Skip to content

Commit 6bdd63f

Browse files
rayluorayluo
committed
Azure DevOps pipeline resources
1 parent e3e0412 commit 6bdd63f

File tree

3 files changed

+348
-0
lines changed

3 files changed

+348
-0
lines changed

‎.ado/azure-pipelines.yml

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# Derived from https://dev.azure.com/mseng/Python/_git/dlltracer-python?path=/azure-pipelines.yml
2+
name: 0.$(Year:yyyy).$(DayOfYear).$(Rev:r)
3+
4+
parameters:
5+
- name: Signed
6+
displayName: "Real signed"
7+
type: boolean
8+
default: false
9+
- name: Publish
10+
displayName: "Publish"
11+
type: boolean
12+
default: false
13+
- name: Feed
14+
displayName: "Publish to feed"
15+
type: string
16+
default: "pypi"
17+
- name: SigningKeyCode
18+
displayName: "Signing key (when 'Signed' is selected)"
19+
type: string
20+
#default: "CP-230072" # Testing (never trusted)
21+
default: "CP-230012" # Real signed
22+
#default: "CP-231522" # OSS real signed
23+
#default: "CP-230856" # MSFT-internal signed
24+
- name: pythons
25+
displayName: "Python versions (amd64)"
26+
type: object
27+
default:
28+
- wheeltag: cp37-cp37-win_amd64
29+
version: 3.7
30+
arch: x64
31+
id: 37x64
32+
- wheeltag: cp38-cp38-win_amd64
33+
version: 3.8
34+
arch: x64
35+
id: 38x64
36+
- wheeltag: cp39-cp39-win_amd64
37+
version: 3.9
38+
arch: x64
39+
id: 39x64
40+
- wheeltag: cp310-cp310-win_amd64
41+
version: '3.10.*'
42+
arch: x64
43+
id: 310x64
44+
- wheeltag: cp311-cp311-win_amd64
45+
version: 3.11
46+
arch: x64
47+
id: 311x64
48+
- wheeltag: cp312-cp312-win_amd64
49+
version: 3.12
50+
arch: x64
51+
id: 312x64
52+
53+
54+
resources:
55+
repositories:
56+
- repository: dlltracer
57+
name: microsoft/dlltracer-python
58+
type: github
59+
ref: main
60+
endpoint: zooba
61+
- repository: 1esPipelines
62+
type: git
63+
name: 1ESPipelineTemplates/1ESPipelineTemplates
64+
ref: refs/tags/release
65+
66+
67+
trigger: none
68+
69+
70+
variables:
71+
REF: $[ resources.repositories['dlltracer'].ref ]
72+
PIP_DISABLE_PIP_VERSION_CHECK: true
73+
PIP_NO_COLOR: true
74+
PIP_NO_INPUT: true
75+
PIP_PROGRESS_BAR: off
76+
PIP_REQUIRE_VIRTUALENV: false
77+
PIP_VERBOSE: true
78+
PYMSBUILD_VERBOSE: true
79+
80+
81+
extends:
82+
template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
83+
parameters:
84+
pool:
85+
name: Python-1ES-Hosted-Pool
86+
image: windows-1espt
87+
os: windows
88+
89+
sdl:
90+
sourceRepositoriesToScan:
91+
include:
92+
- repository: dlltracer
93+
94+
customBuildTags:
95+
- ${{ if eq(parameters.Signed, 'true') }}:
96+
- signed
97+
- signed-${{ parameters.SigningKeyCode }}
98+
- ${{ each py in parameters.pythons }}:
99+
- ${{ py.wheeltag }}
100+
101+
stages:
102+
- stage: Stage
103+
jobs:
104+
- template: build.yml@self
105+
parameters:
106+
pythons: ${{ parameters.pythons }}
107+
Signed: ${{ parameters.Signed }}
108+
SigningKeyCode: ${{ parameters.SigningKeyCode }}
109+
110+
- ${{ if eq(parameters.Publish, 'true') }}:
111+
- template: publish.yml@self
112+
parameters:
113+
Feed: ${{ parameters.Feed }}
114+

‎.ado/build.yml

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
parameters:
2+
Artifact: dist
3+
pythons: []
4+
Signed: false
5+
SigningKeyCode: ''
6+
7+
jobs:
8+
- job: Build
9+
10+
variables:
11+
- ${{ if eq(parameters.Signed, 'true') }}:
12+
- group: ESRPClient
13+
- name: DistDir
14+
value: $(Build.ArtifactStagingDirectory)/dist
15+
- name: TempDir
16+
value: $(Build.BinariesDirectory)/tmp
17+
- name: LayoutDir
18+
value: $(Build.BinariesDirectory)/layout
19+
20+
steps:
21+
- checkout: dlltracer
22+
23+
- task: UsePythonVersion@0
24+
inputs:
25+
versionSpec: '>=3.10'
26+
architecture: 'x64'
27+
displayName: 'Use latest Python by default'
28+
29+
# Acquire a copy of each Python version, specifically for its Include and libs directories.
30+
- ${{ each py in parameters.pythons }}:
31+
- task: UsePythonVersion@0
32+
name: 'py${{ py.id }}'
33+
displayName: 'Download ${{ py.wheeltag }}'
34+
inputs:
35+
versionSpec: '${{ py.version }}'
36+
architecture: '${{ py.arch }}'
37+
addToPath: false
38+
39+
- task: PipAuthenticate@1
40+
inputs:
41+
artifactFeeds: Python
42+
displayName: 'Authenticate pip for internal feed'
43+
44+
- powershell: |
45+
python -m pip install pymsbuild Cython
46+
displayName: 'Install dependencies'
47+
48+
- powershell: |
49+
Write-Output "##vso[task.setvariable variable=GITHUB_REF]$(REF)"
50+
displayName: 'Update build reference'
51+
condition: and(succeeded(), startswith(variables['REF'], 'refs/tags/'))
52+
53+
##############################################################################
54+
# BUILD SDIST and EXTENSION MODULES
55+
##############################################################################
56+
57+
# sdist requires no signing/SBOM or special handling, so just build it
58+
- powershell: |
59+
python -m pymsbuild sdist -d $(DistDir)
60+
displayName: 'Build sdist'
61+
62+
# Build the extension modules for this Python version, but do not
63+
# pack the wheel yet (the '--layout' option achieves this)
64+
- ${{ each py in parameters.pythons }}:
65+
- powershell: |
66+
$env:PYTHON_INCLUDES = Join-Path $env:PREFIX "Include"
67+
$env:PYTHON_LIBS = Join-Path $env:PREFIX "libs"
68+
python -m pymsbuild wheel -d $(DistDir) --layout "$(LayoutDir)/${{ py.id }}"
69+
"" | Out-File -Encoding ascii "$(LayoutDir)/${{ py.id }}-extras.txt"
70+
displayName: 'Build ${{ py.wheeltag }}'
71+
env:
72+
PREFIX: $(py${{ py.id }}.pythonLocation)
73+
PYMSBUILD_WHEEL_TAG: ${{ py.wheeltag }}
74+
75+
##############################################################################
76+
# CODE SIGN EXTENSION MODULES
77+
##############################################################################
78+
79+
- ${{ if eq(parameters.Signed, 'true') }}:
80+
- task: 1ES.Signing@1
81+
displayName: 'Codesign modules'
82+
inputs:
83+
ClientID: $(ESRP.ClientID)
84+
TenantID: $(ESRP.TenantID)
85+
Directory: '$(LayoutDir)'
86+
Pattern: |
87+
**/*.pyd
88+
Operations: |
89+
[
90+
{
91+
"KeyCode" : "${{parameters.SigningKeyCode}}",
92+
"OperationCode" : "SigntoolSign",
93+
"Parameters" : {
94+
"OpusName" : "dlltracer-python $(REF)",
95+
"OpusInfo" : "https://github.com/microsoft/dlltracer-python/",
96+
"Append" : "/as",
97+
"FileDigest" : "/fd \"SHA256\"",
98+
"PageHash" : "/NPH",
99+
"TimeStamp" : "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
100+
},
101+
"ToolName" : "sign",
102+
"ToolVersion" : "1.0"
103+
},
104+
{
105+
"KeyCode" : "${{parameters.SigningKeyCode}}",
106+
"OperationCode" : "SigntoolVerify",
107+
"Parameters" : {},
108+
"ToolName" : "sign",
109+
"ToolVersion" : "1.0"
110+
}
111+
]
112+
113+
##############################################################################
114+
# GENERATE SBOM (only when signing)
115+
##############################################################################
116+
117+
- ${{ if eq(parameters.Signed, 'true') }}:
118+
- ${{ each py in parameters.pythons }}:
119+
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
120+
displayName: 'Generate SBOM for Python ${{ py.wheeltag }}'
121+
inputs:
122+
BuildDropPath: "$(LayoutDir)/${{ py.id }}"
123+
124+
# Move the SBOM manifest directory into the dist-info directory
125+
# and add its content to the list of files to include.
126+
- powershell: |
127+
$m = gi "*.dist-info" | select -first 1
128+
mv _manifest $m -Force
129+
$new_files = (gci "$m\_manifest" -File -Recurse).FullName
130+
$new_files | Out-File "$(LayoutDir)\${{ py.id }}-extras.txt" -Encoding ascii
131+
workingDirectory: '$(LayoutDir)/${{ py.id }}'
132+
displayName: 'Add SBOM into ${{ py.wheeltag }} wheel'
133+
134+
##############################################################################
135+
# PACK WHEELS
136+
##############################################################################
137+
138+
- ${{ each py in parameters.pythons }}:
139+
- powershell: >
140+
python -m pymsbuild
141+
pack
142+
--layout-dir "$(LayoutDir)/${{ py.id }}"
143+
--add "@$(LayoutDir)/${{ py.id }}-extras.txt"
144+
displayName: 'Pack ${{ py.wheeltag }} wheel'
145+
146+
##############################################################################
147+
# SMOKE TESTS
148+
##############################################################################
149+
150+
- powershell: |
151+
python -m pip wheel (gi "$(DistDir)\*.tar.gz") -w $(TempDir)
152+
displayName: 'Test that SDist will build'
153+
154+
- powershell: |
155+
python -m pip install dlltracer
156+
if ($?) { python -c "import dlltracer, dlltracer._native" }
157+
displayName: 'Check that built module will import'
158+
env:
159+
PIP_NO_DEPS: 1
160+
PIP_NO_INDEX: 1
161+
PIP_FIND_LINKS: $(TempDir)
162+
PIP_ONLY_BINARY: ':all:'
163+
164+
templateContext:
165+
outputs:
166+
- output: pipelineArtifact
167+
path: $(DistDir)
168+
artifact: ${{ parameters.Artifact }}
169+
displayName: 'Publish build to ${{ parameters.Artifact }}'
170+

‎.ado/publish.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
parameters:
2+
Artifact: dist
3+
Feed: pypi
4+
5+
jobs:
6+
- job: Publish
7+
dependsOn: Build
8+
displayName: 'Publish to ${{ parameters.Feed }}'
9+
10+
variables:
11+
DistDir: $(Pipeline.Workspace)\${{ parameters.Artifact }}
12+
13+
steps:
14+
- checkout: none
15+
16+
- download: current
17+
artifact: ${{ parameters.Artifact }}
18+
displayName: 'Download built distribution'
19+
20+
- ${{ if eq(parameters.Feed, 'pypi') }}:
21+
- task: EsrpRelease@4
22+
displayName: 'ESRP Release to PyPI'
23+
inputs:
24+
ConnectedServiceName: 'Python ESRP Release'
25+
Intent: PackageDistribution
26+
ContentType: PyPI
27+
FolderLocation: $(DistDir)
28+
Owners: '[email protected]'
29+
Approvers: '[email protected]'
30+
ServiceEndpointUrl: 'https://api.esrp.microsoft.com'
31+
MainPublisher: 'Python'
32+
DomainTenantId: '72f988bf-86f1-41af-91ab-2d7cd011db47'
33+
34+
- ${{ else }}:
35+
- task: PipAuthenticate@1
36+
inputs:
37+
artifactFeeds: Python
38+
displayName: 'Authenticate pip for internal feed'
39+
40+
- powershell: python -m pip install twine
41+
displayName: Install twine
42+
43+
- task: TwineAuthenticate@1
44+
inputs:
45+
artifactFeed: ${{ parameters.Feed }}
46+
displayName: 'Authenticate internal feed'
47+
48+
- powershell: >
49+
python -m twine
50+
upload
51+
--config-file "$(PYPIRC_PATH)"
52+
"$(DistDir)/*.tar.gz"
53+
"$(DistDir)/*.whl"
54+
displayName: 'Push to internal feed'
55+
env:
56+
TWINE_REPOSITORY: ${{ parameters.Feed }}
57+
TWINE_NON_INTERACTIVE: 1
58+
59+
- powershell: |
60+
$feed = "${{ parameters.Feed }}" -replace '[^a-zA-Z]', '_'
61+
echo "##vso[build.addbuildtag]published"
62+
echo "##vso[build.addbuildtag]published-$feed"
63+
displayName: 'Add publishedfeed tag'
64+

0 commit comments

Comments
 (0)