Skip to content

Commit 209f886

Browse files
authored
ci: refreshes ci configuration with recent updates from main (#3021)
* ci: refreshes ci configuration with recent updates from main * ci: adds missing global.json
1 parent 1f9aea9 commit 209f886

12 files changed

Lines changed: 295 additions & 27 deletions

.azure-pipelines/ci-build.yml

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,11 @@ extends:
6565
displayName: 'Use .NET 8'
6666
inputs:
6767
version: 8.x
68+
69+
- task: UseDotNet@2
70+
displayName: 'Use .NET 10'
71+
inputs:
72+
useGlobalJson: true
6873

6974
# Install the nuget tool.
7075
- task: NuGetToolInstaller@1
@@ -74,6 +79,20 @@ extends:
7479
checkLatest: true
7580

7681
# Build the Product project
82+
- task: NuGetAuthenticate@1
83+
displayName: 'Authenticate to Azure Artifacts'
84+
85+
- pwsh: |
86+
@"
87+
<?xml version="1.0" encoding="utf-8"?>
88+
<configuration>
89+
<packageSources>
90+
<clear />
91+
<add key="GraphDeveloperExperiences_Public" value="https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/nuget/v3/index.json" />
92+
</packageSources>
93+
</configuration>
94+
"@ | Set-Content -Path "$(Build.SourcesDirectory)/nuget.config" -Encoding UTF8
95+
displayName: 'Create nuget.config (central feed)'
7796
- task: DotNetCoreCLI@2
7897
displayName: 'build'
7998
inputs:
@@ -88,7 +107,7 @@ extends:
88107
projects: '$(Build.SourcesDirectory)\Microsoft.OpenApi.sln'
89108
arguments: '--configuration $(BuildConfiguration) --no-build'
90109

91-
- task: EsrpCodeSigning@5
110+
- task: EsrpCodeSigning@6
92111
displayName: 'ESRP CodeSigning binaries'
93112
inputs:
94113
ConnectedServiceName: 'Federated DevX ESRP Managed Identity Connection'
@@ -154,7 +173,7 @@ extends:
154173
- pwsh: dotnet pack $(Build.SourcesDirectory)/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj -o $(Build.ArtifactStagingDirectory) --configuration $(BuildConfiguration) --no-build --include-symbols --include-source /p:SymbolPackageFormat=snupkg
155174
displayName: 'pack Hidi'
156175

157-
- task: EsrpCodeSigning@5
176+
- task: EsrpCodeSigning@6
158177
displayName: 'ESRP CodeSigning Nuget Packages'
159178
inputs:
160179
ConnectedServiceName: 'Federated DevX ESRP Managed Identity Connection'
@@ -193,7 +212,7 @@ extends:
193212
displayName: publish Hidi as executable
194213
inputs:
195214
command: 'publish'
196-
arguments: -c Release --runtime win-x64 /p:PublishSingleFile=true /p:PackAsTool=false --self-contained --output $(Build.ArtifactStagingDirectory)/Microsoft.OpenApi.Hidi
215+
arguments: -c Release --runtime win-x64 -p:RestoreConfigFile=$(Build.SourcesDirectory)\nuget.config /p:PublishSingleFile=true /p:PackAsTool=false --self-contained --output $(Build.ArtifactStagingDirectory)/Microsoft.OpenApi.Hidi
197216
projects: 'src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj'
198217
publishWebProjects: False
199218
zipAfterPublish: false
@@ -472,4 +491,8 @@ extends:
472491
-t "$(REGISTRY)/$(IMAGE_NAME):${VERSION}" \
473492
"$(Pipeline.Workspace)"
474493
displayName: 'Build and Push Release Image'
475-
condition: contains(variables['Build.SourceBranch'], 'refs/tags/v')
494+
condition: contains(variables['Build.SourceBranch'], 'refs/tags/v')
495+
496+
# once the nuget has been released, fill this form to get the public documentation updated.
497+
# https://dev.azure.com/msft-skilling/Content/_workitems/create/User%20Story?templateId=39fb91e3-64a2-4c8a-83db-b2bdf3603dd3&ownerId=c4a28f90-17ae-4384-b514-7273392b082b
498+
# https://learn.microsoft.com/en-us/dotnet/api/microsoft.openapi

.config/1espt/PipelineAutobaseliningConfig.yml

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,17 @@ pipelines:
88
credscan:
99
lastModifiedDate: 2024-09-13
1010
eslint:
11-
lastModifiedDate: 2024-09-13
11+
lastModifiedDate: 2026-05-13
1212
psscriptanalyzer:
13-
lastModifiedDate: 2024-09-13
13+
lastModifiedDate: 2026-05-13
1414
armory:
15-
lastModifiedDate: 2024-09-13
15+
lastModifiedDate: 2026-05-13
16+
accessibilityinsights:
17+
lastModifiedDate: 2025-06-03
18+
binary:
19+
credscan:
20+
lastModifiedDate: 2025-01-28
21+
binskim:
22+
lastModifiedDate: 2026-05-13
23+
spotbugs:
24+
lastModifiedDate: 2026-05-13

.config/guardian/.gdnbaselines

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"properties": {
3+
"helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/baselines"
4+
},
5+
"version": "1.0.0",
6+
"baselines": {
7+
"default": {
8+
"name": "default",
9+
"createdDate": "2026-05-13 00:39:09Z",
10+
"lastUpdatedDate": "2026-05-13 00:40:41Z"
11+
}
12+
},
13+
"results": {
14+
"89411c6a070fd31f2836b38a16926ffbfb4882aff49c907cafe6c95dfba1104a": {
15+
"signature": "89411c6a070fd31f2836b38a16926ffbfb4882aff49c907cafe6c95dfba1104a",
16+
"alternativeSignatures": [
17+
"59104f1c3fec111fba3f6b5b6d2d37f3bc0d5267b425f82b8c3f852abc8b2b7a",
18+
"4dee2b2a1887d7a952ae5c61e48c9b6f543096940991cdcd0209c60561a537ce",
19+
"558e542a1dcc76100e4395b278f8b99f1dab960b2b3ae01a4c5cb84ac5cdc70f"
20+
],
21+
"target": "src/Microsoft.OpenApi/Writers/SpecialCharacterStringExtensions.cs",
22+
"line": 152,
23+
"uriBaseId": "file:///D:/a/_work/1/s/",
24+
"memberOf": [
25+
"default"
26+
],
27+
"tool": "roslynanalyzers",
28+
"ruleId": "CA1310",
29+
"createdDate": "2026-05-13 00:39:09Z",
30+
"expirationDate": "2026-10-30 00:42:11Z",
31+
"justification": "This error is baselined with an expiration date of 180 days from 2026-05-13 00:42:11Z"
32+
},
33+
"f6386b2f2aa1886a31fd1b57fa9e476ff5f24efbe144c82246f931e688010861": {
34+
"signature": "f6386b2f2aa1886a31fd1b57fa9e476ff5f24efbe144c82246f931e688010861",
35+
"alternativeSignatures": [
36+
"eb5bc1ea05b68f4106e441c8d441b39afaea833e5b2cbf6804d34cb869d9ed00",
37+
"bbe095dbf06a503925246de4a84cdc73afdafeddde3dab2440302c40560f811e",
38+
"aaac06605663a64f92dc03d6aacf9a424f2d861eba86f4ffa06cd231479734a8"
39+
],
40+
"target": "src/Microsoft.OpenApi/Reader/V2/OpenApiDocumentDeserializer.cs",
41+
"line": 179,
42+
"uriBaseId": "file:///D:/a/_work/1/s/",
43+
"memberOf": [
44+
"default"
45+
],
46+
"tool": "roslynanalyzers",
47+
"ruleId": "CA1310",
48+
"createdDate": "2026-05-13 00:39:09Z",
49+
"expirationDate": "2026-10-30 00:42:11Z",
50+
"justification": "This error is baselined with an expiration date of 180 days from 2026-05-13 00:42:11Z"
51+
}
52+
}
53+
}

.github/workflows/auto-merge-dependabot.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
steps:
2020
- name: Dependabot metadata
2121
id: metadata
22-
uses: dependabot/fetch-metadata@v2.4.0
22+
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
2323
with:
2424
github-token: "${{ secrets.GITHUB_TOKEN }}"
2525

.github/workflows/ci-cd.yml

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,29 @@ jobs:
99
ci:
1010
name: Continuous Integration
1111
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
code-quality: write
15+
pull-requests: read
1216
env:
1317
ARTIFACTS_FOLDER: ${{ github.workspace }}/Artifacts
1418
GITHUB_RUN_NUMBER: ${{ github.run_number }}
1519
steps:
16-
- name: Setup .NET
17-
uses: actions/setup-dotnet@v5
20+
- name: Setup .NET 8
21+
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
1822
with:
1923
dotnet-version: 8.x
2024

25+
- name: Setup .NET 10
26+
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
27+
with:
28+
dotnet-version: 10.x
29+
2130
- name: Checkout repository
2231
id: checkout_repo
23-
uses: actions/checkout@v5
32+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2433
with:
34+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
2535
token: ${{ secrets.GITHUB_TOKEN }}
2636
fetch-depth: 0
2737

.github/workflows/codeql-analysis.yml

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,21 @@ jobs:
2020
steps:
2121
- name: Checkout repository
2222
id: checkout_repo
23-
uses: actions/checkout@v5
23+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2424

25-
- name: Setup .NET
26-
uses: actions/setup-dotnet@v5
25+
- name: Setup .NET 8
26+
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
2727
with:
2828
dotnet-version: 8.0.x
2929

30+
- name: Setup .NET 10
31+
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
32+
with:
33+
dotnet-version: 10.0.x
34+
3035
- name: Initialize CodeQL
3136
id: init_codeql
32-
uses: github/codeql-action/init@v4
37+
uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
3338
with:
3439
queries: security-and-quality
3540

@@ -49,6 +54,6 @@ jobs:
4954
5055
- name: Perform CodeQL Analysis
5156
id: analyze_codeql
52-
uses: github/codeql-action/analyze@v4
57+
uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
5358

5459
# Built with ❤ by [Pipeline Foundation](https://pipeline.foundation)
Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: Promote Shipped APIs
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- support/v2
8+
workflow_dispatch:
9+
10+
jobs:
11+
promote-apis:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
16+
steps:
17+
- name: Generate GitHub App token
18+
id: app-token
19+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
20+
with:
21+
client-id: ${{ vars.RELEASE_PLEASE_TOKEN_PROVIDER_APP_ID }}
22+
private-key: ${{ secrets.RELEASE_PLEASE_TOKEN_PROVIDER_PEM }}
23+
24+
- name: Checkout code
25+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26+
with:
27+
fetch-depth: 0
28+
token: ${{ steps.app-token.outputs.token }}
29+
30+
- name: Configure git
31+
shell: pwsh
32+
env:
33+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
34+
run: |
35+
git config --global user.name "github-actions[bot]"
36+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
37+
git config --global url."https://$($env:GH_TOKEN)@github.com/".insteadOf "https://github.com/"
38+
39+
- name: Check for existing PR
40+
id: check_pr
41+
shell: pwsh
42+
env:
43+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
44+
run: |
45+
$branch = "${{ github.ref_name }}"
46+
$prs = gh pr list --state open --head "promote-shipped-apis-$branch" --json number --jq '.[0].number' 2>$null
47+
if ($prs) {
48+
echo "pr_number=$prs" >> $env:GITHUB_OUTPUT
49+
echo "pr_exists=true" >> $env:GITHUB_OUTPUT
50+
Write-Host "Found existing PR: $prs"
51+
} else {
52+
echo "pr_exists=false" >> $env:GITHUB_OUTPUT
53+
Write-Host "No existing PR found"
54+
}
55+
56+
- name: Checkout existing PR branch
57+
if: steps.check_pr.outputs.pr_exists == 'true'
58+
shell: pwsh
59+
run: |
60+
$branch = "${{ github.ref_name }}"
61+
$prBranch = "promote-shipped-apis-$branch"
62+
63+
git fetch origin
64+
git checkout $prBranch
65+
66+
- name: Merge trigger branch into PR branch
67+
if: steps.check_pr.outputs.pr_exists == 'true'
68+
shell: pwsh
69+
run: |
70+
$branch = "${{ github.ref_name }}"
71+
git merge origin/$branch -m "Merge $branch into promote branch"
72+
73+
- name: Run promote unshipped script
74+
shell: pwsh
75+
run: |
76+
& .\scripts\promoteUnshipped.ps1
77+
78+
- name: Check for changes
79+
id: check_changes
80+
shell: pwsh
81+
run: |
82+
$changes = git diff --name-only -- "*Shipped.txt"
83+
if ($changes) {
84+
echo "has_changes=true" >> $env:GITHUB_OUTPUT
85+
Write-Host "Changed files: $changes"
86+
} else {
87+
echo "has_changes=false" >> $env:GITHUB_OUTPUT
88+
Write-Host "No changes detected"
89+
}
90+
91+
- name: Commit and push changes
92+
if: steps.check_changes.outputs.has_changes == 'true'
93+
shell: pwsh
94+
run: |
95+
git add *hipped.txt
96+
git commit -m "chore: promote shipped APIs"
97+
98+
$branch = "${{ github.ref_name }}"
99+
$prBranch = "promote-shipped-apis-$branch"
100+
git push -u origin HEAD:$prBranch
101+
102+
- name: Create new PR
103+
if: steps.check_pr.outputs.pr_exists == 'false' && steps.check_changes.outputs.has_changes == 'true'
104+
shell: pwsh
105+
env:
106+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
107+
run: |
108+
$branch = "${{ github.ref_name }}"
109+
$prBranch = "promote-shipped-apis-$branch"
110+
$title = "automatic promotion of shipped APIs for $branch"
111+
112+
gh pr create --title "$title" --base "$branch" --head "$prBranch" --body "Automatically promotes unshipped APIs to shipped after running the promotion script."
113+

.github/workflows/release-please-gha.yml

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,53 @@ permissions:
2222
contents: read
2323

2424
jobs:
25+
check-secret:
26+
runs-on: ubuntu-latest
27+
outputs:
28+
has-token: ${{ steps.check.outputs.has-token }}
29+
steps:
30+
- id: check
31+
run: echo "has-token=${{ secrets.RELEASE_PLEASE_TOKEN_PROVIDER_PEM != '' }}" >> $GITHUB_OUTPUT
2532
release:
33+
needs: check-secret
34+
if: needs.check-secret.outputs.has-token == 'true'
2635
runs-on: ubuntu-latest
2736
steps:
28-
- uses: actions/checkout@v5
37+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
38+
39+
- name: Validate PublicAPI.Unshipped.txt files are empty
40+
shell: pwsh
41+
run: |
42+
$unshippedFiles = Get-ChildItem 'src/ ' -Recurse -Filter *.Unshipped.txt | Select -ExpandProperty FullName
43+
44+
$hasUnshippedAPIs = $false
45+
46+
foreach ($file in $unshippedFiles) {
47+
$content = Get-Content -Path $file -Raw
48+
# Remove the #nullable enable line and any whitespace
49+
$trimmedContent = $content -replace '^\s*#nullable enable\s*$', '' -replace '^\s+', ''
50+
51+
if ($trimmedContent -ne '') {
52+
Write-Error "❌ $file contains unshipped APIs. Please promote them to PublicAPI.Shipped.txt before releasing.`nContent:`n$content"
53+
$hasUnshippedAPIs = $true
54+
}
55+
}
56+
57+
if ($hasUnshippedAPIs) {
58+
exit 1
59+
}
60+
61+
Write-Output "✅ All PublicAPI.Unshipped.txt files are clean"
2962
3063
- name: Generate GitHub App token
3164
id: app-token
32-
uses: actions/create-github-app-token@v2
65+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
3366
with:
34-
app-id: ${{ vars.RELEASE_PLEASE_TOKEN_PROVIDER_APP_ID }}
67+
client-id: ${{ vars.RELEASE_PLEASE_TOKEN_PROVIDER_APP_ID }}
3568
private-key: ${{ secrets.RELEASE_PLEASE_TOKEN_PROVIDER_PEM }}
3669

3770
- name: Release Please
38-
uses: googleapis/release-please-action@v4
71+
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
3972
with:
4073
token: ${{ steps.app-token.outputs.token }}
4174
config-file: release-please-config.json

0 commit comments

Comments
 (0)