Skip to content

Commit dce5085

Browse files
pjcollinspjcollins
authored
[ci] Build and sign in a DevDiv pipeline (#7)
The production build has been moved in to Azure Pipelines for security and compliance reasons. The build is now located at: https://devdiv.visualstudio.com/DevDiv/_build?definitionId=17684&_a=summary Authenticode signing has also been enabled for the required macOS and Windows binaries in this pipeline. We can continue to use GitHub actions for PR validation.
1 parent 5e27ec7 commit dce5085

File tree

6 files changed

+310
-97
lines changed

6 files changed

+310
-97
lines changed

‎.gitignore‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,15 @@
4141
.ccls-cache
4242
.projectile
4343
compile_commands.json
44+
45+
# User-specific files
46+
*.rsuser
47+
*.suo
48+
*.user
49+
*.userosscache
50+
*.sln.docstates
51+
.DS_Store
52+
53+
# Build results
54+
[Bb]in/
55+
[Oo]bj/

‎1cs-pipeline.yml‎

Lines changed: 0 additions & 96 deletions
This file was deleted.

‎build-tools/automation/azure-pipelines.yml‎

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
trigger:
2+
- main
3+
- release/*
4+
- dev/*
5+
6+
pr:
7+
- none
8+
9+
resources:
10+
repositories:
11+
- repository: yaml-templates
12+
type: github
13+
name: xamarin/yaml-templates
14+
ref: refs/heads/main
15+
endpoint: xamarin
16+
- repository: xa-yaml
17+
type: github
18+
name: xamarin/xamarin-android
19+
ref: refs/heads/main
20+
endpoint: xamarin
21+
22+
variables:
23+
- name: TeamName
24+
value: XamarinAndroid
25+
- name: BUILD_DIR
26+
value: xa-build
27+
- name: Codeql.Enabled
28+
value: true
29+
30+
stages:
31+
- stage: build
32+
displayName: Build Stage
33+
jobs:
34+
- job: build_linux
35+
displayName: Build Linux
36+
timeoutInMinutes: 240
37+
pool:
38+
name: android-devdiv-ubuntu-vmss
39+
steps:
40+
- checkout: self
41+
submodules: recursive
42+
43+
- script: >-
44+
sudo apt-get update;
45+
sudo apt-get -f -u install cmake ninja-build chrpath texinfo sharutils libffi-dev
46+
lsb-release patchutils diffstat xz-utils python3-dev libedit-dev libncurses5-dev swig
47+
python3-six python3-sphinx binutils-dev libxml2-dev libjsoncpp-dev pkg-config lcov
48+
procps help2man zlib1g-dev g++-multilib libjs-mathjax python3-recommonmark libpfm4-dev
49+
python3-setuptools libz3-dev ccache
50+
displayName: Install LLVM build dependencies
51+
52+
- script: sudo apt-get -f -u install mingw-w64 libz-mingw-w64-dev
53+
displayName: Install Xamarin.Android Utilities build dependencies
54+
55+
- script: ./build-llvm.sh
56+
env:
57+
CC: gcc-10
58+
CXX: g++-10
59+
displayName: Build LLVM
60+
61+
- script: ./build-xa-utils.sh
62+
env:
63+
CC: gcc-10
64+
CXX: g++-10
65+
displayName: Build utilities
66+
67+
- script: |
68+
rsync -avm --include 'config.*' --include '*.log' --include '*.txt' --include='*/' --exclude='*' $(BUILD_DIR) $(Build.StagingDirectory)
69+
displayName: Copy logs
70+
condition: always()
71+
72+
- task: PublishPipelineArtifact@1
73+
displayName: Upload logs
74+
inputs:
75+
artifactName: build-logs-linux
76+
targetPath: $(Build.StagingDirectory)
77+
condition: always()
78+
79+
- task: PublishPipelineArtifact@1
80+
displayName: Upload artifacts
81+
inputs:
82+
artifactName: artifacts-linux-unsigned
83+
targetPath: artifacts
84+
85+
86+
- job: build_macos
87+
displayName: Build macOS
88+
timeoutInMinutes: 240
89+
pool:
90+
name: Azure Pipelines
91+
vmImage: internal-macos12
92+
steps:
93+
- checkout: self
94+
submodules: recursive
95+
96+
- script: |
97+
brew update
98+
brew install cmake ninja ccache
99+
displayName: Install LLVM build dependencies
100+
101+
- script: brew install make xz
102+
displayName: Install Xamarin.Android Utilities build dependencies
103+
104+
- script: bash ./build-llvm.sh
105+
displayName: build LLVM
106+
107+
- script: bash ./build-xa-utils.sh
108+
displayName: Build utilities
109+
110+
- script: |
111+
rsync -avm --include 'config.*' --include '*.log' --include '*.txt' --include='*/' --exclude='*' $(BUILD_DIR) $(Build.StagingDirectory)
112+
displayName: Copy logs
113+
condition: always()
114+
115+
- task: PublishPipelineArtifact@1
116+
displayName: Upload logs
117+
inputs:
118+
artifactName: build-logs-macos
119+
targetPath: $(Build.StagingDirectory)
120+
condition: always()
121+
122+
- task: PublishPipelineArtifact@1
123+
displayName: Upload artifacts
124+
inputs:
125+
artifactName: artifacts-macos-unsigned
126+
targetPath: artifacts
127+
128+
129+
- job: build_windows
130+
displayName: Build Windows
131+
timeoutInMinutes: 300
132+
pool:
133+
name: AzurePipelines-EO
134+
demands:
135+
- ImageOverride -equals AzurePipelinesWindows2022compliant
136+
steps:
137+
- checkout: self
138+
submodules: recursive
139+
140+
- script: ./build-llvm-azure.cmd
141+
displayName: Build Windows LLVM
142+
143+
- task: PublishPipelineArtifact@1
144+
displayName: Upload artifacts
145+
inputs:
146+
artifactName: artifacts-windows-unsigned
147+
targetPath: artifacts
148+
149+
150+
- stage: package
151+
displayName: Package Stage
152+
dependsOn: build
153+
variables:
154+
- name: MicroBuildSignType
155+
value: Real
156+
jobs:
157+
- job: pack_sign
158+
displayName: Sign and Zip
159+
timeoutInMinutes: 240
160+
pool:
161+
name: Azure Pipelines
162+
vmImage: internal-macos12
163+
steps:
164+
- checkout: self
165+
submodules: recursive
166+
167+
- template: build-tools/automation/yaml-templates/install-microbuild-tooling.yaml@xa-yaml
168+
parameters:
169+
condition: and(succeeded(), eq(variables['MicroBuildSignType'], 'Real'))
170+
171+
- task: DownloadPipelineArtifact@2
172+
inputs:
173+
artifactName: artifacts-linux-unsigned
174+
downloadPath: artifacts
175+
176+
- task: DownloadPipelineArtifact@2
177+
inputs:
178+
artifactName: artifacts-macos-unsigned
179+
downloadPath: artifacts
180+
181+
- task: DownloadPipelineArtifact@2
182+
inputs:
183+
artifactName: artifacts-windows-unsigned
184+
downloadPath: artifacts
185+
186+
- task: CmdLine@2
187+
inputs:
188+
script: ./package.sh
189+
workingDirectory: $(Build.SourcesDirectory)
190+
displayName: Package artifacts
191+
192+
- task: DotNetCoreCLI@2
193+
displayName: Sign and zip files
194+
inputs:
195+
projects: build-tools/automation/sign.proj
196+
arguments: >-
197+
-p:SignType=$(MicroBuildSignType)
198+
-bl:$(Build.StagingDirectory)/sign-macos.binlog
199+
200+
- task: PublishPipelineArtifact@1
201+
displayName: Upload artifact
202+
inputs:
203+
artifactName: sign-macos-binlog-$(System.JobAttempt)
204+
targetPath: $(Build.StagingDirectory)/sign-macos.binlog
205+
condition: always()
206+
207+
- template: build-tools/automation/yaml-templates/remove-microbuild-tooling.yaml@xa-yaml
208+
parameters:
209+
condition: and(succeededOrFailed(), eq(variables['MicroBuildSignType'], 'Real'))
210+
211+
- script: >
212+
mkdir -p $(Build.StagingDirectory)/toolchain &&
213+
ln artifacts/android-llvm-toolchain*.zip $(Build.StagingDirectory)/toolchain
214+
displayName: copy toolchain artifact
215+
216+
- task: PublishPipelineArtifact@1
217+
displayName: Upload artifact
218+
inputs:
219+
artifactName: android-llvm-toolchain-signed
220+
targetPath: $(Build.StagingDirectory)/toolchain
221+
222+
223+
- job: sign_verify
224+
displayName: Verify Signing
225+
dependsOn: pack_sign
226+
timeoutInMinutes: 240
227+
pool:
228+
name: VSEngSS-MicroBuild2022-1ES
229+
steps:
230+
- checkout: self
231+
submodules: recursive
232+
233+
- task: DownloadPipelineArtifact@2
234+
inputs:
235+
artifactName: android-llvm-toolchain-signed
236+
downloadPath: $(Build.SourcesDirectory)\artifacts
237+
238+
- task: MicroBuildCodesignVerify@3
239+
displayName: verify signed content
240+
inputs:
241+
TargetFolders: $(Build.SourcesDirectory)\artifacts
242+
ExcludeSNVerify: true
243+
condition: and(succeededOrFailed(), eq(variables['MicroBuildSignType'], 'Real'))

0 commit comments

Comments
 (0)