azure-pipelines.yml

# SonarScanner for MSBuild
# Build, QA, Deploy

schedules:
  # Run from Monday to Friday at 2:0 UTC (https://docs.microsoft.com/en-us/azure/devops/pipelines/process/scheduled-triggers?view=azure-devops&tabs=yaml#cron-syntax)
  - cron: "0 2 * * 1-5"
    displayName: Nightly build
    branches:
      include:
        - master
        - branch-*
    always: true

trigger:
  - master
  - branch-*

pool: .net-bubble-aws-re-team-prod

variables:
  - group: sonarsource-build-variables
  - group: sonar-scanner-dotnet-variables
  - group: artifactory_access
  - group: digicert-keylocker
  # ARTIFACTORY_URL https://repox.jfrog.io/repox => https://repox.jfrog.io/artifactory
  # JFROG_URL https://repox.jfrog.io
  # https://github.com/SonarSource/parent-oss/blob/master/pom.xml#L708-L711
  - name: ARTIFACTORY_DEPLOY_USERNAME
    value: $[variables.ARTIFACTORY_QA_DEPLOYER_USERNAME]
  - name: ARTIFACTORY_QA_READER_USERNAME
    value: $[variables.ARTIFACTORY_PRIVATE_READER_USERNAME]
  # pipelines-yaml-templates/promote-stage.yml line 56
  - name: IS_RELEASE_BRANCH
    value: ${{ or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), startsWith(variables['Build.SourceBranch'], 'refs/heads/branch-')) }}
  - name: BUILD_CONFIGURATION
    value: "Release"
  - name: BUILD_PLATFORM
    value: "Any CPU"
  - name: SOLUTION
    value: "SonarScanner.MSBuild.sln"
  - name: NUGET_VERSION
    value: "6.10.1"

stages:
  - stage: build
    displayName: 'Build:'
    jobs:
      - job: build
        displayName: 'Build and stage to repox'
        workspace:
          clean: all
        variables:
          MAVEN_CACHE_FOLDER: $(Pipeline.Workspace)/.m2/repository
          MAVEN_OPTS: '-Xmx3072m -Dmaven.repo.local=$(MAVEN_CACHE_FOLDER)'
          commonMavenArguments: -B -Pdeploy-sonarsource -Dmaven.test.skip=true
        steps:
          - checkout: self

          - task: NuGetToolInstaller@1
            displayName: "Install NuGet"
            inputs:
              versionSpec: $(NUGET_VERSION)

          - task: Cache@2
            displayName: Cache Maven local repo
            inputs:
              key: maven | pom.xml
              path: $(MAVEN_CACHE_FOLDER)

          - task: DownloadSecureFile@1
            name: snk
            inputs:
              secureFile: 'SonarSourceSecret.snk'
            displayName: 'Download snk'
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')

          - task: DownloadSecureFile@1
            # This file is used by the "DigiCert Signing Manager KSP" Key Storage Provider to authenticate against the DigiCert private key provider server.
            name: SM_CLIENT_CERT
            displayName: Download p12 file
            inputs:
              secureFile: digicert_authentication_certificate.p12
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')

          - task: DownloadSecureFile@1
            # This file contains the signing certificate without the private key. The private key will be downloaded later, during the signing process.
            displayName: 'Download crt file'
            name: SM_CLIENT_CRT
            inputs:
              secureFile: cert_525594307.crt
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')

          # Initialize the DigiCert Private Key Provider.
          # What we think it does: The smctl tool authenticates with a client certificate (SM_CLIENT_CERT_FILE) and a client password (SM_CLIENT_CERT_PASSWORD).
          # It uses an API Key (SM_API_KEY) and the ID of the certificate (SM_CERT) to check if the authenticated client is authorized to use the
          # certificate specified and synchronize (potentially private) information about the certificate.
          - powershell: |
              Write-Output "smctl sync:"
              smctl windows certsync
            displayName: Synchronize certificates
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')
            env:
              SM_CLIENT_CERT_FILE: $(SM_CLIENT_CERT.secureFilePath)
              SM_CLIENT_CERT_PASSWORD: $(SM_CLIENT_CERT_PASSWORD)
              SM_API_KEY: $(SM_API_KEY)
              SM_CERT: $(SM_CERT)

          - powershell: .\scripts\promote-project-version.ps1
            displayName: 'Promote project version'

          - task: VSBuild@1
            displayName: 'Set BranchName, Sha1 and BuildNumber properties from Azdo pipeline variables'
            inputs:
              solution: 'scripts\version\ChangeVersion.proj'
              msbuildArgs: '/p:Sha1=$(Build.SourceVersion) /p:BranchName=$(Build.SourceBranchName) /p:BuildNumber=$(Build.BuildId)  /p:BuildConfiguration=$(BUILD_CONFIGURATION)'

          - task: DotNetCoreCLI@2
            displayName: Dotnet restore $(SOLUTION)
            env:
              ARTIFACTORY_USER: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)
            inputs:
              command: 'restore'
              projects: '$(SOLUTION)'
              feedsToUse: 'config'
              nugetConfigPath: 'NuGet.Config'
              verbosityRestore: 'normal'  # Default is noisy 'Detailed'

          - task: DotNetCoreCLI@2
            displayName: Dotnet generate SBOM
            # https://sonarsource.atlassian.net/browse/BUILD-1303
            inputs:
              command: custom
              custom: CycloneDX
              projects: '$(SOLUTION)'
              arguments: '-t -j -o build'

          - task: DotNetCoreCLI@2
            env:
              SignAssembly: $(IS_RELEASE_BRANCH)
            condition: and(succeeded(), eq(variables.IS_RELEASE_BRANCH, 'true'))
            displayName: 'Build and prepare signing $(SOLUTION)'
            inputs:
              command: 'build'
              projects: '$(SOLUTION)'
              arguments: '/m /p:DeployExtension=false /p:ZipPackageCompressionLevel=normal /p:configuration=$(BUILD_CONFIGURATION) /p:platform="$(BUILD_PLATFORM)" /p:AssemblyOriginatorKeyFile="$(snk.secureFilePath)"'

          - task: DotNetCoreCLI@2
            condition: and(succeeded(), eq(variables.IS_RELEASE_BRANCH, 'false')) # This should run only on PRs (master and other release branches need signing)
            displayName: 'Build $(SOLUTION)'
            inputs:
              command: 'build'
              projects: '$(SOLUTION)'
              arguments: '/m /p:DeployExtension=false /p:ZipPackageCompressionLevel=normal /p:configuration=$(BUILD_CONFIGURATION) /p:platform="$(BUILD_PLATFORM)"'

          - task: PowerShell@2
            displayName: 'Sign and package scanner files'
            env:
              SM_CLIENT_CRT_FILE: $(SM_CLIENT_CRT.secureFilePath)
              SM_CLIENT_CERT_FILE: $(SM_CLIENT_CERT.secureFilePath)
              SM_CLIENT_CERT_PASSWORD: $(SM_CLIENT_CERT_PASSWORD)
              SM_API_KEY: $(SM_API_KEY)
              SM_CERT: $(SM_CERT)
            inputs:
              targetType: 'inline'
              script: |
                . (Join-Path "scripts" "package-artifacts.ps1")
                . (Join-Path "scripts" "variables.ps1")

                Download-ScannerCli

                $signAssemblies = [System.Convert]::ToBoolean("$(IS_RELEASE_BRANCH)") # the variable is a string, we need a boolean
                Package-NetFrameworkScanner -SignAssemblies $signAssemblies
                Package-NetScanner -SignAssemblies $signAssemblies

          - task: NuGetCommand@2
            displayName: 'Package dotnet global tool'
            inputs:
              command: 'pack'
              packagesToPack: 'nuspec\netcoreglobaltool\dotnet-sonarscanner.nuspec'
              packDestination: 'build'
              versioningScheme: 'off'

          - powershell: |
              nuget sign "$env:PACKAGES_PATH" -Overwrite -HashAlgorithm SHA256 -CertificateFingerprint $(SM_CERT_FP) -Timestamper http://timestamp.digicert.com -TimestampHashAlgorithm SHA256
            displayName: "Sign NuGet packages"
            condition: and(succeeded(), eq(variables.IS_RELEASE_BRANCH, 'true'))
            env:
              PACKAGES_PATH: '$(Build.SourcesDirectory)\build\dotnet-sonarscanner*.nupkg'
              SM_CLIENT_CERT_FILE: $(SM_CLIENT_CERT.secureFilePath)
              SM_CLIENT_CERT_PASSWORD: $(SM_CLIENT_CERT_PASSWORD)
              SM_API_KEY: $(SM_API_KEY)
              SM_CERT: $(SM_CERT)

          - powershell: |
              Add-Content build/version.txt $(SONAR_PROJECT_VERSION)
            displayName: 'Write project version in file'

          - task: DownloadSecureFile@1
            displayName: 'Download Maven settings'
            name: mavenSettings
            inputs:
              secureFile: 'maven-settings.xml'

          - powershell: |
              Install-Module -Name Pester -Force -SkipPublisherCheck # https://pester.dev/docs/introduction/installation#windows
              Invoke-Pester -Output Detailed -CI -Script .\scripts\generate-packages.tests.ps1
            displayName: 'Test package generation script'

          - powershell: |
              . .\scripts\generate-packages.ps1
              Run
            displayName: 'Generate packages'

          - task: Maven@3
            displayName: Promote new version in pom
            inputs:
              mavenPomFile: 'pom.xml'
              goals: 'org.codehaus.mojo:versions-maven-plugin:2.2:set'
              options: >-
                $(commonMavenArguments)
                -DnewVersion=$(SONAR_PROJECT_VERSION).$(Build.BuildId)
                --settings $(mavenSettings.secureFilePath)
                -DgenerateBackupPoms=false -e
              javaHomeOption: 'JDKVersion'
              mavenVersionOption: 'Default'
              jdkVersionOption: '1.17'
              mavenOptions: $(MAVEN_OPTS)

          - task: DownloadSecureFile@1
            displayName: 'Download the sign key'
            name: signKey
            inputs:
              secureFile: 'sign-key.asc'

          - task: Maven@3
            displayName: 'Stage to repox'
            env:
              PROJECT_VERSION: $(SONAR_PROJECT_VERSION)
              BUILD_ID: $(Build.BuildId)
              ARTIFACTORY_DEPLOY_PASSWORD: $(ARTIFACTORY_QA_DEPLOYER_ACCESS_TOKEN)
              PGP_SIGN_KEY_PATH: $(signKey.secureFilePath)
              PGP_PASSPHRASE: $(PGP_PASSPHRASE)
            inputs:
              goals: 'deploy'
              options: >-
                $(commonMavenArguments)
                --settings $(mavenSettings.secureFilePath)
                -Pdeploy-sonarsource,sign -e -V
              publishJUnitResults: false
              javaHomeOption: 'JDKVersion'
              jdkVersionOption: '1.17'
              mavenOptions: $(MAVEN_OPTS)

          - powershell: |
              $artifactsFolder = "$env:BUILD_SOURCESDIRECTORY\\build"
              Rename-Item -Path "$artifactsFolder\\sonarscanner-net-framework.zip" -NewName sonar-scanner-$(SONAR_PROJECT_VERSION).$(Build.BuildId)-net-framework.zip
              Rename-Item -Path "$artifactsFolder\\sonarscanner-net.zip" -NewName sonar-scanner-$(SONAR_PROJECT_VERSION).$(Build.BuildId)-net.zip
            displayName: "Rename artifacts for GitHub Release"

          - task: PublishPipelineArtifact@1
            displayName: 'Publish packages as artifacts'
            inputs:
              targetPath: 'build'
              artifact: 'build'

          - task: CmdLine@2
            displayName: Revert changes made to pom.xml to not break cache feature
            inputs:
              script: 'git checkout .'

  - stage: qa
    displayName: 'QA:'
    dependsOn: build
    jobs:
      - job: uts_analysis_mend
        displayName: 'Run UTs, SC analysis and Mend scan'
        steps:
          - script: nuget restore -LockedMode -ConfigFile "NuGet.Config" $(SOLUTION)
            displayName: "NuGet Restore"
            env:
              ARTIFACTORY_USER: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)

          - task: SonarCloudPrepare@3
            displayName: 'Code Analysis - Begin'
            inputs:
              SonarCloud: 'SonarCloud'
              organization: 'sonarsource'
              projectKey: 'sonarscanner-msbuild'
              projectName: 'SonarScanner for .NET'
              projectVersion: '$(SONAR_PROJECT_VERSION)'
              scannerMode: 'dotnet'
              extraProperties: |
                sonar.cs.opencover.reportsPaths="$(Build.SourcesDirectory)/coverage/**.xml"
                sonar.cs.vstest.reportsPaths="$(Build.SourcesDirectory)/TestResults/*.trx"

          - task: VSBuild@1
            displayName: "Build and analyze project"
            inputs:
              solution: '$(SOLUTION)'
              platform: '$(BUILD_PLATFORM)'
              configuration: '$(BUILD_CONFIGURATION)'

          - powershell: .\scripts\run-unit-tests.ps1 -sourcesDirectory "$(Build.SourcesDirectory)" -buildConfiguration "$(BUILD_CONFIGURATION)"
            displayName: 'Run UTs and compute coverage'
            env:
              ARTIFACTORY_USER: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)

          - task: PublishBuildArtifacts@1
            inputs:
              pathToPublish: $(Build.SourcesDirectory)\coverage\
              artifactName: CoverageReport

          - task: PowerShell@2
            displayName: 'Delete files created by unit tests'
            inputs:
              targetType: 'inline'
              script: |
                Get-ChildItem $(Agent.TempDirectory) -Filter 'dummy.*' -Recurse -Attributes !Directory | Remove-Item

          - task: SonarCloudAnalyze@3
            displayName: 'Code Analysis - End'

          - task: SonarCloudPublish@3
            displayName: 'Code Analysis - Publish QG'
            inputs:
              pollingTimeoutSec: '300'

          - powershell: .\scripts\Mend\Mend-Scan.ps1
            displayName: "Mend scan"
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')
            env:
              JAVA_HOME_11_X64: '$(JAVA_HOME_11_X64)'
              WS_PRODUCTNAME: '$(MEND_PRODUCTNAME)'
              WS_APIKEY: '$(WHITESOURCE_APIKEY)'
              ARTIFACTORY_USER: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)


      - job: its
        displayName: 'Run ITs'
        strategy:
          matrix:
            msbuild15_latest89:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[8.9]"
              SONAR_DOTNET_VERSION: '8.22.0.31243' # Boundled version with SQ 8.9
              SONAR_CFAMILYPLUGIN_VERSION: "6.20.5.49286"  # LATEST_RELEASE of CFAMILY is not compatible with old SQ
              MSBUILD_PATH: $(MSBUILD_15_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
            msbuild17_latest89:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[8.9]"
              SONAR_DOTNET_VERSION: '8.22.0.31243' # Boundled version with SQ 8.9
              SONAR_CFAMILYPLUGIN_VERSION: "6.20.5.49286"  # LATEST_RELEASE of CFAMILY is not compatible with old SQ
              MSBUILD_PATH: $(MSBUILD_17_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
            msbuild15_latest99:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[9.9]"
              SONAR_DOTNET_VERSION: '8.51.0.59060' # Boundled version with SQ 9.9
              SONAR_CFAMILYPLUGIN_VERSION: "6.41.0.60884"  # LATEST_RELEASE of CFAMILY is not compatible with old SQ
              MSBUILD_PATH: $(MSBUILD_15_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
            msbuild16_latest99:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[9.9]"
              SONAR_DOTNET_VERSION: '8.51.0.59060' # Boundled version with SQ 9.9
              SONAR_CFAMILYPLUGIN_VERSION: "6.41.0.60884"  # LATEST_RELEASE of CFAMILY is not compatible with old SQ
              MSBUILD_PATH: $(MSBUILD_16_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
            msbuild17_latest99:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[9.9]"
              SONAR_DOTNET_VERSION: '8.51.0.59060' # Boundled version with SQ 9.9
              SONAR_CFAMILYPLUGIN_VERSION: "6.41.0.60884" # LATEST_RELEASE of CFAMILY is not compatible with old SQ
              MSBUILD_PATH: $(MSBUILD_17_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
            msbuild17_latest:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE"
              SONAR_CFAMILYPLUGIN_VERSION: "LATEST_RELEASE"
              MSBUILD_PATH: $(MSBUILD_17_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
            msbuild17_dev:
              PRODUCT: "SonarQube"
              SQ_VERSION: "DEV"
              SONAR_CFAMILYPLUGIN_VERSION: "LATEST_RELEASE"
              MSBUILD_PATH: $(MSBUILD_17_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
            msbuild17_sonar_cloud:
              PRODUCT: "SonarCloud"
              SQ_VERSION: ""
              MSBUILD_PATH: $(MSBUILD_17_PATH)
              TEST_INCLUDE: "**/sonarcloud/*"
            others:
              PRODUCT: "others"
              SQ_VERSION: ""
              MSBUILD_PATH: ""
              TEST_INCLUDE: "**/others/*"
        variables:
          SONAR_DOTNET_VERSION: 'DEV'
          JDKVERSION: "1.17"
          PLATFORMTOOLSET: 'v140'
          WINDOWSSDKTARGET: '10.0.17763.0'
          MAVEN_CACHE_FOLDER: $(Pipeline.Workspace)/.m2/repository
          MAVEN_OPTS: '-Xmx3072m -Dmaven.repo.local=$(MAVEN_CACHE_FOLDER)'
        steps:
          - checkout: self
            fetchDepth: 1

          - task: Cache@2
            displayName: Cache Maven local repo
            inputs:
              key: maven | its/pom.xml
              path: $(MAVEN_CACHE_FOLDER)

          - task: DownloadSecureFile@1
            displayName: 'Download maven settings'
            name: mavenSettings
            inputs:
              secureFile: 'maven-settings.xml'

          - task: DownloadPipelineArtifact@2
            inputs:
              buildType: 'current'
              targetPath: '$(Build.SourcesDirectory)\build'
              artifactName: build

          - task: NuGetToolInstaller@1
            inputs:
              versionSpec: $(NUGET_VERSION)

          - powershell: |
              $projectVersion = Get-Content "$(Build.SourcesDirectory)\build\version.txt"
              Write-Host "##vso[task.setvariable variable=SONAR_PROJECT_VERSION]$projectVersion"
            displayName: "Get version from artifact file"

          - task: Maven@3
            displayName: 'Run Maven ITs for $(PRODUCT) $(SQ_VERSION)'
            env:
              ARTIFACTORY_USER: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)
              ARTIFACTORY_QA_READER_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)
              # For Orchestrator (https://github.com/SonarSource/orchestrator/commit/d5396c75ab77e6088afe58e61b0cd0693ac885f0)
              ARTIFACTORY_ACCESS_TOKEN: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)
              GITHUB_TOKEN: $(GITHUB_TOKEN)
              MAVEN_LOCAL_REPOSITORY: $(MAVEN_CACHE_FOLDER)
              NUGET_PATH: $(NUGETEXETOOLPATH)
              SONARCLOUD_PROJECT_TOKEN: $(SONARCLOUD_PROJECT_TOKEN) # This is a secret variable: it needs to be propagated to the job
            inputs:
              goals: 'verify'
              options: --settings $(mavenSettings.secureFilePath) -B -e -Denable-repo=qa -DtestInclude=$(TEST_INCLUDE) -Dsonar.cfamilyplugin.version=$(SONAR_CFAMILYPLUGIN_VERSION) -Dsonar.csharpplugin.version=$(SONAR_DOTNET_VERSION) -Dsonar.vbnetplugin.version=$(SONAR_DOTNET_VERSION) -Dsonar.runtimeVersion=$(SQ_VERSION) -DscannerForMSBuild.version=$(SONAR_PROJECT_VERSION).$(Build.BuildId) -Dmsbuild.path="$(MSBUILD_PATH)" -Dmsbuild.platformtoolset=$(PLATFORMTOOLSET) -Dmsbuild.windowssdk=$(WINDOWSSDKTARGET)
              publishJUnitResults: true
              mavenPomFile: 'its/pom.xml'
              testResultsFiles: '**/surefire-reports/TEST-*.xml'
              testRunTitle: 'ITs $(SQ_VERSION)'
              javaHomeOption: 'JDKVersion'
              jdkVersionOption: $(JDKVERSION)
              mavenOptions: $(MAVEN_OPTS)
              mavenVersionOption: 'Default'

          - bash: git checkout .
            name: revertPomChanges
            displayName: Revert changes made to pom.xml to not break cache feature

  - stage: artifacts
    displayName: 'Promote Artifacts:'
    dependsOn:
    - build
    - qa
    condition: and(succeeded(), or(eq(variables['Build.Reason'], 'PullRequest'), in(variables['Build.SourceBranchName'], 'main', 'master'), startsWith(replace(variables['Build.SourceBranch'], 'refs/heads/', ''), 'branch')))
    jobs:
    - job: promoteRepox
      displayName: Call repox
      steps:
      - checkout: none
      - task: JFrogBuildPromotion@1
        name: promoteRepoxCLI
        displayName: Promote build in Repox
        inputs:
          artifactoryConnection: repox_promoter_token
          buildName: sonar-scanner-msbuild
          buildNumber: $(Build.BuildId)
          ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
            targetRepo: 'sonarsource-public-dev'
            status: 'it-passed-pr'
          ${{ else }}:
            targetRepo: 'sonarsource-public-builds'
            status: 'it-passed'