|
- job: AzdevStyleModifiedExtensions
|
|
displayName: "azdev style on Modified Extensions"
|
|
condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
|
|
continueOnError: true
|
|
pool:
|
|
name: 'pool-ubuntu-2004'
|
|
steps:
|
|
- task: UsePythonVersion@0
|
|
displayName: 'Use Python 3.12'
|
|
inputs:
|
|
versionSpec: 3.12
|
|
- template: .azure-pipelines/templates/azdev_setup.yml
|
|
- bash: |
|
|
#!/usr/bin/env bash
|
|
set -ev
|
|
source ./env/bin/activate
|
|
# overwrite the default AZURE_EXTENSION_DIR set by ADO
|
|
AZURE_EXTENSION_DIR=~/.azure/cliextensions az --version
|
|
|
|
AZURE_EXTENSION_DIR=~/.azure/cliextensions python scripts/ci/azdev_linter_style.py --type style
|
|
displayName: "azdev style on Modified Extensions"
|
|
env:
|
|
ADO_PULL_REQUEST_LATEST_COMMIT: HEAD
|
|
ADO_PULL_REQUEST_TARGET_BRANCH: $(System.PullRequest.TargetBranch)
|
|
|
|
- job: AzdevLinterModifiedExtensions
|
|
displayName: "azdev linter on Modified Extensions"
|
|
condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
|
|
pool:
|
|
name: 'pool-ubuntu-2004'
|
|
steps:
|
|
- task: UsePythonVersion@0
|
|
displayName: 'Use Python 3.12'
|
|
inputs:
|
|
versionSpec: 3.12
|
|
- template: .azure-pipelines/templates/azdev_setup.yml
|
|
- bash: |
|
|
#!/usr/bin/env bash
|
|
set -ev
|
|
source ./env/bin/activate
|
|
# overwrite the default AZURE_EXTENSION_DIR set by ADO
|
|
AZURE_EXTENSION_DIR=~/.azure/cliextensions az --version
|
|
|
|
# TODO: remove --type linter once all extensions are fixed
|
|
AZURE_EXTENSION_DIR=~/.azure/cliextensions python scripts/ci/azdev_linter_style.py --type linter
|
|
displayName: "azdev linter on Modified Extensions"
|
|
env:
|
|
ADO_PULL_REQUEST_LATEST_COMMIT: HEAD
|
|
ADO_PULL_REQUEST_TARGET_BRANCH: $(System.PullRequest.TargetBranch)
|
|
|
|
- job: AzdevScanModifiedExtensionsHigh
|
|
displayName: "azdev scan ( High Confidence ) on Modified Extensions"
|
|
condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
|
|
pool:
|
|
name: 'pool-ubuntu-2004'
|
|
steps:
|
|
- task: UsePythonVersion@0
|
|
displayName: 'Use Python 3.11'
|
|
inputs:
|
|
versionSpec: 3.11
|
|
- template: .azure-pipelines/templates/azdev_setup.yml
|
|
- bash: |
|
|
#!/usr/bin/env bash
|
|
set -ev
|
|
source ./env/bin/activate
|
|
git fetch origin --depth=1 $(System.PullRequest.TargetBranch)
|
|
declare -A secret_files
|
|
for FILE in `git diff --name-only --diff-filter=AM origin/$(System.PullRequest.TargetBranch)` ; do
|
|
detected=$(azdev scan -f $FILE --continue-on-failure| python -c "import sys, json; print(json.load(sys.stdin)['secrets_detected'])")
|
|
if [ $detected == 'True' ]; then
|
|
printf "\033[0;31mSecrets detected from %s, Please remove or replace it. You can run 'azdev scan'/'azdev mask' locally to fix.\033[0m\n" "$FILE"
|
|
secret_files+=$FILE
|
|
fi
|
|
done
|
|
if [ "${#secret_files[@]}" -gt 0 ]; then
|
|
exit 1
|
|
fi
|
|
displayName: "azdev scan ( High Confidence ) on Modified Extensions"
|
|
|
|
- job: AzdevScanProModifiedExtensionsMedium
|
|
displayName: "azdev scan ( Medium Confidence ) on Modified Extensions"
|
|
dependsOn: AzdevScanModifiedExtensionsHigh
|
|
condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
|
|
continueOnError: true
|
|
pool:
|
|
name: 'pool-ubuntu-2004'
|
|
steps:
|
|
- task: UsePythonVersion@0
|
|
displayName: 'Use Python 3.11'
|
|
inputs:
|
|
versionSpec: 3.11
|
|
- template: .azure-pipelines/templates/azdev_setup.yml
|
|
- bash: |
|
|
#!/usr/bin/env bash
|
|
set -ev
|
|
source ./env/bin/activate
|
|
git fetch origin --depth=1 $(System.PullRequest.TargetBranch)
|
|
declare -A secret_files
|
|
for FILE in `git diff --name-only --diff-filter=AM origin/$(System.PullRequest.TargetBranch)` ; do
|
|
detected=$(azdev scan --confidence-level MEDIUM -f $FILE --continue-on-failure| python -c "import sys, json; print(json.load(sys.stdin)['secrets_detected'])")
|
|
if [ $detected == 'True' ]; then
|
|
printf "\033[0;31mSecrets detected from %s, Please remove or replace it. You can run 'azdev scan --confidence-level MEDIUM'/'azdev mask --confidence-level MEDIUM' locally to fix.\033[0m\n" "$FILE"
|
|
secret_files+=$FILE
|
|
fi
|
|
done
|
|
if [ "${#secret_files[@]}" -gt 0 ]; then
|
|
exit 1
|
|
fi
|
|
displayName: "azdev scan ( Medium Confidence ) on Modified Extensions"
|
|
|
|
#- job: IndexRefDocVerify
|
|
# displayName: "Verify Ref Docs"
|
|
# continueOnError: true
|
|
# pool:
|
|
# name: 'pool-ubuntu-2004'
|
|
# steps:
|
|
# - task: UsePythonVersion@0
|
|
# displayName: 'Use Python 3.12'
|
|
# inputs:
|
|
# versionSpec: 3.12
|
|
# - bash: pip install wheel==0.30.0
|
|
# displayName: 'Install wheel==0.30.0'
|
|
# - task: Bash@3
|
|
# displayName: "Verify Extension Ref Docs"
|
|
# inputs:
|
|
# targetType: 'filePath'
|
|
# filePath: scripts/ci/test_index_ref_doc.sh
|
|
|
|
- job: CheckInit
|
|
displayName: "Check Init Files"
|
|
pool:
|
|
name: 'pool-ubuntu-2004'
|
|
steps:
|
|
- task: UsePythonVersion@0
|
|
displayName: 'Use Python 3.x'
|
|
inputs:
|
|
versionSpec: 3.x
|
|
- bash: |
|
|
python scripts/ci/test_init.py -v
|