SkiaSharp/scripts/azure-pipelines.yml

trigger:
  - main
  - develop
  - release/*

pr:
  - main
  - develop
  - release/*

parameters:
  - name: buildExternals
    displayName: 'The Build ID containing the specific native artifacts to use:'
    type: string
    default: 'latest'
  - name: buildAgentHost
    displayName: 'The generic host build agent configuration:'
    type: object
    default:
      pool:
        name: Maui-1ESPT
        image: 1ESPT-Windows2022
        os: windows
  - name: buildAgentWindows
    displayName: 'The Windows build agent configuration:'
    type: object
    default:
      pool:
        name: Maui-1ESPT
        image: 1ESPT-Windows2022
        os: windows
  - name: buildAgentWindowsNative
    displayName: 'The Windows build agent configuration for building the native assets:'
    type: object
    default:
      pool:
        name: Maui-1ESPT
        image: 1ESPT-Windows2022
        os: windows
  - name: buildAgentMac
    displayName: 'The macOS build agent configuration:'
    type: object
    default:
      pool:
        name: Azure Pipelines
        vmImage: macos-14
        os: macos
  - name: buildAgentMacNative
    displayName: 'The macOS build agent configuration for building the native assets:'
    type: object
    default:
      pool:
        name: Azure Pipelines
        vmImage: macos-13
        os: macos
  - name: buildAgentLinux
    displayName: 'The Linux build agent configuration:'
    type: object
    default:
      pool:
        name: Maui-1ESPT
        image: 1ESPT-Ubuntu22.04
        os: linux
  - name: buildAgentLinuxNative
    displayName: 'The Linux build agent configuration for building the native assets:'
    type: object
    default:
      pool:
        name: Maui-1ESPT
        image: 1ESPT-Ubuntu20.04
        os: linux
  - name: runCompliance
    displayName: 'Run post-build compliance tasks (such as API Scan and PoliCheck)'
    type: boolean
    default: false
  - name: forceRealSigning
    displayName: 'Ignore all logic and force Real signing on binaries'
    type: boolean
    default: false

variables:
  - template: /scripts/azure-pipelines-variables.yml@self

resources:
  repositories:
    - repository: xamarin-templates
      type: github
      name: xamarin/yaml-templates
      endpoint: xamarin
      ref: refs/heads/main
    - repository: 1ESPipelineTemplates
      type: git
      name: 1ESPipelineTemplates/1ESPipelineTemplates
      ref: refs/tags/release

extends:
  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
  parameters:
    pool: ${{ parameters.buildAgentHost.pool }}
    customBuildTags:
      - ES365AIMigrationTooling
    stages:
      - template: /scripts/azure-templates-stages.yml@self
        parameters:
          buildPipelineType: 'build'
          buildExternals: ${{ parameters.buildExternals }}
          ${{ if and(eq(variables['System.TeamProject'], 'devdiv'), ne(variables['System.PullRequest.IsFork'], 'true')) }}:
            enableSigning: true
            forceRealSigning: ${{ parameters.forceRealSigning }}
            ${{ if or(parameters.runCompliance, and(eq(variables['Build.Reason'], 'Schedule'), or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/')))) }}:
              sdl:
                apiscan:
                  enabled: true
                binskim:
                  enabled: true
                  break: false
                codeInspector:
                  enabled: true
                credscan:
                  enabled: true
                  # suppressionsFile: $(Build.SourcesDirectory)\scripts\guardian\CredScanSuppressions.json
                policheck:
                  enabled: true
                  exclusionsFile: $(Build.SourcesDirectory)\scripts\guardian\PoliCheckExclusions.xml
                spotBugs:
                  enabled: false
                suppression:
                  suppressionFile: $(Build.SourcesDirectory)\scripts\guardian\source.gdnsuppress
                tsa:
                  enabled: true
                  configFile: $(Build.SourcesDirectory)\scripts\guardian\tsaoptions-v2.json
          use1ESPipelineTemplates: true
          buildAgentHost: ${{ parameters.buildAgentHost }}
          buildAgentWindows: ${{ parameters.buildAgentWindows }}
          buildAgentWindowsNative: ${{ parameters.buildAgentWindowsNative }}
          buildAgentMac: ${{ parameters.buildAgentMac }}
          buildAgentMacNative: ${{ parameters.buildAgentMacNative }}
          buildAgentLinux: ${{ parameters.buildAgentLinux }}
          buildAgentLinuxNative: ${{ parameters.buildAgentLinuxNative }}
          buildAgentAndroidTests: ${{ parameters.buildAgentMac }}