azure-pipelines.yml

schedules:
- cron: 0 9 * * 1
  displayName: "Run CodeQL3000 weekly, Monday at 2:00 AM PDT"
  branches:
    include:
    - main
  always: true

parameters:
# Parameter below is ignored in public builds.
#
# Choose whether to run the CodeQL3000 tasks.
# Manual builds align w/ official builds unless this parameter is true.
- name: runCodeQL3000
  default: false
  displayName: Run CodeQL3000 tasks
  type: boolean

variables:
  - name: _BuildConfig
    value: Release
  - name: _TeamName
    value: AspNetCore
  - name: DOTNET_SKIP_FIRST_TIME_EXPERIENCE
    value: true
  - name: _PublishUsingPipelines
    value: true
  - name: _DotNetArtifactsCategory
    value: ASPNETENTITYFRAMEWORK6
  - ${{ if ne(variables['System.TeamProject'], 'public') }}:
    - group: DotNet-MSRC-Storage
    - name: _InternalRuntimeDownloadArgs
      value: /p:DotNetRuntimeSourceFeed=https://dotnetclimsrc.blob.core.windows.net/dotnet
             /p:DotNetRuntimeSourceFeedKey=$(dotnetclimsrc-read-sas-token-base64)
  - ${{ if eq(variables['System.TeamProject'], 'public') }}:
    - name: _InternalRuntimeDownloadArgs
      value: ''
  - name: runCodeQL3000
    value: ${{ and(ne(variables['System.TeamProject'], 'public'), or(eq(variables['Build.Reason'], 'Schedule'), and(eq(variables['Build.Reason'], 'Manual'), eq(parameters.runCodeQL3000, 'true')))) }}

trigger:
  batch: true
  branches:
    include:
      - main
      - release/*
      - internal/release/6.*

pr: ['*']

stages:
- stage: build
  displayName: Build
  jobs:
    - template: eng/common/templates/jobs/jobs.yml
      parameters:
        enableMicrobuild: ${{ ne(variables.runCodeQL3000, 'true') }}
        enablePublishBuildArtifacts: true
        enablePublishBuildAssets: ${{ ne(variables.runCodeQL3000, 'true') }}
        enablePublishTestResults: ${{ ne(variables.runCodeQL3000, 'true') }}
        enablePublishUsingPipelines: ${{ variables._PublishUsingPipelines }}
        enableTelemetry: true
        helixRepo: dotnet/ef6
        jobs:
          - job: Windows
            pool:
              ${{ if eq(variables['System.TeamProject'], 'public') }}:
                name: NetCore-Public
                demands: ImageOverride -equals 1es-windows-2019-open
              ${{ if ne(variables['System.TeamProject'], 'public') }}:
                name: NetCore1ESPool-Internal
                demands: ImageOverride -equals 1es-windows-2019
            ${{ if eq(variables.runCodeQL3000, 'true') }}:
              # Component governance and SBOM creation are not needed here. Disable what Arcade would inject.
              disableComponentGovernance: true
              enableSbom: false
              # CodeQL3000 extends build duration.
              timeoutInMinutes: 240
            ${{ else }}:
              timeoutInMinutes: 180
            variables:
              - _InternalBuildArgs: ''
              - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
                - group: DotNet-Blob-Feed
                - _SignType: real
                - _InternalBuildArgs: /p:DotNetSignType=$(_SignType)
                                      /p:TeamName=$(_TeamName)
                                      /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
                                      /p:DotNetPublishUsingPipelines=$(_PublishUsingPipelines)
                                      /p:DotNetArtifactsCategory=$(_DotNetArtifactsCategory)
              - ${{ if eq(variables.runCodeQL3000, 'true') }}:
                - _AdditionalBuildArgs: /p:Test=false /p:Sign=false /p:Pack=false /p:Publish=false /p:UseSharedCompilation=false
                # Security analysis is included in normal runs. Disable its auto-injection.
                - skipNugetSecurityAnalysis: true
                # Do not let CodeQL3000 Extension gate scan frequency.
                - Codeql.Cadence: 0
                # Enable CodeQL3000 unconditionally so it may be run on any branch.
                - Codeql.Enabled: true
                # Ignore test and infrastructure code.
                - Codeql.SourceRoot: src
                # CodeQL3000 needs this plumbed along as a variable to enable TSA.
                - Codeql.TSAEnabled: ${{ eq(variables['Build.Reason'], 'Schedule') }}
                # Default expects tsaoptions.json under SourceRoot.
                - Codeql.TSAOptionsPath: '$(Build.SourcesDirectory)/.config/tsaoptions.json'
            steps:
              - checkout: self
                clean: true
              - powershell: >
                  Get-ChildItem -ErrorAction SilentlyContinue -Recurse 'C:\Program Files\Microsoft SQL Server\sqlcmd.exe' |
                  Sort-Object -Property @{Expression={$_.FullName.Length}; Descending=$true},@{Expression={$_.FullName}; Descending=$true} |
                  Select-Object -First 1 |
                  Foreach-Object {Write-Host "##vso[task.prependpath]$($_.DirectoryName)"}
                displayName: Add SqlCmd to path
              - script: tools\CleanMSSQLLocalDB.cmd
                displayName: Cleanup LocalDB databases
              - task: NuGetCommand@2
                displayName: 'Clear NuGet caches'
                condition: succeeded()
                inputs:
                  command: custom
                  arguments: 'locals all -clear'
              - ${{ if ne(variables['System.TeamProject'], 'public') }}:
                - task: PowerShell@2
                  displayName: Setup Private Feeds Credentials
                  inputs:
                    filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
                    arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token
                  env:
                    Token: $(dn-bot-dnceng-artifact-feeds-rw)
              - ${{ if eq(variables.runCodeQL3000, 'true') }}:
                - task: CodeQL3000Init@0
                  displayName: CodeQL Initialize
                - script: "echo ##vso[build.addbuildtag]CodeQL3000"
                  displayName: 'Set CI CodeQL3000 tag'
                  condition: ne(variables.CODEQL_DIST,'')
              - script: eng\common\cibuild.cmd -configuration $(_BuildConfig) -prepareMachine $(_InternalBuildArgs)
                  $(_InternalRuntimeDownloadArgs) $(_AdditionalBuildArgs)
                name: Build
              - ${{ if eq(variables.runCodeQL3000, 'true') }}:
                - task: CodeQL3000Finalize@0
                  displayName: CodeQL Finalize
              - ${{ else }}:
                - task: PublishBuildArtifacts@1
                  displayName: Upload TestResults
                  condition: always()
                  continueOnError: true
                  inputs:
                    pathtoPublish: artifacts/TestResults/$(_BuildConfig)/
                    artifactName: $(Agent.Os)_$(Agent.JobName) TestResults
                    artifactType: Container
                    parallel: true
                - task: PublishBuildArtifacts@1
                  displayName: Upload artifacts
                  condition: and(succeeded(), eq(variables['system.pullrequest.isfork'], false))
                  inputs:
                    pathtoPublish: 'artifacts/packages/'
                    artifactName: packages
                    artifactType: Container
                    parallel: true

- ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), ne(variables.runCodeQL3000, 'true')) }}:
  - template: eng\common\templates\post-build\post-build.yml
    parameters:
      # Symbol validation isn't being very reliable lately. This should be enabled back
      # once this issue is resolved: https://github.com/dotnet/arcade/issues/2871
      enableSymbolValidation: false