variables:
  - name: _BuildConfig
    value: Release
  - name: _TeamName
    value: AspNetCore
  - name: DOTNET_SKIP_FIRST_TIME_EXPERIENCE
    value: true
  - name: _PublishUsingPipelines
    value: true
  - name: _CosmosConnectionUrl
    value: https://localhost:8081
  - name: _CosmosToken
    value: C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==
  - ${{ if or(startswith(variables['Build.SourceBranch'], 'refs/heads/release/'), startswith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'), eq(variables['Build.Reason'], 'Manual')) }}:
    - name: PostBuildSign
      value: false
  - ${{ else }}:
    - name: PostBuildSign
      value: true
  - group: DotNet-HelixApi-Access
  - group: DotNetBuilds storage account read tokens
  - group: AzureDevOps-Artifact-Feeds-Pats
  - name: _InternalRuntimeDownloadArgs
    value: /p:DotNetRuntimeSourceFeed=https://dotnetbuilds.blob.core.windows.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64)
  - name: LC_ALL
    value: 'en_US.UTF-8'
  - name: LANG
    value: 'en_US.UTF-8'
  - name: LANGUAGE
    value: 'en_US.UTF-8'
  - template: /eng/common/templates-official/variables/pool-providers.yml@self
trigger:
  batch: true
  branches:
    include:
      - main
      - release/*
      - feature/*
      - internal/release/*
pr: ['*']
resources:
  repositories:
  - repository: 1ESPipelineTemplates
    type: git
    name: 1ESPipelineTemplates/1ESPipelineTemplates
    ref: refs/tags/release
extends:
  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
  parameters:
    featureFlags:
      autoBaseline: false
    sdl:
      sourceAnalysisPool:
        name: $(DncEngInternalBuildPool)
        image: 1es-windows-2022
        os: windows
      baseline:
        baselineFile: $(Build.SourcesDirectory)\.config\guardian\.gdnbaselines
      binskim:
        scanOutputDirectoryOnly: true
    customBuildTags:
    - ES365AIMigrationTooling
    stages:
    - stage: build
      displayName: Build
      jobs:
      - template: /eng/common/templates-official/jobs/jobs.yml@self
        parameters:
          enableMicrobuild: true
          enablePublishBuildArtifacts: true
          enablePublishBuildAssets: true
          enablePublishTestResults: true
          enablePublishUsingPipelines: ${{ variables._PublishUsingPipelines }}
          publishAssetsImmediately: true
          enableSourceIndex: ${{ eq(variables['Build.SourceBranch'], 'refs/heads/main') }}
          enableTelemetry: true
          helixRepo: dotnet/efcore
          jobs:
          - job: Windows
            pool:
              name: $(DncEngInternalBuildPool)
              demands: ImageOverride -equals 1es-windows-2022
              os: windows
            timeoutInMinutes: 180
            variables:
              - _AdditionalBuildArgs: ''
              - _InternalBuildArgs: ''
              # Rely on task Arcade injects, not auto-injected build step.
              - skipComponentGovernanceDetection: true
              - ${{ if notin(variables['Build.Reason'], 'PullRequest') }}:
                - _SignType: real
                - _InternalBuildArgs: /p:DotNetSignType=$(_SignType) /p:TeamName=$(_TeamName) /p:DotNetPublishUsingPipelines=$(_PublishUsingPipelines) /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
              # Ignore test and infrastructure code.
              - Codeql.SourceRoot: src
              # CodeQL3000 needs this plumbed along as a variable to enable TSA.
              - Codeql.TSAEnabled: true
              # Default expects tsaoptions.json under SourceRoot.
              - Codeql.TSAOptionsPath: '$(Build.SourcesDirectory)/.config/tsaoptions.json'
            steps:
              - task: NuGetCommand@2
                displayName: 'Clear NuGet caches'
                condition: succeeded()
                inputs:
                  command: custom
                  arguments: 'locals all -clear'
              - script: "echo ##vso[build.addbuildtag]daily-build"
                condition: and(notin(variables['Build.Reason'], 'PullRequest'), ne(variables['IsFinalBuild'], 'true'))
                displayName: 'Set CI tags'
              - script: "echo ##vso[build.addbuildtag]release-candidate"
                condition: and(notin(variables['Build.Reason'], 'PullRequest'), eq(variables['IsFinalBuild'], 'true'))
                displayName: 'Set CI tags'
              - powershell: SqlLocalDB start
                displayName: Start LocalDB
              - task: PowerShell@2
                displayName: Setup Private Feeds Credentials
                inputs:
                  filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
                  arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token
                env:
                  Token: $(dn-bot-dnceng-artifact-feeds-rw)
              - script: eng\common\cibuild.cmd -configuration $(_BuildConfig) -prepareMachine $(_InternalBuildArgs) $(_InternalRuntimeDownloadArgs) $(_AdditionalBuildArgs)
                env:
                  Test__Cosmos__DefaultConnection: $(_CosmosConnectionUrl)
                name: Build
            templateContext:
              outputs:
              - output: pipelineArtifact
                displayName: Upload TestResults
                condition: always()
                path: artifacts/TestResults/$(_BuildConfig)/
                artifact: $(Agent.Os)_$(Agent.JobName) TestResults
          - job: macOS
            pool:
              name: Azure Pipelines
              image: macOS-11
              os: macOS
            variables:
              # Rely on task Arcade injects, not auto-injected build step.
              - skipComponentGovernanceDetection: true
            steps:
              - task: Bash@3
                displayName: Setup Private Feeds Credentials
                inputs:
                  filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.sh
                  arguments: $(Build.SourcesDirectory)/NuGet.config $Token
                env:
                  Token: $(dn-bot-dnceng-artifact-feeds-rw)
              - script: eng/common/cibuild.sh --configuration $(_BuildConfig) --prepareMachine $(_InternalRuntimeDownloadArgs)
                env:
                  Test__Cosmos__DefaultConnection: $(_CosmosConnectionUrl)
                  # Work-around for https://github.com/dotnet/runtime/issues/70758
                  COMPlus_EnableWriteXorExecute: 0
                name: Build
            templateContext:
              outputs:
              - output: pipelineArtifact
                displayName: Upload TestResults
                condition: always()
                path: artifacts/TestResults/$(_BuildConfig)/
                artifact: $(Agent.Os)_$(Agent.JobName) TestResults
          - job: Linux
            timeoutInMinutes: 120
            pool:
              name: $(DncEngInternalBuildPool)
              demands: ImageOverride -equals 1es-ubuntu-2204
              os: linux
            variables:
              - _runCounter: $[counter(variables['Build.Reason'], 0)]
              # Rely on task Arcade injects, not auto-injected build step.
              - skipComponentGovernanceDetection: true
              - ${{ if notin(variables['Build.Reason'], 'PullRequest', 'Schedule') }}:
                - _CosmosConnectionUrl: 'true'
            steps:
              - bash: |
                  echo "##vso[task.setvariable variable=_CosmosConnectionUrl]https://ef-nightly-test.documents.azure.com:443/"
                  echo "##vso[task.setvariable variable=_CosmosToken]$(ef-nightly-cosmos-key)"
                displayName: Prepare to run Cosmos tests on ef-nightly-test
                condition: and(eq(variables['_CosmosConnectionUrl'], 'true'), or(endsWith(variables['_runCounter'], '0'), endsWith(variables['_runCounter'], '2'), endsWith(variables['_runCounter'], '4'), endsWith(variables['_runCounter'], '6'), endsWith(variables['_runCounter'], '8')))
              - bash: |
                  echo "##vso[task.setvariable variable=_CosmosConnectionUrl]https://ef-pr-test.documents.azure.com:443/"
                  echo "##vso[task.setvariable variable=_CosmosToken]$(ef-pr-cosmos-test)"
                displayName: Prepare to run Cosmos tests on ef-pr-test
                condition: and(eq(variables['_CosmosConnectionUrl'], 'true'), or(endsWith(variables['_runCounter'], '1'), endsWith(variables['_runCounter'], '3'), endsWith(variables['_runCounter'], '5'), endsWith(variables['_runCounter'], '7'), endsWith(variables['_runCounter'], '9')))
              - task: Bash@3
                displayName: Setup Private Feeds Credentials
                inputs:
                  filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.sh
                  arguments: $(Build.SourcesDirectory)/NuGet.config $Token
                env:
                  Token: $(dn-bot-dnceng-artifact-feeds-rw)
              - script: eng/common/cibuild.sh --configuration $(_BuildConfig) --prepareMachine $(_InternalRuntimeDownloadArgs)
                env:
                  Test__Cosmos__DefaultConnection: $(_CosmosConnectionUrl)
                  Test__Cosmos__AuthToken: $(_CosmosToken)
                name: Build
            templateContext:
              outputs:
              - output: pipelineArtifact
                displayName: Upload TestResults
                condition: always()
                path: artifacts/TestResults/$(_BuildConfig)/
                artifact: $(Agent.Os)_$(Agent.JobName) TestResults
          - job: Helix
            timeoutInMinutes: 180
            pool:
              name: $(DncEngInternalBuildPool)
              demands: ImageOverride -equals 1es-windows-2022
              os: windows
            variables:
              # Rely on task Arcade injects, not auto-injected build step.
              - skipComponentGovernanceDetection: true
              - name: _HelixBuildConfig
                value: $(_BuildConfig)
              - name: HelixTargetQueues
                value: OSX.1100.Amd64;(Ubuntu.2004.Amd64.SqlServer)Ubuntu.2004.Amd64@mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-20.04-helix-sqlserver-amd64
              - name: _HelixAccessToken
                # Needed for internal queues
                value: $(HelixApiAccessToken)
            steps:
              - task: NuGetCommand@2
                displayName: 'Clear NuGet caches'
                condition: succeeded()
                inputs:
                  command: custom
                  arguments: 'locals all -clear'
              - task: PowerShell@2
                displayName: Setup Private Feeds Credentials
                inputs:
                  filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
                  arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token
                env:
                    Token: $(dn-bot-dnceng-artifact-feeds-rw)
              - script: restore.cmd -ci /p:configuration=$(_BuildConfig) $(_InternalRuntimeDownloadArgs)
                displayName: Restore packages
              - script: .dotnet\dotnet build eng\helix.proj /restore /t:Test /p:configuration=$(_BuildConfig) /bl:$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/SendToHelix.binlog $(_InternalRuntimeDownloadArgs)
                displayName: Send job to helix
                env:
                  HelixAccessToken: $(_HelixAccessToken)
                  # We need to set this env var to publish helix results to Azure Dev Ops
                  SYSTEM_ACCESSTOKEN: $(System.AccessToken)
                  MSSQL_SA_PASSWORD: "PLACEHOLDER"
                  # Work-around for https://github.com/dotnet/runtime/issues/70758
                  COMPlus_EnableWriteXorExecute: 0
                  DotNetBuildsInternalReadSasToken: $(dotnetbuilds-internal-container-read-token)
    - ${{ if notin(variables['Build.Reason'], 'PullRequest') }}:
      - template: /eng/common/templates-official/post-build/post-build.yml@self
        parameters:
          publishingInfraVersion: 3
          enableSigningValidation: false
          enableNugetValidation: false
          enableSourceLinkValidation: false
          publishAssetsImmediately: true
          SDLValidationParameters:
            enable: false