Skip to content

Commit 8c4965f

Browse files
directhexmmitche
directhex
authored and
mmitche
committed
Use Service Connection instead of SAS for source index stage 1 upload (dotnet#14766)
Manual backport of dotnet#14750 to release/8.0 Needed for Spring Grove. The only repo using Arcade 8.0 but publishing to Source Index is maintenance-packages.
1 parent a721b8e commit 8c4965f

File tree

3 files changed

+75
-40
lines changed

3 files changed

+75
-40
lines changed

‎.vault-config/product-builds-netsourceindexvault.yaml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎eng/common/templates-official/job/source-index-stage1.yml‎

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
parameters:
22
runAsPublic: false
3-
sourceIndexPackageVersion: 1.0.1-20240320.1
3+
sourceIndexUploadPackageVersion: 2.0.0-20240502.12
4+
sourceIndexProcessBinlogPackageVersion: 1.0.1-20240129.2
45
sourceIndexPackageSource: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json
56
sourceIndexBuildCommand: powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "eng/common/build.ps1 -restore -build -binarylog -ci"
67
preSteps: []
@@ -17,14 +18,27 @@ jobs:
1718
dependsOn: ${{ parameters.dependsOn }}
1819
condition: ${{ parameters.condition }}
1920
variables:
20-
- name: SourceIndexPackageVersion
21-
value: ${{ parameters.sourceIndexPackageVersion }}
21+
- name: SourceIndexUploadPackageVersion
22+
value: ${{ parameters.sourceIndexUploadPackageVersion }}
23+
- name: SourceIndexProcessBinlogPackageVersion
24+
value: ${{ parameters.sourceIndexProcessBinlogPackageVersion }}
2225
- name: SourceIndexPackageSource
2326
value: ${{ parameters.sourceIndexPackageSource }}
2427
- name: BinlogPath
2528
value: ${{ parameters.binlogPath }}
26-
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
27-
- group: source-dot-net stage1 variables
29+
- template: /eng/common/templates-official/variables/pool-providers.yml
30+
31+
${{ if ne(parameters.pool, '') }}:
32+
pool: ${{ parameters.pool }}
33+
${{ if eq(parameters.pool, '') }}:
34+
pool:
35+
${{ if eq(variables['System.TeamProject'], 'public') }}:
36+
name: $(DncEngPublicBuildPool)
37+
demands: ImageOverride -equals windows.vs2019.amd64.open
38+
${{ if eq(variables['System.TeamProject'], 'internal') }}:
39+
name: $(DncEngInternalBuildPool)
40+
image: windows.vs2022.amd64
41+
os: windows
2842

2943
pool: ${{ parameters.pool }}
3044
steps:
@@ -40,8 +54,8 @@ jobs:
4054
workingDirectory: $(Agent.TempDirectory)
4155

4256
- script: |
43-
$(Agent.TempDirectory)/dotnet/dotnet tool install BinLogToSln --version $(SourceIndexPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools
44-
$(Agent.TempDirectory)/dotnet/dotnet tool install UploadIndexStage1 --version $(SourceIndexPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools
57+
$(Agent.TempDirectory)/dotnet/dotnet tool install BinLogToSln --version $(sourceIndexProcessBinlogPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools
58+
$(Agent.TempDirectory)/dotnet/dotnet tool install UploadIndexStage1 --version $(sourceIndexUploadPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools
4559
displayName: Download Tools
4660
# Set working directory to temp directory so 'dotnet' doesn't try to use global.json and use the repo's sdk.
4761
workingDirectory: $(Agent.TempDirectory)
@@ -53,7 +67,21 @@ jobs:
5367
displayName: Process Binlog into indexable sln
5468

5569
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
56-
- script: $(Agent.TempDirectory)/.source-index/tools/UploadIndexStage1 -i .source-index/stage1output -n $(Build.Repository.Name)
70+
- task: AzureCLI@2
71+
displayName: Get stage 1 auth token
72+
inputs:
73+
azureSubscription: 'SourceDotNet Stage1 Publish'
74+
addSpnToEnvironment: true
75+
scriptType: 'ps'
76+
scriptLocation: 'inlineScript'
77+
inlineScript: |
78+
echo "##vso[task.setvariable variable=ARM_CLIENT_ID;issecret=true]$env:servicePrincipalId"
79+
echo "##vso[task.setvariable variable=ARM_ID_TOKEN;issecret=true]$env:idToken"
80+
echo "##vso[task.setvariable variable=ARM_TENANT_ID;issecret=true]$env:tenantId"
81+
82+
- script: |
83+
az login --service-principal -u $(ARM_CLIENT_ID) --tenant $(ARM_TENANT_ID) --allow-no-subscriptions --federated-token $(ARM_ID_TOKEN)
84+
displayName: "Login to Azure"
85+
86+
- script: $(Agent.TempDirectory)/.source-index/tools/UploadIndexStage1 -i .source-index/stage1output -n $(Build.Repository.Name) -s netsourceindexstage1 -b stage1
5787
displayName: Upload stage1 artifacts to source index
58-
env:
59-
BLOB_CONTAINER_URL: $(source-dot-net-stage1-blob-container-url)

‎eng/common/templates/job/source-index-stage1.yml‎

Lines changed: 37 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
parameters:
22
runAsPublic: false
3-
sourceIndexPackageVersion: 1.0.1-20240320.1
3+
sourceIndexUploadPackageVersion: 2.0.0-20240502.12
4+
sourceIndexProcessBinlogPackageVersion: 1.0.1-20240129.2
45
sourceIndexPackageSource: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json
56
sourceIndexBuildCommand: powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "eng/common/build.ps1 -restore -build -binarylog -ci"
67
preSteps: []
@@ -15,14 +16,26 @@ jobs:
1516
dependsOn: ${{ parameters.dependsOn }}
1617
condition: ${{ parameters.condition }}
1718
variables:
18-
- name: SourceIndexPackageVersion
19-
value: ${{ parameters.sourceIndexPackageVersion }}
19+
- name: SourceIndexUploadPackageVersion
20+
value: ${{ parameters.sourceIndexUploadPackageVersion }}
21+
- name: SourceIndexProcessBinlogPackageVersion
22+
value: ${{ parameters.sourceIndexProcessBinlogPackageVersion }}
2023
- name: SourceIndexPackageSource
2124
value: ${{ parameters.sourceIndexPackageSource }}
2225
- name: BinlogPath
2326
value: ${{ parameters.binlogPath }}
24-
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
25-
- group: source-dot-net stage1 variables
27+
- template: /eng/common/templates/variables/pool-providers.yml
28+
29+
${{ if ne(parameters.pool, '') }}:
30+
pool: ${{ parameters.pool }}
31+
${{ if eq(parameters.pool, '') }}:
32+
pool:
33+
${{ if eq(variables['System.TeamProject'], 'public') }}:
34+
name: $(DncEngPublicBuildPool)
35+
demands: ImageOverride -equals windows.vs2019.amd64.open
36+
${{ if eq(variables['System.TeamProject'], 'internal') }}:
37+
name: $(DncEngInternalBuildPool)
38+
demands: ImageOverride -equals windows.vs2019.amd64
2639

2740
pool: ${{ parameters.pool }}
2841
steps:
@@ -38,8 +51,8 @@ jobs:
3851
workingDirectory: $(Agent.TempDirectory)
3952

4053
- script: |
41-
$(Agent.TempDirectory)/dotnet/dotnet tool install BinLogToSln --version $(SourceIndexPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools
42-
$(Agent.TempDirectory)/dotnet/dotnet tool install UploadIndexStage1 --version $(SourceIndexPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools
54+
$(Agent.TempDirectory)/dotnet/dotnet tool install BinLogToSln --version $(sourceIndexProcessBinlogPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools
55+
$(Agent.TempDirectory)/dotnet/dotnet tool install UploadIndexStage1 --version $(sourceIndexUploadPackageVersion) --add-source $(SourceIndexPackageSource) --tool-path $(Agent.TempDirectory)/.source-index/tools
4356
displayName: Download Tools
4457
# Set working directory to temp directory so 'dotnet' doesn't try to use global.json and use the repo's sdk.
4558
workingDirectory: $(Agent.TempDirectory)
@@ -51,7 +64,21 @@ jobs:
5164
displayName: Process Binlog into indexable sln
5265

5366
- ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
54-
- script: $(Agent.TempDirectory)/.source-index/tools/UploadIndexStage1 -i .source-index/stage1output -n $(Build.Repository.Name)
67+
- task: AzureCLI@2
68+
displayName: Get stage 1 auth token
69+
inputs:
70+
azureSubscription: 'SourceDotNet Stage1 Publish'
71+
addSpnToEnvironment: true
72+
scriptType: 'ps'
73+
scriptLocation: 'inlineScript'
74+
inlineScript: |
75+
echo "##vso[task.setvariable variable=ARM_CLIENT_ID;issecret=true]$env:servicePrincipalId"
76+
echo "##vso[task.setvariable variable=ARM_ID_TOKEN;issecret=true]$env:idToken"
77+
echo "##vso[task.setvariable variable=ARM_TENANT_ID;issecret=true]$env:tenantId"
78+
79+
- script: |
80+
az login --service-principal -u $(ARM_CLIENT_ID) --tenant $(ARM_TENANT_ID) --allow-no-subscriptions --federated-token $(ARM_ID_TOKEN)
81+
displayName: "Login to Azure"
82+
83+
- script: $(Agent.TempDirectory)/.source-index/tools/UploadIndexStage1 -i .source-index/stage1output -n $(Build.Repository.Name) -s netsourceindexstage1 -b stage1
5584
displayName: Upload stage1 artifacts to source index
56-
env:
57-
BLOB_CONTAINER_URL: $(source-dot-net-stage1-blob-container-url)

0 commit comments

Comments
 (0)