[release/6.0.1xx] Add CI for security-partners-dotnet #14963

lbussell · 2022-11-11T17:41:06Z

Pending this CI run: https://dev.azure.com/dnceng/internal/_build/results?buildId=2042997&view=results

lbussell · 2022-11-11T20:36:33Z

@MichaelSimons trying a new approach: remove all nuget configs from all submodules. I don't think it will cause any major build issues. Let me know what you think. (internal) CI run: https://dev.azure.com/dnceng/internal/_build/results?buildId=2043133&view=results

src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml

MichaelSimons · 2022-11-12T00:57:07Z

src/SourceBuild/tarball/content/ci.yml

@@ -0,0 +1,19 @@
+variables:


We should avoid putting content at the root of the tarball. This should go into the eng\pipelines folder IMO.

There is no existing eng/pipelines folder that I see. Do you mean to put it in <installer src>/eng/... or <tarball content>/eng/...?

I intended to create the folder in <tarball content>/eng/. I would be fine with just putting it in <tarball content>/

MichaelSimons · 2022-11-12T01:00:24Z

src/SourceBuild/tarball/content/ci.yml

@@ -0,0 +1,19 @@
+variables:
+  NugetSecurityAnalysisWarningLevel: none


Is this variable used? From your feedback, it doesn't seem to. I think it is worth reaching out to [email protected] on why this doesn't work.

There are some places setting this in dotnet - https://github.com/dotnet/project-system/blob/5930b5b0dc5afb547eb399cd71445d43338647cb/eng/pipelines/pull-request.yml#L46

Perhaps the problem is not multiple feeds rather there is no clear first?

It seems to me that this variable does nothing and might have been a placeholder while teams fix their NuGet configs. I have sent an email to that alias and CC'ed you, and I will remove the variable from the pipeline as well.

MichaelSimons · 2022-11-12T01:00:42Z

src/SourceBuild/tarball/content/ci.yml

@@ -0,0 +1,19 @@
+variables:


Does this pipeline need a PR trigger?

For PR validation on Azure Repos Git, it's configured via the UI and not yaml: https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/azure-repos-git?view=azure-devops&tabs=yaml#pr-triggers

I'll put a trigger: none here for now, but do you think we should have it trigger on commits to release/* branches as well as for PR validation?

Thanks, I didn't realize that.

lbussell · 2022-11-15T19:59:21Z

For some reason the online smoke tests have failed, but only after I fixed the installer nuget config path. @MichaelSimons could you take a look, given you're more familiar with the smoke test nuget config setup? https://dev.azure.com/dnceng/internal/_build/results?buildId=2043133&view=results (internal link)

MichaelSimons · 2022-11-15T20:25:14Z

src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml

      inputs:
-        filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.sh
-        arguments: $(Build.SourcesDirectory)/NuGet.config $Token
+        filePath: $(installerSrcDir)/eng/common/SetupNugetSources.sh


I think the problem with the failing tests is that in an offline build, we strip the online feeds from the repo's nuget configs - https://github.com/dotnet/installer/blob/main/src/SourceBuild/tarball/content/repos/Directory.Build.targets#L184. Additionally, we don't want to be adding these sources for the installer's nuget.config we build with. We really only want to manipulate the nuget.config used for testing. I'll let you propose how to accomplish that.

MichaelSimons

Friendly reminder to proactively ping the thread on the nuget security scanning issue.

src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml

…uild-tarball.yml Co-authored-by: Michael Simons <[email protected]>

lbussell · 2022-11-16T19:15:39Z

I submitted dotnet/source-build#3125 as a draft in case we don't get an exception to the NuGet Security Analysis check.

This reverts commit 87b8a2c.

* [release/6.0.1xx] Add CI for security-partners-dotnet (#14963) * Add CI for dotnet-security-partners * Remove nuget configs from all repo submodules * Address code review * Move security-partners ci to tarball/eng dir * Copy out installer NuGet config before build * Fix relative path for installer template * Update src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml Co-authored-by: Michael Simons <[email protected]> * Revert "Remove nuget configs from all repo submodules" This reverts commit 87b8a2c. Co-authored-by: Michael Simons <[email protected]> * Update branding to 6.0.113 Co-authored-by: Logan Bussell <[email protected]> Co-authored-by: Michael Simons <[email protected]> Co-authored-by: Sean Reeser <[email protected]> Co-authored-by: Marc Paine <[email protected]> Co-authored-by: Matt Mitchell <[email protected]>

lbussell requested a review from a team as a code owner November 11, 2022 17:41

Add CI for dotnet-security-partners

77a500f

lbussell force-pushed the security-partners-ci branch from 41c02f4 to 77a500f Compare November 11, 2022 18:20

Remove nuget configs from all repo submodules

87b8a2c

MichaelSimons reviewed Nov 12, 2022

View reviewed changes

lbussell added 2 commits November 15, 2022 10:13

Address code review

3564280

Move security-partners ci to tarball/eng dir

a371893

MichaelSimons reviewed Nov 15, 2022

View reviewed changes

MichaelSimons added the Area-SourceBuild label Nov 15, 2022

lbussell added 2 commits November 16, 2022 00:13

Copy out installer NuGet config before build

457017c

Fix relative path for installer template

5bc2120

lbussell requested a review from MichaelSimons November 16, 2022 16:30

MichaelSimons reviewed Nov 16, 2022

View reviewed changes

src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml Outdated Show resolved Hide resolved

lbussell mentioned this pull request Nov 16, 2022

[release/7.0.1xx] Add CI for security-partners-dotnet #15007

Merged

lbussell changed the title ~~[release/6.0.1xx] Add CI for dotnet-security-partners~~ [release/6.0.1xx] Add CI for security-partners-dotnet Nov 16, 2022

Update src/SourceBuild/Arcade/eng/common/templates/job/source-build-b…

3f06b90

…uild-tarball.yml Co-authored-by: Michael Simons <[email protected]>

lbussell mentioned this pull request Nov 16, 2022

[release/6.0] Remove nuget config changes from humanizer patch dotnet/source-build#3125

Closed

Revert "Remove nuget configs from all repo submodules"

7e6af9b

This reverts commit 87b8a2c.

lbussell requested review from MichaelSimons and crummel November 17, 2022 18:51

MichaelSimons approved these changes Nov 17, 2022

View reviewed changes

crummel approved these changes Nov 17, 2022

View reviewed changes

lbussell merged commit 9299e47 into dotnet:release/6.0.1xx Nov 17, 2022

		@@ -0,0 +1,19 @@
		variables:
		NugetSecurityAnalysisWarningLevel: none

[release/6.0.1xx] Add CI for security-partners-dotnet #14963

[release/6.0.1xx] Add CI for security-partners-dotnet #14963

Uh oh!

Conversation

lbussell commented Nov 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lbussell commented Nov 11, 2022

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lbussell commented Nov 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MichaelSimons left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lbussell commented Nov 16, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lbussell commented Nov 11, 2022 •

edited

Loading

lbussell commented Nov 15, 2022 •

edited

Loading