Updating the publish pipelines for NPM packages

common/config/azure-pipelines/esrp-publish-rush.yaml

@@ -0,0 +1,70 @@
+# Pipeline: rushstack-esrp-publish-rush (AzDO project GitHubProjectsPublish)
+# Trigger: Automatically when a version bump PR from the Rush bump pipeline (definition 12) merges to main.
+# Purpose: Publish the tarballs packed by that bump pipeline run to the npm feed via ESRP.
+
+trigger:
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - '**/CHANGELOG.md'
+      - 'common/config/rush/version-policies.json'
+
+pr: none
+
+parameters:
+  - name: publishToNpmFeed
+    displayName: 'Publish to npm feed'
+    type: boolean
+    default: true
+  - name: NpmTag
+    displayName: 'NPM dist-tag'
+    type: string
+    default: latest
+  - name: DryRun
+    displayName: 'Dry run'
+    type: boolean
+    default: false
+  - name: CommitShaOverride
+    displayName: 'Commit SHA Override (for testing)'
+    type: string
+    default: ''
+
+variables:
+  - name: FORCE_COLOR
+    value: 1
+  - name: PackagesPath
+    value: $(Pipeline.Workspace)/packages
+
+resources:
+  repositories:
+    - repository: 1esPipelines
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+    - repository: publishConfig
+      type: git
+      name: GitHubProjectsPublish/GitHubProjectsPublish
+      ref: refs/heads/main
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    settings:
+      networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny
+    pool:
+      name: Azure-Pipelines-1ESPT-ExDShared
+      os: windows
+    stages:
+      - template: /common/config/azure-pipelines/templates/esrp-publish-stages.yaml@self
+        parameters:
+          # https://dev.azure.com/RushStack/GitHubProjects/_build?definitionId=12
+          BumpPipelineId: 12
+          BumpPipelineProject: GitHubProjects
+          StageNameSuffix: Rush
+          DisplayNameSuffix: Rush
+          PublishToNpmFeed: ${{ parameters.publishToNpmFeed }}
+          NpmTag: ${{ parameters.NpmTag }}
+          DryRun: ${{ parameters.DryRun }}
+          CommitShaOverride: ${{ parameters.CommitShaOverride }}

common/config/azure-pipelines/esrp-publish-rushstack.yaml

@@ -0,0 +1,70 @@
+# Pipeline: rushstack-esrp-publish (AzDO project GitHubProjectsPublish)
+# Trigger: Automatically when a version bump PR from the non-Rush bump pipeline (definition 10) merges to main.
+# Purpose: Publish the tarballs packed by that bump pipeline run to the npm feed via ESRP.
+
+trigger:
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - '**/CHANGELOG.md'
+      - 'common/config/rush/version-policies.json'
+
+pr: none
+
+parameters:
+  - name: publishToNpmFeed
+    displayName: 'Publish to npm feed'
+    type: boolean
+    default: true
+  - name: NpmTag
+    displayName: 'NPM dist-tag'
+    type: string
+    default: latest
+  - name: DryRun
+    displayName: 'Dry run'
+    type: boolean
+    default: false
+  - name: CommitShaOverride
+    displayName: 'Commit SHA Override (for testing)'
+    type: string
+    default: ''
+
+variables:
+  - name: FORCE_COLOR
+    value: 1
+  - name: PackagesPath
+    value: $(Pipeline.Workspace)/packages
+
+resources:
+  repositories:
+    - repository: 1esPipelines
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+    - repository: publishConfig
+      type: git
+      name: GitHubProjectsPublish/GitHubProjectsPublish
+      ref: refs/heads/main
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    settings:
+      networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny
+    pool:
+      name: Azure-Pipelines-1ESPT-ExDShared
+      os: windows
+    stages:
+      - template: /common/config/azure-pipelines/templates/esrp-publish-stages.yaml@self
+        parameters:
+          # https://dev.azure.com/RushStack/GitHubProjects/_build?definitionId=10
+          BumpPipelineId: 10
+          BumpPipelineProject: GitHubProjects
+          StageNameSuffix: Rushstack
+          DisplayNameSuffix: Rushstack
+          PublishToNpmFeed: ${{ parameters.publishToNpmFeed }}
+          NpmTag: ${{ parameters.NpmTag }}
+          DryRun: ${{ parameters.DryRun }}
+          CommitShaOverride: ${{ parameters.CommitShaOverride }}

common/config/azure-pipelines/npm-post-publish.yaml

@@ -10,22 +10,24 @@ variables:
   - name: FORCE_COLOR
     value: 1
 
-# This pipeline is triggered only by pipeline resources (npm publish pipelines),
+# This pipeline is triggered only by pipeline resources (esrp publish pipelines),
 # not by CI pushes or PR builds.
 trigger: none
 pr: none
 
 resources:
   pipelines:
-    - pipeline: npmPublish
-      source: 'rushstack NPM Publish'
+    - pipeline: esrpPublishRushstack
+      source: 'rushstack-esrp-publish'
+      project: GitHubProjectsPublish
       trigger:
         enabled: true
         branches:
           include:
             - refs/heads/main
-    - pipeline: npmPublishRush
-      source: 'rushstack NPM Publish (rush)'
+    - pipeline: esrpPublishRush
+      source: 'rushstack-esrp-publish-rush'
+      project: GitHubProjectsPublish
       trigger:
         enabled: true
         branches:
@@ -45,6 +47,8 @@ resources:
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
   parameters:
+    settings:
+      networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny
     sdl:
       sourceRepositoriesToScan:
         exclude:
@@ -222,8 +226,8 @@ extends:
                 displayName: 'Download API review files'
                 inputs:
                   source: specific
-                  project: GitHubProjects
-                  pipeline: 'rushstack NPM Publish'
+                  project: GitHubProjectsPublish
+                  pipeline: 'rushstack-esrp-publish'
                   preferTriggeringPipeline: true
                   runVersion: latest
                   artifact: api

common/config/azure-pipelines/npm-publish-rush.yaml

@@ -1,82 +1,54 @@
-parameters:
-  - name: publishToNpmFeed
-    displayName: 'Publish to npm feed'
-    type: boolean
-    default: true
-
-variables:
-  - name: FORCE_COLOR
-    value: 1
-  - name: SourceBranch
-    value: $[ replace(replace(resources.repositories.self.ref, 'refs/heads/', ''), 'refs/pull/', 'refs/remotes/pull/') ]
-
-resources:
-  repositories:
-    - repository: 1esPipelines
-      type: git
-      name: 1ESPipelineTemplates/1ESPipelineTemplates
-      ref: refs/tags/release
-
-extends:
-  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
-  parameters:
-    pool:
-      name: Azure-Pipelines-1ESPT-ExDShared
-      os: windows
-    stages:
-      - stage:
-        jobs:
-          - job:
-            pool:
-              name: publish-rushstack
-              os: linux
-            templateContext:
-              outputParentDirectory: $(Build.ArtifactStagingDirectory)
-              outputs:
-                - output: pipelineArtifact
-                  targetPath: $(Build.ArtifactStagingDirectory)/published-versions
-                  artifactName: published-versions
-                - output: pipelineArtifact
-                  targetPath: $(Build.ArtifactStagingDirectory)/json-schemas
-                  artifactName: json-schemas
-                - output: pipelineArtifact
-                  targetPath: $(Build.ArtifactStagingDirectory)/packages
-                  artifactName: packages
-                - output: pipelineArtifact
-                  targetPath: $(Build.ArtifactStagingDirectory)/api
-                  artifactName: api
-            steps:
-              - checkout: self
-                persistCredentials: true
-
-              - template: /common/config/azure-pipelines/templates/install-node.yaml@self
-
-              - template: /common/config/azure-pipelines/templates/build.yaml@self
-
-              - template: /common/config/azure-pipelines/templates/bump-versions.yaml@self
-                parameters:
-                  VersionPolicyName: noRush
-                  BranchName: $(SourceBranch)
-
-              - template: /common/config/azure-pipelines/templates/bump-versions.yaml@self
-                parameters:
-                  VersionPolicyName: rush
-                  BranchName: $(SourceBranch)
-
-              - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js'
-                displayName: 'Prepublish workaround for rush-lib'
-
-              - template: /common/config/azure-pipelines/templates/pack.yaml@self
-
-              - ${{ if eq(parameters.publishToNpmFeed, true) }}:
-                  - template: /common/config/azure-pipelines/templates/publish.yaml@self
-                    parameters:
-                      VersionPolicyName: noRush
-                      BranchName: $(SourceBranch)
-
-                  - template: /common/config/azure-pipelines/templates/publish.yaml@self
-                    parameters:
-                      VersionPolicyName: rush
-                      BranchName: $(SourceBranch)
-
-              - template: /common/config/azure-pipelines/templates/post-publish.yaml@self
+# Pipeline: Bump Versions (Rush) -- AzDO definition 12 in the GitHubProjects project
+# Trigger: Automatically when changes merge to main that include change files or pipeline YAML.
+# Purpose: Bump versions for the "rush" version policy, build, pack, create/update GitHub PR.
+#          The packed tarballs are published by the "esrp-publish-rush.yaml" pipeline once the
+#          resulting version bump PR is merged.
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - 'common/changes/*'
+      - 'common/config/rush/version-policies.json'
+      - 'common/config/azure-pipelines/**'
+
+pr: none
+
+variables:
+  - name: FORCE_COLOR
+    value: 1
+  - name: BaseBranch
+    value: $[ replace(variables['Build.SourceBranch'], 'refs/heads/', '') ]
+
+resources:
+  repositories:
+    - repository: 1esPipelines
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    settings:
+      networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny
+    pool:
+      name: Azure-Pipelines-1ESPT-ExDShared
+      os: windows
+    stages:
+      - template: /common/config/azure-pipelines/templates/bump-versions-stages.yaml@self
+        parameters:
+          VersionPolicyName: rush
+          StageName: BumpRushVersions
+          StageDisplayName: 'Bump Rush Versions and Create PR'
+          FeatureBranch: 'automated/bump-versions-rush'
+          PrTitle: 'Bump Rush package versions'
+          PrDescription: |
+            Automated version bump generated by Azure DevOps Pipeline.
+
+            This PR contains version bumps for the "rush" version policy.
+
+            **Pipeline Run:** $(System.CollectionUri)$(System.TeamProject)/_build/results?buildId=$(Build.BuildId)