Use MicroBuildSigningPlugin from arcade templates and split .vsts-dotnet.yml

.vsts-dotnet.yml

@@ -1,8 +1,6 @@
 trigger:
 - main
 - vs*
-- exp/*
-- perf/*
 
 # If defined here, these values are not overrideable
 # Once they exist, we should define these as "runtime parameters"
@@ -54,9 +52,6 @@ variables:
     value: true # Enable loc for vs17.14
   - name: Codeql.Enabled
     value: true
-  # ensures we don't build and push experimental versions to official feeds as release versions
-  - name: IsExperimental
-    value: ${{ startsWith(variables['Build.SourceBranch'], 'refs/heads/exp/') }}
   - group: DotNet-MSBuild-SDLValidation-Params
   - group: AzureDevOps-Artifact-Feeds-Pats
   - name: cfsNugetWarnLevel
@@ -65,6 +60,7 @@ variables:
     value: none
   - name: NugetSecurityAnalysisWarningLevel
     value: none
+
 resources:
   repositories:
   - repository: 1ESPipelineTemplates
@@ -98,256 +94,20 @@ extends:
     stages:
     - stage: build
       displayName: Build
-
       jobs:
-      # The localization setup for release/ branches. Note difference in LclPackageId. main branch is handled separately below.
-      # Used for vs17.2, vs17.4, vs17.6 etc. branches only.
-      # When the branch is setup for localization (the localization ticket needs to be created - https://aka.ms/ceChangeLocConfig, requesting change from one release branch to another),
-      #  set 'EnableReleaseOneLocBuild' to true.
-      - ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/vs') }}:
-        - template: /eng/common/templates-official/job/onelocbuild.yml@self
-          parameters:
-            MirrorRepo: 'msbuild'
-            LclSource: lclFilesfromPackage
-            LclPackageId: 'LCL-JUNO-PROD-MSBUILDREL'
-            MirrorBranch: ${{ replace(variables['Build.SourceBranch'], 'refs/heads/', '') }}
-            JobNameSuffix: '_release'
-            condition: ${{ variables.EnableReleaseOneLocBuild }}
-      # The localization setup for main branch. Note difference in package ID. Should not be used with release/ branches.
-      - ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/main') }}:
-        - template: /eng/common/templates-official/job/onelocbuild.yml@self
-          parameters:
-            MirrorRepo: 'msbuild'
-            LclSource: lclFilesfromPackage
-            LclPackageId: 'LCL-JUNO-PROD-MSBUILD'
-            MirrorBranch: 'main'
-            JobNameSuffix: '_main'
-            condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')
-
-      - job: Windows_NT
-        pool:
-          name: VSEngSS-MicroBuild2022-1ES
-          demands:
-          - agent.os -equals Windows_NT
-
-        timeoutInMinutes: 180
-
-        variables:
-        - group: Publish-Build-Assets
-        - name: TeamName
-          value: MSBuild
-        - name: VisualStudio.MajorVersion
-          value: 18
-        - name: VisualStudio.ChannelName
-          value: 'int.main'
-        - name: VisualStudio.DropName
-          value: Products/$(System.TeamProject)/$(Build.Repository.Name)/$(Build.SourceBranchName)/$(Build.BuildNumber)
-
-        steps:
-        - task: NuGetToolInstaller@1
-          displayName: 'Install NuGet.exe'
-        - pwsh: Get-MpComputerStatus
-
-        - pwsh: Set-MpPreference -DisableRealtimeMonitoring $true
-
-        - task: PowerShell@2
-          displayName: Setup Private Feeds Credentials
-          inputs:
-            filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
-            arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token
-          env:
-            Token: $(dn-bot-dnceng-artifact-feeds-rw)
-
-        - task: NuGetCommand@2
-          displayName: Restore internal tools
-          inputs:
-            command: restore
-            feedsToUse: config
-            restoreSolution: 'eng\common\internal\Tools.csproj'
-            nugetConfigPath: 'eng\common\internal\NuGet.config'
-            restoreDirectory: '$(Build.SourcesDirectory)\.packages'
-
-        - task: ms-vseng.MicroBuildTasks.30666190-6959-11e5-9f96-f56098202fef.MicroBuildSigningPlugin@1
-          inputs:
-            signType: $(SignType)
-            zipSources: false
-          condition: and(succeeded(), in(variables['SignType'], 'test', 'real'))
-
-        - task: MicroBuildOptProfPlugin@6
-          inputs:
-            ProfilingInputsDropName: '$(VisualStudio.DropName)'
-            ShouldSkipOptimize: true
-            AccessToken: '$(System.AccessToken)'
-            feedSource: 'https://devdiv.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
-          displayName: 'Install OptProf Plugin'
-          condition: and(succeeded(), ${{ parameters.EnableOptProf }})
-
-        # Required by MicroBuildBuildVSBootstrapper
-        - task: MicroBuildSwixPlugin@4
-          inputs:
-            dropName: $(VisualStudio.DropName)
-
-        - script: eng/CIBuild.cmd
-                    -configuration $(BuildConfiguration)
-                    -officialBuildId $(Build.BuildNumber)
-                    -officialSkipApplyOptimizationData $(SkipApplyOptimizationData)
-                    /p:RepositoryName=$(Build.Repository.Name)
-                    /p:VisualStudioIbcSourceBranchName=$(SourceBranch)
-                    /p:VisualStudioDropAccessToken=$(System.AccessToken)
-                    /p:VisualStudioDropName=$(VisualStudio.DropName)
-                    /p:DotNetSignType=$(SignType)
-                    /p:TeamName=MSBuild
-                    /p:DotNetPublishUsingPipelines=true
-                    /p:VisualStudioIbcDrop=$(OptProfDrop)
-                    /p:GenerateSbom=true
-                    /p:SuppressFinalPackageVersion=$(IsExperimental)
-          displayName: Build
-          condition: succeeded()
-
-        # Required by Microsoft policy
-        - template: eng\common\templates-official\steps\generate-sbom.yml@self
-
-        # Publish OptProf configuration files
-        - task: 1ES.PublishArtifactsDrop@1
-          inputs:
-            dropServiceURI: 'https://devdiv.artifacts.visualstudio.com'
-            buildNumber: 'ProfilingInputs/DevDiv/$(Build.Repository.Name)/$(Build.SourceBranchName)/$(Build.BuildNumber)'
-            sourcePath: '$(Build.SourcesDirectory)\artifacts\OptProf\$(BuildConfiguration)\Data'
-            toLowerCase: false
-            usePat: true
-          displayName: 'OptProf - Publish to Artifact Services - ProfilingInputs'
-          condition: and(succeeded(), ${{ parameters.EnableOptProf }})
-
-        # Build VS bootstrapper
-        # Generates $(Build.StagingDirectory)\MicroBuild\Output\BootstrapperInfo.json
-        - task: MicroBuildBuildVSBootstrapper@3
-          inputs:
-            vsMajorVersion: $(VisualStudio.MajorVersion)
-            channelName: $(VisualStudio.ChannelName)
-            manifests: $(VisualStudio.SetupManifestList)
-            outputFolder: '$(Build.SourcesDirectory)\artifacts\VSSetup\$(BuildConfiguration)\Insertion'
-          displayName: 'OptProf - Build VS bootstrapper'
-          condition: and(succeeded(), ${{ parameters.EnableOptProf }})
-
-        # Publish run settings
-        - task: PowerShell@2
-          inputs:
-            filePath: eng\common\sdk-task.ps1
-            arguments: -configuration $(BuildConfiguration)
-                      -task VisualStudio.BuildIbcTrainingSettings
-                      /p:VisualStudioDropName=$(VisualStudio.DropName)
-                      /p:BootstrapperInfoPath=$(Build.StagingDirectory)\MicroBuild\Output\BootstrapperInfo.json
-                      /p:VisualStudioIbcTrainingSettingsPath=$(Build.SourcesDirectory)\eng\config\OptProf.runsettings
-          displayName: 'OptProf - Build IBC training settings'
-          condition: and(succeeded(), ${{ parameters.EnableOptProf }})
-
-        # Publish bootstrapper info
-        - task: 1ES.PublishBuildArtifacts@1
-          inputs:
-            PathtoPublish: $(Build.StagingDirectory)\MicroBuild\Output
-            ArtifactName: MicroBuildOutputs
-            ArtifactType: Container
-          displayName: 'OptProf - Publish Artifact: MicroBuildOutputs'
-          condition: and(succeeded(), ${{ parameters.EnableOptProf }})
-
-        - task: 1ES.PublishBuildArtifacts@1
-          displayName: 'Publish Artifact: logs'
-          inputs:
-            PathtoPublish: 'artifacts\log\$(BuildConfiguration)'
-            ArtifactName: logs
-          condition: succeededOrFailed()
-
-        # Publishes setup VSIXes to a drop.
-        # Note: The insertion tool looks for the display name of this task in the logs.
-        - task: 1ES.MicroBuildVstsDrop@1
-          displayName: Upload VSTS Drop
-          inputs:
-            dropName: $(VisualStudio.DropName)
-            dropFolder: 'artifacts\VSSetup\$(BuildConfiguration)\Insertion'
-            dropRetentionDays: '30' # extended by insertion + VS release
-            accessToken: '$(System.AccessToken)'
-            dropServiceUri: 'https://devdiv.artifacts.visualstudio.com'
-            vsDropServiceUri: 'https://vsdrop.corp.microsoft.com/file/v1'
-          condition: succeeded()
-
-        # Publish an artifact that the RoslynInsertionTool is able to find by its name.
-        - task: 1ES.PublishBuildArtifacts@1
-          displayName: 'Publish Artifact: VSSetup'
-          inputs:
-            PathtoPublish: 'artifacts\VSSetup\$(BuildConfiguration)'
-            ArtifactName: VSSetup
-          condition: succeeded()
-
-        # Archive NuGet packages to DevOps.
-        # Publish our NuPkgs as an artifact. The name of this artifact must be PackageArtifacts as the
-        # arcade templates depend on the name.
-        - task: 1ES.PublishBuildArtifacts@1
-          displayName: 'Publish Artifact: packages'
-          inputs:
-            PathtoPublish: 'artifacts\packages\$(BuildConfiguration)'
-            ArtifactName: PackageArtifacts
-          condition: succeeded()
-
-        # Publish "IntelliSense" XSD files to their own artifact
-        # so it can be consumed by the insertion-to-VS job
-        - task: 1ES.PublishPipelineArtifact@1
-          displayName: 'Publish Artifact: xsd'
-          inputs:
-            path: 'artifacts\xsd'
-            artifactName: xsd
-          condition: succeeded()
-
-        # Publish Asset Manifests for Build Asset Registry job
-        - task: 1ES.PublishBuildArtifacts@1
-          displayName: Publish Asset Manifests
-          inputs:
-            PathtoPublish: '$(Build.SourcesDirectory)/artifacts/log/$(BuildConfiguration)/AssetManifest'
-            ArtifactName: AssetManifests
-          condition: succeeded()
-
-        # Tag the build at the very end when we know it's been successful.
-        - task: colinsalmcorner.colinsalmcorner-buildtasks.tag-build-task.tagBuildOrRelease@0
-          displayName: Tag build as ready for optimization training
-          inputs:
-            tags: 'ready-for-training'
-          condition: and(succeeded(), ${{ parameters.EnableOptProf }})
-
-        - task: ms-vseng.MicroBuildTasks.521a94ea-9e68-468a-8167-6dcf361ea776.MicroBuildCleanup@1
-          displayName: Execute cleanup tasks
-          condition: succeededOrFailed()
-
-        - template: /eng/common/templates-official/steps/component-governance.yml@self
-          parameters:
-            ${{ if or(startsWith(variables['Build.SourceBranch'], 'refs/heads/vs'), eq(variables['Build.SourceBranch'], 'refs/heads/main')) }}:
-              disableComponentGovernance: false
-            ${{ else }}:
-              disableComponentGovernance: true
-
-      - template: /eng/common/templates-official/jobs/source-build.yml@self
-        parameters:
-          platforms:
-            - name: Managed
-              pool:
-                name: AzurePipelines-EO
-                image: 1ESPT-Ubuntu22.04
-                os: linux
-
-      - template: /eng/common/templates-official/job/publish-build-assets.yml@self
+      - template: eng/.vsts-dotnet-build-jobs.yml@self
         parameters:
-          enablePublishBuildArtifacts: true
-          publishUsingPipelines: true
-          dependsOn:
-            - Windows_NT
-            - Source_Build_Managed
-          pool:
-            name: $(DncEngInternalBuildPool)
-            image: $(WindowsImage)
-            os: windows
+          enableMicrobuild: true
+          isExperimental: false
+          enableLocalization: true
+          enableComponentGovernance: true
+          codeSignValidationEnabled: true
+          codeSignValidationBreak: true
 
     - template: eng\common\templates-official\post-build\post-build.yml@self
       parameters:
         publishingInfraVersion: 3
         enableSymbolValidation: true
         enableSourceLinkValidation: false
         enableNugetValidation: false
-        requireDefaultChannels: ${{ variables.requireDefaultChannels }}
+        requireDefaultChannels: ${{ variables.requireDefaultChannels }}

azure-pipelines/.vsts-dotnet-exp-perf.yml

@@ -0,0 +1,99 @@
+trigger:
+- exp/*
+- perf/*
+
+# If defined here, these values are not overrideable
+# Once they exist, we should define these as "runtime parameters"
+# https://github.com/Microsoft/azure-pipelines-yaml/pull/129
+# variables:
+#   SignType: test
+#   SkipApplyOptimizationData: false
+
+parameters:
+- name: OptProfDropName
+  displayName: Optional OptProfDrop Override
+  type: string
+  default: 'default'
+- name: requireDefaultChannelsEnabled
+  displayName: Require Default Channels
+  type: boolean
+  default: true
+
+variables:
+  # if OptProfDrop is not set, string '$(OptProfDrop)' will be passed to the build script.
+  - name: OptProfDrop
+    value: ''
+  - name: requireDefaultChannels
+    value: false
+  - name: SourceBranch
+    value: $(IbcSourceBranchName)
+  # Use main as our optprof collection branch by default.
+  - ${{ if not(startsWith(variables['Build.SourceBranch'], 'refs/heads/vs')) }}:
+    - name: SourceBranch
+      value: main
+  # if OptProfDropName is set as a parameter, set OptProfDrop to the parameter and unset SourceBranch
+  - ${{ if ne(parameters.OptProfDropName, 'default') }}:
+    - name: OptProfDrop
+      value: ${{parameters.OptProfDropName}}
+    - name: SourceBranch
+      value: ''
+  - name: Codeql.Enabled
+    value: false
+  - group: DotNet-MSBuild-SDLValidation-Params
+  - group: AzureDevOps-Artifact-Feeds-Pats
+  - name: cfsNugetWarnLevel
+    value: warn
+  - name: nugetMultiFeedWarnLevel
+    value: none
+  - name: NugetSecurityAnalysisWarningLevel
+    value: none
+
+resources:
+  repositories:
+  - repository: 1ESPipelineTemplates
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+  parameters:
+    featureFlags:
+      autoBaseline: true
+    pool:
+      name: VSEngSS-MicroBuild2022-1ES
+      os: windows
+    sdl:
+      policheck:
+        enabled: true
+        exclusionsFile: $(Build.SourcesDirectory)\eng\policheck_exclusions.xml
+      tsa:
+        enabled: true
+      # We generate SBOM ourselves, so don't need steps injected by 1ES.
+      sbom:
+        enabled: false
+      codeSignValidation:
+        enabled: false
+        additionalTargetsGlobPattern: -|**\bootstrapper\**\vs_enterprise.exe
+      credscan:
+        suppressionsFile: $(Build.SourcesDirectory)/eng/CredScanSuppressions.json
+
+    stages:
+    - stage: build
+      displayName: Build
+      jobs:
+      - template: eng/.vsts-dotnet-build-jobs.yml@self
+        parameters:
+          enableMicrobuild: true
+          isExperimental: true
+          enableLocalization: false
+          enableComponentGovernance: false
+          codeSignValidationEnabled: true
+          codeSignValidationBreak: true
+
+    - template: /eng/common/templates-official/post-build/post-build.yml@self
+      parameters:
+        publishingInfraVersion: 3
+        enableSymbolValidation: true
+        enableSourceLinkValidation: false
+        enableNugetValidation: false
+        requireDefaultChannels: ${{ variables.requireDefaultChannels }}