throw more things at the wall

build/Helix/ProcessHelixFiles.ps1

@@ -20,13 +20,31 @@ function Generate-File-Links
         Out-File -FilePath $helixLinkFile -Append -InputObject "<ul>"
         foreach($file in $files)
         {
-            Out-File -FilePath $helixLinkFile -Append -InputObject "<li><a href=$($file.Link)>$($file.Name)</a></li>"
+            $url = Append-HelixAccessTokenToUrl $file.Link "{Your-Helix-Access-Token-Here}"
+            Out-File -FilePath $helixLinkFile -Append -InputObject "<li>$($url)</li>"
         }
         Out-File -FilePath $helixLinkFile -Append -InputObject "</ul>"
         Out-File -FilePath $helixLinkFile -Append -InputObject "</div>"
     }
 }
 
+function Append-HelixAccessTokenToUrl
+{
+    Param ([string]$url, [string]$token)
+    if($token)
+    {
+        if($url.Contains("?"))
+        {
+            $url = "$($url)&access_token=$($token)"
+        }
+        else
+        {
+            $url = "$($url)?access_token=$($token)"
+        }
+    }
+    return $url
+}
+
 #Create output directory
 New-Item $OutputFolder -ItemType Directory
 
@@ -63,7 +81,8 @@ foreach ($testRun in $testRuns.value)
         if (-not $workItems.Contains($workItem))
         {
             $workItems.Add($workItem)
-            $filesQueryUri = "https://helix.dot.net/api/2019-06-17/jobs/$helixJobId/workitems/$helixWorkItemName/files$accessTokenParam"
+            $filesQueryUri = "https://helix.dot.net/api/2019-06-17/jobs/$helixJobId/workitems/$helixWorkItemName/files"
+            $filesQueryUri = Append-HelixAccessTokenToUrl $filesQueryUri $helixAccessToken
             $files = Invoke-RestMethodWithRetries $filesQueryUri
 
             $screenShots = $files | where { $_.Name.EndsWith(".jpg") }
@@ -102,6 +121,7 @@ foreach ($testRun in $testRuns.value)
 
                     Write-Host "Downloading $link to $destination"
 
+                    $link = Append-HelixAccessTokenToUrl $link $HelixAccessToken
                     Download-FileWithRetries $link $destination
                 }
             }

build/pipelines/release.yml

@@ -4,7 +4,9 @@ pr: none
 
 pool: 
   name: WinDevPool-L
-  demands: ImageOverride -equals WinDevVS16-latest
+  demands: 
+   - ImageOverride -equals WinDevVS16-latest
+   - ImageVersionOverride -equals 2.0.0
 
 parameters:
   - name: branding
@@ -17,7 +19,7 @@ parameters:
   - name: buildTerminal
     displayName: "Build Windows Terminal MSIX"
     type: boolean
-    default: true
+    default: false
   - name: buildTerminalVPack
     displayName: "Build Windows Terminal VPack"
     type: boolean
@@ -29,7 +31,7 @@ parameters:
   - name: pgoBuildMode
     displayName: "PGO Build Mode"
     type: string
-    default: Optimize
+    default: None
     values:
       - Optimize
       - Instrument
@@ -43,8 +45,8 @@ parameters:
     type: object
     default:
       - x64
-      - x86
-      - arm64
+      # - x86
+      # - arm64
 
 variables:
   TerminalInternalPackageVersion: "0.0.7"
@@ -66,6 +68,7 @@ jobs:
             BuildPlatform: ${{ platform }}
   displayName: Build
   cancelTimeoutInMinutes: 1
+  condition: false
   steps:
   - checkout: self
     clean: true
@@ -265,6 +268,95 @@ jobs:
       IndexSources: false
       SymbolServerType: TeamServices
 
+- job: ComplianceTasks
+  displayName: Validate security and compliance
+  pool:
+     vmImage: 'windows-2019'
+  #dependsOn: Build
+  steps:
+  - checkout: self
+    fetchDepth: 1
+    clean: true
+    submodules: true
+    persistCredentials: True
+  - task: PkgESSetupBuild@12
+    displayName: 'Package ES - Setup Build'
+
+  - task: NuGetAuthenticate@0
+
+  # 1ES Component Governance onboarding (Detects open source components). See https://docs.opensource.microsoft.com/tools/cg.html
+  - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+    displayName: Component Detection
+    
+  # PREfast. See https://www.1eswiki.com/wiki/SDL_Native_Rules_Build_Task 
+  - task: securedevelopmentteam.vss-secure-development-tools.build-task-prefast.SDLNativeRules@2
+    displayName: 'Run the PREfast SDL Native Rules for MSBuild'
+    condition: succeededOrFailed()
+
+  # Copies output from PREfast SDL Native Rules task to expected location for consumption by PkgESSecComp
+  - task: CopyFiles@1
+    displayName: 'Copy PREfast xml files to SDLNativeRulesDir'
+    inputs:
+      SourceFolder: '$(Agent.BuildDirectory)'
+      Contents: |
+        **\*.nativecodeanalysis.xml
+      TargetFolder: '$(Agent.BuildDirectory)\_sdt\logs\SDLNativeRules'
+  - task: DownloadBuildArtifacts@0
+    displayName: Download Build Artifacts
+    inputs:
+      artifactName: appx-x64-Release
+      downloadPath: $(System.ArtifactsDirectory)
+      buildType: 'specific'
+      project: $(System.TeamProjectId)
+      pipeline: 70913
+      buildVersionToDownload: 'specific'
+      buildId: 37520569
+  - task: ExtractFiles@1
+    inputs:
+      archiveFilePatterns: '$(System.ArtifactsDirectory)\**\CascadiaPackage*.msix'
+      cleanDestinationFolder: true
+      overwriteExistingFiles: true
+      destinationFolder: $(Build.BinariesDirectory)
+  - task: ExtractFiles@1
+    inputs:
+      archiveFilePatterns: '$(System.ArtifactsDirectory)\**\CascadiaPackage*.appxsym'
+      cleanDestinationFolder: false
+      overwriteExistingFiles: true
+      destinationFolder: $(Build.BinariesDirectory)
+   # Set XES_SERIALPOSTBUILDREADY to run Security and Compliance task once per build
+  - powershell: Write-Host “##vso[task.setvariable variable=XES_SERIALPOSTBUILDREADY;]true”  
+    displayName: 'Set XES_SERIALPOSTBUILDREADY Vars'
+  - task: PkgESSecComp@10
+    displayName: 'Security and Compliance tasks'
+    inputs:
+      fileNewBugs: false
+      areaPath: 'OS\WDX\DXP\WinDev\Terminal'
+      teamProject: 'OS'
+      iterationPath: 'OS\Future'
+      bugTags: 'TerminalReleaseCompliance'
+      scanAll: true
+      errOnBugs: false
+      failOnStdErr: true
+      taskLogVerbosity: Diagnostic
+      secCompConfigFromTask: |
+        # Overrides default build sources directory
+        sourceTargetOverrideAll: $(Build.SourcesDirectory)
+        # Overrides default build binaries directory when "Scan all" option is specified
+        binariesTargetOverrideAll: $(Build.BinariesDirectory)
+  
+        # Set the tools to false if they should not run in the build
+        tools:
+            - toolName: CheckCFlags
+              enable: true
+            - toolName: CFGCheck
+              enable: true
+            - toolName: Policheck
+              enable: false
+            - toolName: CredScan
+              enable: false
+            - toolName: XFGCheck
+              enable: false
+
 - ${{ if eq(parameters.buildTerminal, true) }}:
   - job: BundleAndSign
     displayName: Create and sign AppX/MSIX bundles

build/pipelines/templates/helix-processtestresults-job.yml

@@ -22,6 +22,7 @@ jobs:
     condition: succeededOrFailed()
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+      HelixAccessToken: $(HelixApiAccessToken)
     inputs:
       targetType: filePath
       filePath: build\Helix\UpdateUnreliableTests.ps1
@@ -32,6 +33,7 @@ jobs:
     condition: succeededOrFailed()
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+      HelixAccessToken: $(HelixApiAccessToken)
     inputs:
       targetType: filePath
       filePath: build\Helix\OutputTestResults.ps1

build/pipelines/templates/helix-runtests-job.yml

@@ -15,6 +15,7 @@ parameters:
   # if 'useBuildOutputFromBuildId' is set, we will default to using a build from this pipeline:
   useBuildOutputFromPipeline: $(System.DefinitionId)
   openHelixTargetQueues: 'windows.10.amd64.client19h1.open.xaml'
+  closedHelixTargetQueues: 'windows.10.amd64.client19h1.xaml'
 
 jobs:
 - job: ${{ parameters.name }}
@@ -29,11 +30,11 @@ jobs:
     buildConfiguration: ${{ parameters.configuration }}
     buildPlatform: ${{ parameters.platform }}
     openHelixTargetQueues: ${{ parameters.openHelixTargetQueues }}
+    closedHelixTargetQueues: ${{ parameters.closedHelixTargetQueues }}
     artifactsDir: $(Build.SourcesDirectory)\Artifacts
     taefPath: $(Build.SourcesDirectory)\build\Helix\packages\Microsoft.Taef.10.60.210621002\build\Binaries\$(buildPlatform)
     helixCommonArgs: '/binaryLogger:$(Build.SourcesDirectory)/${{parameters.name}}.$(buildPlatform).$(buildConfiguration).binlog /p:HelixBuild=$(Build.BuildId).$(buildPlatform).$(buildConfiguration) /p:Platform=$(buildPlatform) /p:Configuration=$(buildConfiguration) /p:HelixType=${{parameters.helixType}} /p:TestSuite=${{parameters.testSuite}} /p:ProjFilesPath=$(Build.ArtifactStagingDirectory) /p:rerunPassesRequiredToAvoidFailure=${{parameters.rerunPassesRequiredToAvoidFailure}}'
 
-
   steps:
   - task: CmdLine@1
     displayName: 'Display build machine environment variables'
@@ -140,6 +141,7 @@ jobs:
 
   - task: DotNetCoreCLI@2
     displayName: 'Run tests in Helix (open queues)'
+    condition: and(succeeded(),eq(variables['System.CollectionUri'],'https://dev.azure.com/ms/'))
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
     inputs:
@@ -147,3 +149,15 @@ jobs:
       projects: build\Helix\RunTestsInHelix.proj
       custom: msbuild
       arguments: '$(helixCommonArgs) /p:IsExternal=true /p:Creator=Terminal /p:HelixTargetQueues=$(openHelixTargetQueues)'
+
+  - task: DotNetCoreCLI@2
+    displayName: 'Run tests in Helix (closed queues)'
+    condition: and(succeeded(),ne(variables['System.CollectionUri'],'https://dev.azure.com/ms/'))
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+      HelixAccessToken: $(HelixApiAccessToken)
+    inputs:
+      command: custom
+      projects: build\Helix\RunTestsInHelix.proj
+      custom: msbuild
+      arguments: '$(helixCommonArgs) /p:HelixTargetQueues=$(closedHelixTargetQueues)'

build/pipelines/templates/pgo-build-and-publish-nuget-job.yml

@@ -20,11 +20,15 @@ jobs:
     inputs:
       artifactName: ${{ parameters.pgoArtifact }}
       downloadPath: $(artifactsPath)
-  
-  - task: NuGetToolInstaller@0
-    displayName: 'Use NuGet 5.2.0'
+
+  - task: NuGetAuthenticate@0
     inputs:
-      versionSpec: 5.2.0
+      nuGetServiceConnections: 'Terminal Public Artifact Feed'
+
+  - task: NuGetToolInstaller@0
+    displayName: 'Use NuGet 5.8.0'
+    inputs:
+      versionSpec: 5.8.0
 
   - task: CopyFiles@2
     displayName: 'Copy pgd files to NuGet build directory'
@@ -58,5 +62,11 @@ jobs:
     displayName: 'NuGet push'
     inputs:
       command: push
-      publishVstsFeed: Terminal/TerminalDependencies
-      packagesToPush: $(Build.ArtifactStagingDirectory)/*.nupkg
+      nuGetFeedType: external
+      packagesToPush: $(Build.ArtifactStagingDirectory)/*.nupkg
+      # The actual URL and PAT for this feed is configured at
+      # https://microsoft.visualstudio.com/Dart/_settings/adminservices
+      # This is the name of that connection
+      publishFeedCredentials: 'Terminal Public Artifact Feed'
+      feedsToUse: config
+      nugetConfigPath: '$(Build.SourcesDirectory)/NuGet.config'