1es-pipeline-linux.yml

trigger: none

# The `resources` specify the location and version of the 1ES PT.
resources:
  repositories:
    - repository: 1esPipelines
      type: git
      name: 1ESPipelineTemplates/1ESPipelineTemplates
      ref: refs/tags/release

parameters:
  - name: nodeVersion
    type: string
    default: 20.x
  - name: goVersion
    type: string
    default: 1.26.3

extends:
  # The pipeline extends the 1ES PT which will inject different SDL and compliance tasks.
  # For non-production pipelines, use "Unofficial" as defined below.
  # For productions pipelines, use "Official".
  template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines
  parameters:
    # Update the pool with your team's 1ES hosted pool.
    # Update the pool with your team's 1ES hosted pool.
    pool:
      name: staging-pool-amd64-mariner-2
      image: 1es-azlinux-3-amd64-custom-disk
      os: linux
      hostArchitecture: amd64
    sdl:
      sourceAnalysisPool:
        name: staging-pool-amd64-mariner-2
        image: azcu-agent-amd64-windows-22-img
        os: windows
        hostArchitecture: amd64
      git:
        submodules: false
        longpaths: true

    stages:
      - stage: Stage
        jobs:
          - job: HostJob
            # If the pipeline publishes artifacts, use `templateContext` to define the artifacts.
            # This will enable 1ES PT to run SDL analysis tools on the artifacts and then upload them.
            templateContext:
              outputs:
              - output: pipelineArtifact
                targetPath: $(Pipeline.Workspace)/aks-desktop-deb-unsigned
                artifactName: aks-desktop-signed
            # # Define the steps that the pipeline will run.
            # # In most cases, copy and paste the steps from the original pipeline.
            steps:
              - task: GoTool@0
                displayName: Install Go
                retryCountOnTaskFailure: 3
                inputs:
                  version: ${{ parameters.goVersion }}
              # FIX: Install .NET SDK early (required for ESRP Code Signing)
              # Changed from "runtime" to "sdk" and added version specification
              - task: UseDotNet@2
                displayName: Install .NET SDK (required for ESRP signing)
                inputs:
                  packageType: "sdk"
                  version: "6.x" # Use 6.x or 8.x depending on ESRP requirement
              # TODO: Remove debug logging after pipeline is stable
              - bash: |
                  echo "=== GO INSTALLATION DEBUG ==="
                  echo "Go version requested: ${{ parameters.goVersion }}"
                  go version || echo "Go not found in PATH"
                  echo "GOROOT: $GOROOT"
                  echo "GOPATH: $GOPATH"
                  echo "PATH: $PATH"
                  echo "=== END GO DEBUG ==="
                displayName: "Debug: Go Installation"
              - task: NodeTool@0
                displayName: Install Node.js
                retryCountOnTaskFailure: 3
                inputs:
                  versionSpec: ${{ parameters.nodeVersion }}
              # TODO: Remove debug logging after pipeline is stable
              - bash: |
                  echo "=== NODE.JS INSTALLATION DEBUG ==="
                  echo "Node version requested: ${{ parameters.nodeVersion }}"
                  node --version || echo "Node not found in PATH"
                  npm --version || echo "NPM not found in PATH"
                  echo "NODE_PATH: $NODE_PATH"
                  echo "PATH: $PATH"
                  echo "=== END NODE.JS DEBUG ==="
                displayName: "Debug: Node.js Installation"
              - checkout: self
                submodules: recursive
              # TODO: Remove debug logging after pipeline is stable
              - bash: |
                  echo "=== CHECKOUT DEBUG ==="
                  echo "Current working directory: $(pwd)"
                  echo "Repository contents:"
                  ls -la
                  echo "Submodules status:"
                  git submodule status || echo "No submodules or git not available"
                  echo "Git branch:"
                  git branch -a || echo "Git not available"
                  echo "Git commit:"
                  git log --oneline -1 || echo "Git not available"
                  echo "=== END CHECKOUT DEBUG ==="
                displayName: "Debug: Checkout"
              - bash: |
                  set -e
                  echo "=== INSTALL MAKE START ==="
                  if command -v make >/dev/null 2>&1; then
                    echo "make is already installed, skipping install."
                  else
                    echo "make not found, installing via tdnf..."
                    if [ "$(id -u)" -eq 0 ]; then
                      tdnf install -y make
                    else
                      sudo -n tdnf install -y make
                    fi
                    echo "make installed successfully."
                  fi

                  echo "make version:"
                  make --version | head -n 1
                  echo "=== INSTALL MAKE END ==="
                displayName: "Install make build tool"
              - bash: |
                  set -e
                  echo "=== INSTALL BINUTILS START ==="
                  if command -v ld >/dev/null 2>&1; then
                    echo "binutils is already installed, skipping install."
                  else
                    echo "binutils not found, installing via tdnf..."
                    if [ "$(id -u)" -eq 0 ]; then
                      tdnf install -y binutils
                    else
                      sudo -n tdnf install -y binutils
                    fi
                    echo "binutils installed successfully."
                  fi

                  echo "binutils version:"
                  ld --version | head -n 1
                  echo "=== INSTALL BINUTILS END ==="
                displayName: "Install binutils"
              # Build the Windows application
              - bash: |
                  echo "=== BUILD DEBUG START ==="
                  echo "Current working directory: $(pwd)"
                  echo "Node version: $(node --version)"
                  echo "NPM version: $(npm --version)"
                  echo "Go version: $(go version)"
                  echo "Package.json exists: $([ -f package.json ] && echo 'YES' || echo 'NO')"
                  echo "NPM scripts available:"
                  npm run 2>/dev/null | grep -E "build|win" || echo "No build scripts found"
                  echo "=== BUILD DEBUG END ==="

                  # Fix Go proxy configuration - override any problematic ADO settings
                  export GOPROXY="https://proxy.golang.org,direct"
                  export GOSUMDB="sum.golang.org"
                  export GONOPROXY=""
                  export GOPRIVATE=""
                  # Clear any proxy environment variables that might interfere
                  unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy NO_PROXY no_proxy

                  echo "=== GO ENVIRONMENT ==="
                  echo "GOPROXY=$GOPROXY"
                  echo "GOSUMDB=$GOSUMDB"
                  go env | grep -E "GOPROXY|GOSUMDB|PROXY"
                  echo "=== END GO ENVIRONMENT ==="

                  echo "Building AKS desktop Linux application..."
                  npm run build:linux
                  echo "✅ Build complete"

                  echo "=== POST-BUILD DEBUG ==="
                  echo "Checking for build outputs..."
                  find . -name "*.deb" -type f 2>/dev/null || echo "No .deb files found"
                  echo "headlamp/app/dist contents:"
                  ls -la headlamp/app/dist/ 2>/dev/null || echo "headlamp/app/dist not found"
                  echo "=== END POST-BUILD DEBUG ==="
                displayName: "Build AKS desktop (Linux)"

              # Find and copy the built executable to workspace dir
              - bash: |
                  set -e  # fail on error
                  echo "=== COPY EXECUTABLE DEBUG START ==="
                  echo "Current working directory: $(pwd)"
                  echo "Pipeline workspace: $(Pipeline.Workspace)"
                  echo "Searching for aks-desktop*.deb and *.tar.gz files..."

                  # TODO: Remove debug logging after pipeline is stable
                  echo "All .deb files in current directory:"
                  find . -name "*.deb" -type f 2>/dev/null || echo "No .deb files found"

                  echo "All .tar.gz files in current directory:"
                  find . -name "*.tar.gz" -type f 2>/dev/null || echo "No .tar.gz files found"

                  echo "headlamp/app/dist directory contents:"
                  ls -la headlamp/app/dist/ 2>/dev/null || echo "headlamp/app/dist directory not found"

                  echo "=== COPY EXECUTABLE DEBUG END ==="

                  echo "Finding built .deb file..."
                  DEB_PATH=$(find headlamp/app/dist -type f -name "aks-desktop*.deb" -print -quit)

                  if [ -z "$DEB_PATH" ]; then
                    echo "❌ No aks-desktop .deb file found in headlamp/app/dist!" >&2
                    echo "Listing headlamp/app/dist contents:"
                    ls -la headlamp/app/dist/ || echo "headlamp/app/dist directory not found"
                    exit 1
                  fi

                  echo "✅ Found: $DEB_PATH"
                  echo "File size: $(ls -lh "$DEB_PATH" | awk '{print $5}')"
                  echo "File permissions: $(ls -la "$DEB_PATH")"

                  echo "Finding built .tar.gz files..."
                  TARGZ_FILES=$(find headlamp/app/dist -type f -name "aks-desktop*.tar.gz" 2>/dev/null || true)

                  if [ -z "$TARGZ_FILES" ]; then
                    echo "No aks-desktop .tar.gz files found in headlamp/app/dist"
                  else
                    echo "Found tar.gz files:"
                    echo "$TARGZ_FILES" | while read -r file; do
                      echo "  - $file ($(ls -lh "$file" | awk '{print $5}'))"
                    done
                  fi

                  mkdir -p "$(Pipeline.Workspace)/aks-desktop-deb-unsigned"
                  cp "$DEB_PATH" "$(Pipeline.Workspace)/aks-desktop-deb-unsigned/"
                  echo "Copied .deb to $(Pipeline.Workspace)/aks-desktop-deb-unsigned/"

                  # Copy tar.gz files to unsigned folder (they don't need signing, pattern is *.deb)
                  if [ -n "$TARGZ_FILES" ]; then
                    for file in $TARGZ_FILES; do
                      cp "$file" "$(Pipeline.Workspace)/aks-desktop-deb-unsigned/"
                      echo "Copied $(basename "$file") to $(Pipeline.Workspace)/aks-desktop-deb-unsigned/"
                    done
                  fi

                  # TODO: Remove debug logging after pipeline is stable
                  echo "Verifying copy:"
                  ls -la "$(Pipeline.Workspace)/aks-desktop-deb-unsigned/"
                displayName: "Copy built DEB and tar.gz files to workspace directory"

              # Verify contents in workspace directory
              - bash: |
                  echo "=== VERIFICATION DEBUG START ==="
                  echo "Pipeline workspace: $(Pipeline.Workspace)"
                  echo "Target directory: $(Pipeline.Workspace)/aks-desktop-deb-unsigned"

                  # TODO: Remove debug logging after pipeline is stable
                  echo "Directory exists: $([ -d "$(Pipeline.Workspace)/aks-desktop-deb-unsigned" ] && echo 'YES' || echo 'NO')"
                  echo "Directory permissions:"
                  ls -ld "$(Pipeline.Workspace)/aks-desktop-deb-unsigned" 2>/dev/null || echo "Directory not found"

                  echo "Listing workspace directory contents..."
                  ls -la "$(Pipeline.Workspace)/aks-desktop-deb-unsigned"

                  echo "File count: $(find "$(Pipeline.Workspace)/aks-desktop-deb-unsigned" -type f | wc -l)"
                  echo "Total size: $(du -sh "$(Pipeline.Workspace)/aks-desktop-deb-unsigned" 2>/dev/null || echo 'Unable to calculate size')"

                  echo "=== VERIFICATION DEBUG END ==="
                displayName: "List the unsigned dir"

              # TODO: Remove debug logging after pipeline is stable
              - bash: |
                  echo "=== SIGNING DEBUG START ==="
                  echo "About to start ESRP code signing..."
                  echo "Target folder: $(Pipeline.Workspace)/aks-desktop-deb-unsigned"
                  echo "Pattern: *.deb"
                  echo "Files to be signed:"
                  find "$(Pipeline.Workspace)/aks-desktop-deb-unsigned" -name "*.deb" -type f || echo "No .deb files found"
                  echo "ESRP Service: ESRP-AME-AZCU"
                  echo "Key Vault: upstreamci-ado"
                  echo "Certificate: azcu-ersp-corp"
                  echo "=== SIGNING DEBUG END ==="
                displayName: "Debug: Pre-Signing"
              - task: EsrpCodeSigning@5
                displayName: "ESRP CodeSigning"
                condition: succeeded()
                inputs:
                  ConnectedServiceName: "ESRP-AME-AZCU"
                  UseMSIAuthentication: true
                  AppRegistrationClientId: "70ebf75b-d46f-46da-90e6-1fa654251514"
                  AppRegistrationTenantId: "33e01921-4d64-4f8c-a055-5bdaffd5e33d"
                  EsrpClientId: "150f8d2b-ad88-4a27-b782-c9bc3b028430"
                  ServiceEndpointUrl: 'https://api.esrp.microsoft.com/api/v2'
                  AuthAKVName: "upstreamci-ado"
                  AuthSignCertName: 'azcu-ersp-corp'
                  FolderPath: "$(Pipeline.Workspace)/aks-desktop-deb-unsigned"
                  Pattern: "*.deb"
                  signConfigType: inlineSignParams
                  inlineOperation: |
                    [
                        {
                            "KeyCode" : "CP-450779-Pgp",
                            "OperationCode" : "LinuxSign",
                            "Parameters" : {},
                            "ToolName" : "sign",
                            "ToolVersion" : "1.0"
                        }
                    ]
              # TODO: Remove debug logging after pipeline is stable
              - bash: |
                  echo "=== POST-SIGNING DEBUG START ==="
                  echo "Signing completed, verifying results..."
                  echo "Signed files in workspace:"
                  find "$(Pipeline.Workspace)/aks-desktop-deb-unsigned" -name "*.deb" -type f || echo "No .deb files found"

                  # Check if files are actually signed (this is a basic check)
                  for deb_file in "$(Pipeline.Workspace)/aks-desktop-deb-unsigned"/*.deb; do
                    if [ -f "$deb_file" ]; then
                      echo "File: $deb_file"
                      echo "Size: $(ls -lh "$deb_file" | awk '{print $5}')"
                      echo "Permissions: $(ls -la "$deb_file")"
                    fi
                  done

                  echo "Pipeline workspace contents:"
                  ls -la "$(Pipeline.Workspace)/"
                  echo "=== POST-SIGNING DEBUG END ==="
                displayName: "Debug: Post-Signing"
                condition: succeeded()

              # TODO: Remove debug logging after pipeline is stable
              - bash: |
                  echo "=== ARTIFACT PUBLISHING DEBUG ==="
                  echo "Artifact will be published via 1ES templateContext:"
                  echo "Artifact name: aks-desktop-signed"
                  echo "Source path: $(Pipeline.Workspace)/aks-desktop-deb-unsigned"
                  echo "Artifact contents:"
                  ls -la "$(Pipeline.Workspace)/aks-desktop-deb-unsigned/"
                  echo "Artifact size: $(du -sh "$(Pipeline.Workspace)/aks-desktop-deb-unsigned" 2>/dev/null || echo 'Unable to calculate')"
                  echo "Note: 1ES template will handle the actual artifact publishing"
                  echo "=== END ARTIFACT DEBUG ==="
                displayName: "Debug: Artifact Publishing"
                condition: succeeded()