PSDesiredStateConfiguration-OneBranch.yml

trigger:
- main

schedules:
- cron: '18 11 * * 5'
  displayName: Weekly CodeQL
  branches:
    include:
    - main
  always: true

parameters:
- name: debug
  displayName: Enable debug output
  type: boolean
  default: false
- name: OfficialBuild
  displayName: Use Official OneBranch template
  type: boolean
  default: true
- name: Release
  displayName: Generate a release
  type: boolean
  default: false

variables:
  system.debug: ${{ parameters.debug }}
  BuildConfiguration: Release
  WindowsContainerImage: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
  OneBranchTemplate: ${{ iif(parameters.OfficialBuild, 'v2/OneBranch.Official.CrossPlat.yml@templates', 'v2/OneBranch.NonOfficial.CrossPlat.yml@templates') }}

resources:
  repositories:
    - repository: templates
      type: git
      name: OneBranch.Pipelines/GovernedTemplates
      ref: refs/heads/main

extends:
  # https://aka.ms/obpipelines/templates
  template: ${{ variables.OneBranchTemplate }}
  parameters:
    globalSdl: # https://aka.ms/obpipelines/sdl
      asyncSdl:
        enabled: true
        forStages: [build]
    featureFlags:
      EnableCDPxPAT: false
      WindowsHostVersion:
        Version: 2022
        Network: KS3
    release:
      category: NonAzure
    stages:
    - stage: build
      jobs:
      - job: main
        displayName: Build package
        pool:
          type: windows
        variables:
          ob_outputDirectory: $(Build.SourcesDirectory)/out
        steps:
          - pwsh: |
              $manifest = Import-PowerShellDataFile ./src/PSDesiredStateConfiguration/PSDesiredStateConfiguration.psd1
              $version = $manifest.ModuleVersion
              Write-Output "##vso[task.setvariable variable=version;isOutput=true]$version"
            name: package
            displayName: Get version from module manifest
          - task: onebranch.pipeline.version@1
            displayName: Set OneBranch version
            inputs:
              system: Custom
              customVersion: $(package.version)
          - pwsh: ./tools/installPSResources.ps1 -PSRepository CFS
            displayName: Install PSResources
          - pwsh: ./build.ps1 -Clean -Build -Test
            displayName: Build
          - task: onebranch.pipeline.signing@1
            displayName: Sign 1st-party files
            inputs:
              command: sign
              signing_profile: external_distribution
              search_root: $(Build.SourcesDirectory)/out
              files_to_sign: |
                **/*.psd1;
                **/*.psm1;
          - pwsh: ./build.ps1 -Publish
            displayName: Package module
          - task: onebranch.pipeline.signing@1
            displayName: Sign NuGet package
            inputs:
              command: sign
              signing_profile: external_distribution
              search_root: $(Build.SourcesDirectory)/out
              files_to_sign: |
                *.nupkg
    - stage: release
      dependsOn: build
      condition: and(succeeded(), ${{ eq(parameters.Release, true) }})
      variables:
        ob_release_environment: ${{ iif(parameters.OfficialBuild, 'Production', 'Test') }}
        version: $[ stageDependencies.build.main.outputs['package.version'] ]
      jobs:
      - job: github
        displayName: Publish draft to GitHub
        pool:
          type: release
        templateContext:
          inputs:
          - input: pipelineArtifact
            artifactName: drop_build_main
        steps:
        - task: GitHubRelease@1
          displayName: Create GitHub release
          inputs:
            gitHubConnection: GitHub
            repositoryName: PowerShell/PSDesiredStateConfiguration
            target: v2
            assets: $(Pipeline.Workspace)/PSDesiredStateConfiguration.$(version).nupkg
            tagSource: userSpecifiedTag
            tag: $(version)
            isDraft: true
            addChangeLog: false
            releaseNotesSource: inline
            releaseNotesInline: "<!-- TODO: Generate release notes on GitHub! -->"
      - job: validation
        displayName: Manual validation
        pool:
          type: server
        timeoutInMinutes: 1440
        steps:
        - task: ManualValidation@0
          displayName: Wait 24 hours for validation
          inputs:
            notifyUsers: $(Build.RequestedForEmail)
            instructions: Please validate the release and then publish it!
            timeoutInMinutes: 1440
      - job: publish
        dependsOn: validation
        displayName: Publish to PowerShell Gallery
        pool:
          type: release
        templateContext:
          inputs:
          - input: pipelineArtifact
            artifactName: drop_build_main
        steps:
        - task: NuGetCommand@2
          displayName: Publish module to PowerShell Gallery
          inputs:
            command: push
            packagesToPush: $(Pipeline.Workspace)/PSDesiredStateConfiguration.$(version).nupkg
            nuGetFeedType: external
            publishFeedCredentials: PowerShellGallery