feat(pipelines): network isolation

.azure-devops/nova-facade-release.yml

@@ -1,34 +1,33 @@
-resources:
-  repositories:
-  - repository: 1ESPipelineTemplates
-    type: git
-    name: 1ESPipelineTemplates/1ESPipelineTemplates
-    ref: refs/tags/release
-
 pr: none
 trigger:
   - main
-schedules:
-- cron: 0 0 * * Mon
-  displayName: Nova-Facade weekly pipeline validation
-  branches:
-    include: 
-    - main
-  always: true
-
+
 variables:
   - group: InfoSec-SecurityResults
   - name: tags
     value: production,externalfacing
   - name: serviceTreeID
     value: ade7d667-42f5-485a-91a9-f1dc6482a9b0
+  - name: packagesArtifactName
+    value: packed-packages
   - name: adoNpmFeedBaseUrl
-    value: https://pkgs.dev.azure.com/domoreexp/_apis/packaging/feeds/npm-mirror
+    value: https://pkgs.dev.azure.com/DomoreexpGithub/_packaging/GraphQL/npm/registry/
+  - name: adoMirrorNpmFeedBaseUrl
+    value: https://pkgs.dev.azure.com/DomoreexpGithub/Github_Pipelines/_packaging/github-npm-mirror/npm/registry/
+
+resources:
+  repositories:
+    - repository: 1ESPipelineTemplates
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
 
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
 
   parameters:
+    settings:
+      networkIsolationPolicy: Permissive,CFSClean
     sdl:
       sourceAnalysisPool:
         name: Azure-Pipelines-1ESPT-ExDShared
@@ -37,35 +36,175 @@ extends:
     stages:
       - stage: release
         variables:
-          # OPTIONAL: Set this varibale to 'true' to enable signing in a target stage.
-          # Remove if signing is not required.
-          Build.ESRP.CodeSign.Enabled: true
+          # ESRP publishing is handled by EsrpRelease@9.
+          Build.ESRP.CodeSign.Enabled: false
           # OPTIONAL: To disable required tools not applicable in the pipeline set to false.
           # Supported values: BinSkim, Roslyn, ESLint, PREFast.
           Build.SDL.<Roslyn>.Enabled: false
           Build.SDL.<ESLint>.Enabled: true
         jobs:
-          - job: Release
-            pool: 
+          - job: Build
+            displayName: Build, test, and pack Graphitation packages
+            pool:
               name: Azure-Pipelines-1ESPT-ExDShared
               image: ubuntu-latest
               os: linux
+            workspace:
+              clean: all
+            variables:
+              artifactPath: $(Build.StagingDirectory)/out
+              packagesArtifactPath: $(Build.StagingDirectory)/out/${{ variables.packagesArtifactName }}
+            templateContext:
+              outputParentDirectory: $(artifactPath)
+              outputs:
+                - output: pipelineArtifact
+                  artifactName: ${{ variables.packagesArtifactName }}
+                  targetPath: $(packagesArtifactPath)
             steps:
               - checkout: self
                 persistCredentials: true # fix for beachball: https://github.com/microsoft/beachball/issues/674
-              - script: yarn
+
+              - template: /.azure-devops/steps/npm-auth-steps.yml@self
+                parameters:
+                  adoMirrorNpmFeedBaseUrl: ${{ variables.adoMirrorNpmFeedBaseUrl }}
+              - script: yarn install
                 displayName: yarn
+                env:
+                  YARN_NPM_AUTH_TOKEN: $(NPM_TOKEN)
+                  NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/npm-mirror.npmrc
               - script: |
                   yarn ci
                 displayName: build and test [test]
+                env:
+                  NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/npm-mirror.npmrc
+
+              - script: |
+                  mkdir -p "$(packagesArtifactPath)"
+                  packLayersPath="$(Build.StagingDirectory)/beachball-packed-layers"
+                  mkdir -p "$packLayersPath"
+                  releaseBranch="origin/${BUILD_SOURCEBRANCH#refs/heads/}"
+
+                  yarn beachball publish -b "$releaseBranch" -t latest -y --access public --no-push --keep-change-files --pack-to-path "$packLayersPath"
+
+                  find "$packLayersPath" -type f -name "*.tgz" -exec cp {} "$(packagesArtifactPath)" \;
+                displayName: Pack packages with beachball
+                env:
+                  NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/npm-mirror.npmrc
+
+          - job: PrivateAdoRelease
+            displayName: Release to ADO npm feed
+            dependsOn: Build
+            pool:
+              name: Azure-Pipelines-1ESPT-ExDShared
+              image: ubuntu-latest
+              os: linux
+            steps:
+              - checkout: self
+                persistCredentials: true # fix for beachball: https://github.com/microsoft/beachball/issues/674
+
+              - template: /.azure-devops/steps/npm-auth-steps.yml@self
+                parameters:
+                  adoMirrorNpmFeedBaseUrl: ${{ variables.adoMirrorNpmFeedBaseUrl }}
+
+              - script: yarn install
+                displayName: yarn install
+                env:
+                  YARN_NPM_AUTH_TOKEN: $(NPM_TOKEN)
+                  NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/npm-mirror.npmrc
+
+              - script: yarn build
+                displayName: build
+                env:
+                  NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/npm-mirror.npmrc
+
+              - script: |
+                  echo "always-auth=true" > .npmrc
+                  echo "registry=$(adoNpmFeedBaseUrl)" >> .npmrc
+                displayName: Create .npmrc for private ADO feed
+
+              - task: npmAuthenticate@0
+                displayName: npm authenticate for private ADO feed
+                inputs:
+                  workingFile: ".npmrc"
+
+              - script: |
+                  releaseBranch="origin/${BUILD_SOURCEBRANCH#refs/heads/}"
+                  if [ "${BUILD_SOURCEBRANCH}" = "refs/heads/main" ]; then
+                    yarn beachball publish -b "$releaseBranch" -t latest -y --registry $(adoNpmFeedBaseUrl) --no-push --keep-change-files
+                  else
+                    yarn beachball canary -b "$releaseBranch" -y --registry $(adoNpmFeedBaseUrl)
+                  fi
+                displayName: Release to the ADO npm feed
+                env:
+                  NPM_CONFIG_USERCONFIG: $(Build.SourcesDirectory)/.npmrc
+
+          - job: PublicNpmRelease
+            displayName: ESRP release to public npm
+            dependsOn: Build
+            condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+            pool:
+              name: Azure-Pipelines-1ESPT-ExDShared
+              image: ubuntu-latest
+              os: linux
+            variables:
+              packagesArtifactPath: $(Agent.BuildDirectory)/${{ variables.packagesArtifactName }}
+            templateContext:
+              type: releaseJob
+              isProduction: true
+              inputs:
+                - input: pipelineArtifact
+                  artifactName: ${{ variables.packagesArtifactName }}
+                  targetPath: $(packagesArtifactPath)
+            steps:
+              - script: find "$(packagesArtifactPath)" -maxdepth 2 -type f -name "*.tgz" -print
+                displayName: Show packages artifact contents
+
+              - task: EsrpRelease@9
+                displayName: ESRP Release to npm
+                inputs:
+                  connectedservicename: $(Release.ConnectedServiceName)
+                  usemanagedidentity: true
+                  keyvaultname: $(Release.KeyVaultName)
+                  signcertname: $(Release.SignCertName)
+                  clientid: $(Release.ClientId)
+                  contenttype: npm
+                  folderlocation: $(packagesArtifactPath)
+                  owners: $(Release.Owners)
+                  approvers: $(Release.Approvers)
+                  mainpublisher: ESRPRELPACMAN
+                  domaintenantid: $(Release.DomainTenantId)
+
+          - job: Bump
+            displayName: Bump package versions
+            dependsOn:
+              - PrivateAdoRelease
+              - PublicNpmRelease
+            condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+            pool:
+              name: Azure-Pipelines-1ESPT-ExDShared
+              image: ubuntu-latest
+              os: linux
+            steps:
+              - checkout: self
+                persistCredentials: true # fix for beachball: https://github.com/microsoft/beachball/issues/674
+
+              - template: /.azure-devops/steps/npm-auth-steps.yml@self
+                parameters:
+                  adoMirrorNpmFeedBaseUrl: ${{ variables.adoMirrorNpmFeedBaseUrl }}
+
+              - script: yarn install
+                displayName: yarn install
+                env:
+                  YARN_NPM_AUTH_TOKEN: $(NPM_TOKEN)
+                  NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/npm-mirror.npmrc
+
               - script: |
                   git config user.email "gql-svc@microsoft.com"
                   git config user.name "Graphitation Service Account"
-                displayName: Configure git for release
-              - script: yarn release -y -n $(ossNpmToken) --access public
-                displayName: Release
-              - task: 1ES.PublishPipelineArtifact@1
-                displayName: 📒 Publish Manifest
-                inputs:
-                  artifactName: SBom-$(System.JobAttempt)
-                  targetPath: $(System.DefaultWorkingDirectory)/_manifest
+                  releaseBranchName="${BUILD_SOURCEBRANCH#refs/heads/}"
+                  releaseBranch="origin/$releaseBranchName"
+                  git fetch origin "$releaseBranchName"
+                  yarn beachball publish -b "$releaseBranch" -t latest -y --access public --no-publish --message "applying package updates [skip ci]"
+                displayName: Bump versions and push changelogs
+                env:
+                  NPM_CONFIG_USERCONFIG: $(Agent.TempDirectory)/npm-mirror.npmrc

.azure-devops/steps/npm-auth-steps.yml

@@ -0,0 +1,25 @@
+# Reusable steps to authenticate against the ADO npm mirror feed and configure
+# both npm and yarn to use it. Consumed via `- template: templates/npm-auth-steps.yml`.
+parameters:
+  - name: adoMirrorNpmFeedBaseUrl
+    type: string
+
+steps:
+  - script: |
+      cat <<'EOF' > "$(Agent.TempDirectory)/npm-mirror.npmrc"
+      always-auth=true
+      registry=${{ parameters.adoMirrorNpmFeedBaseUrl }}
+      EOF
+    displayName: Create temporary .npmrc for mirror feed
+  - task: npmAuthenticate@0
+    displayName: npm authenticate
+    inputs:
+      workingFile: "$(Agent.TempDirectory)/npm-mirror.npmrc"
+  - script: |
+      TOKEN=$(grep '_authToken' "$(Agent.TempDirectory)/npm-mirror.npmrc" | head -1 | cut -d'=' -f2)
+      echo "##vso[task.setvariable variable=NPM_TOKEN;issecret=true]$TOKEN"
+    displayName: Extract token from .npmrc
+  - script: |
+      yarn config set npmAlwaysAuth true
+      yarn config set npmRegistryServer ${{ parameters.adoMirrorNpmFeedBaseUrl }}
+    displayName: Configure yarn for ADO npm feed

.gitignore

@@ -13,3 +13,7 @@ __screenshots__
 .swc
 .vitest
 .vitest2
+
+# Yarn Berry install state cache
+.yarn/install-state.gz
+