Copied Azure pipelines YAML files to psnext

.azure-pipelines/1es-entra-powershell-ci-build.yml

@@ -0,0 +1,79 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+name: $(BuildDefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
+trigger:
+  branches:
+    include:
+      - main
+pr: none
+parameters:
+  - name: Pack
+    type: boolean
+    default: true
+  - name: Sign
+    type: boolean
+    default: true
+resources:
+  repositories:
+  - repository: 1ESPipelineTemplates
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/heads/main
+variables:
+  - group: OData-ESRP-CodeSigning
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+  parameters:
+    pool:
+      name: MSSecurity-1ES-Build-Agents-Pool
+      image: MSSecurity-1ES-Windows-2022
+      os: windows
+    sdl:
+      sourceAnalysisPool:
+        name: MSSecurity-1ES-Build-Agents-Pool
+        image: MSSecurity-1ES-Windows-2022
+        os: windows
+      credscan:
+        suppressionsFile: $(Build.SourcesDirectory)\.config\CredScanSuppressions.json
+        outputFormat: pre
+        debugMode: false
+        batchSize: 16
+      psscriptanalyzer:
+        break: false
+        enabled: true
+    stages:
+    - stage: build
+      jobs:
+      - job: EntraPowerShellCIBuild
+        displayName: Entra PowerShell CI Build
+        timeoutInMinutes: 840
+        steps:
+          - template: .azure-pipelines/common-templates/install-tools.yml@self
+          - template: .azure-pipelines/common-templates/security-pre-checks.yml@self
+
+          - template: .azure-pipelines/generation-templates/generate-build-1es.yml@self
+            parameters:
+              Sign: ${{ parameters.Sign }}
+
+          - ${{ if and(eq(parameters.Pack, true), eq(parameters.Sign, true)) }}:
+              - template: .azure-pipelines/common-templates/esrp/codesign-nuget.yml@self
+                parameters:
+                  FolderPath: "$(Build.ArtifactStagingDirectory)"
+                  Pattern: "Microsoft.Entra.*.nupkg"
+              - task: 1ES.PublishBuildArtifacts@1
+                displayName: Publish Module Artifacts
+                inputs:
+                  PathtoPublish: $(Build.ArtifactStagingDirectory)
+                  ArtifactName: drop
+              - task: 1ES.PublishNuget@1
+                displayName: Publish NuGet to preview feed
+                inputs:
+                  useDotNetTask: false
+                  packagesToPush: $(Build.ArtifactStagingDirectory)/**/Microsoft.Entra.*.nupkg
+                  packageParentPath: '$(Build.ArtifactStagingDirectory)'
+                  publishVstsFeed: $(PROJECT_NAME)/$(PREVIEW_FEED_NAME)
+                  nuGetFeedType: internal
+                  allowPackageConflicts: true
+
+          - template: .azure-pipelines/common-templates/security-post-checks.yml@self

.azure-pipelines/1es-zt-powershell-pr.yml

@@ -0,0 +1,45 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+name: $(SourceBranchName)-PR-$(Date:yyyy-MM-dd)$(Rev:.r)
+
+trigger: none
+pr:
+  branches:
+    include:
+    - '*'
+
+resources:
+  repositories:
+  - repository: 1ESPipelineTemplates
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/heads/main
+
+variables:
+  - group: ZTPowerShell-variable-group
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+  parameters:
+    pool:
+      name: MSSecurity-1ES-Build-Agents-Pool
+      image: MSSecurity-1ES-Windows-2022
+      os: windows
+    sdl:
+      sourceAnalysisPool:
+        name: MSSecurity-1ES-Build-Agents-Pool
+        image: MSSecurity-1ES-Windows-2022
+        os: windows
+      psscriptanalyzer:
+        break: false
+        enabled: true
+    stages:
+    - stage: Build
+      jobs:
+      - job: ZTPowerShellPRBuild
+        displayName: ZT PowerShell PR Build
+        steps:
+          - template: .azure-pipelines/generation-templates/generate-build-1es.yml@self
+            parameters:
+              Sign: false
+

.azure-pipelines/1es-zt-powershell-release.yml

@@ -0,0 +1,64 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+name: $(BuildDefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
+trigger: none
+pr: none
+
+resources:
+  pipelines:
+  - pipeline: _1es-EntraPowerShell-CI
+    source: 1es-EntraPowerShell-CI
+  repositories:
+  - repository: 1ESPipelineTemplates
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/heads/main
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+  parameters:
+    pool:
+      name: MSSecurity-1ES-Build-Agents-Pool
+      image: MSSecurity-1ES-Windows-2022
+      os: windows
+    sdl:
+      sourceAnalysisPool:
+        name: MSSecurity-1ES-Build-Agents-Pool
+        image: MSSecurity-1ES-Windows-2022
+        os: windows
+    stages:
+    - stage: release
+      jobs:
+      - job: approval
+        displayName: Approval
+        pool: server
+        timeoutInMinutes: 720
+        templateContext:
+          type: releaseJob
+          isProduction: true
+        steps:
+        - task: ApprovalTask@1
+          inputs:
+            environment: Production
+            servicetreeguid: f3970205-d841-45de-8b2d-3a7d45846ae1
+
+      - job: release
+        dependsOn: approval
+        condition: succeeded('approval')
+        templateContext:
+          type: releaseJob
+          isProduction: true
+        steps:
+        - task: 1ES.DownloadPipelineArtifact@1
+          inputs:
+            pipeline: _1es-EntraPowerShell-CI
+            artifactName: drop
+            targetPath: '$(System.ArtifactsDirectory)/drop'
+        - task: 1ES.PublishNuget@1
+          displayName: Publish Nuget package
+          inputs:
+            useDotNetTask: false
+            packagesToPush: '$(System.ArtifactsDirectory)/drop/Microsoft.Entra*.nupkg'
+            packageParentPath: '$(System.ArtifactsDirectory)'
+            nuGetFeedType: external
+            publishFeedCredentials: EntraPowerShell_PSGallery

.azure-pipelines/common-templates/esrp/codesign-nuget.yml

@@ -0,0 +1,44 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+parameters:
+  - name: FolderPath
+    type: string
+    default: $(System.DefaultWorkingDirectory)
+  - name: Pattern
+    type: string
+    default: "*.nupkg"
+
+steps:
+  - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5 
+    displayName: 'NuGet CodeSigning' 
+    inputs: 
+      ConnectedServiceName: 'esrpsigning-ztassessment-wif'
+      AppRegistrationClientId: '$(EsrpAppRegistrationClientId)'
+      AppRegistrationTenantId: '$(EsrpAppRegistrationTenantId)'
+      AuthAKVName: $(EsrpAuthAKVName)
+      AuthCertName: $(EsrpAuthCertName)
+      AuthSignCertName: $(EsrpAuthSignCertName)
+      ServiceEndpointUrl: '$(EsrpServiceEndpointUrl)'
+      FolderPath: ${{ parameters.FolderPath }}
+      Pattern: ${{ parameters.Pattern }}
+      SessionTimeout: 90
+      MaxConcurrency: 25
+      signConfigTYpe: 'inlineSignParams'
+      inlineOperation: |
+        [
+            {
+                "keyCode": "CP-401405",
+                "operationSetCode": "NuGetSign",
+                "parameters": [ ],
+                "toolName": "sign",
+                "toolVersion": "1.0"
+            },
+            {
+                "keyCode": "CP-401405",
+                "operationSetCode": "NuGetVerify",
+                "parameters": [ ],
+                "toolName": "sign",
+                "toolVersion": "1.0"
+            }
+        ]

.azure-pipelines/common-templates/esrp/codesign.yml

@@ -0,0 +1,65 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+parameters:
+    - name: FolderPath
+      type: string
+      default: $(System.DefaultWorkingDirectory)
+    - name: Pattern
+      type: string
+      default: ".*.dll"
+
+steps:
+    - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5
+      displayName: ESRP DLL CodeSigning
+      inputs:
+        ConnectedServiceName: 'esrpsigning-ztassessment-wif' 
+        AppRegistrationClientId: '$(EsrpAppRegistrationClientId)'
+        AppRegistrationTenantId: '$(EsrpAppRegistrationTenantId)'
+        AuthAKVName: $(EsrpAuthAKVName)
+        AuthCertName: $(EsrpAuthCertName)
+        AuthSignCertName: $(EsrpAuthSignCertName)
+        ServiceEndpointUrl: '$(EsrpServiceEndpointUrl)'
+        FolderPath: ${{ parameters.FolderPath }}
+        Pattern: ${{ parameters.Pattern }}
+        SessionTimeout: 160
+        MaxConcurrency: 25
+        signConfigType: inlineSignParams
+        inlineOperation: |
+            [
+                {
+                    "keyCode": "CP-230012",
+                    "operationSetCode": "SigntoolSign",
+                    "parameters": [
+                        {
+                            "parameterName": "OpusName",
+                            "parameterValue": "Microsoft"
+                        },
+                        {
+                            "parameterName": "OpusInfo",
+                            "parameterValue": "http://www.microsoft.com"
+                        },
+                        {
+                            "parameterName": "FileDigest",
+                            "parameterValue": "/fd \"SHA256\""
+                        },
+                        {
+                            "parameterName": "PageHash",
+                            "parameterValue": "/NPH"
+                        },
+                        {
+                            "parameterName": "TimeStamp",
+                            "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+                        }
+                    ],
+                    "toolName": "sign",
+                    "toolVersion": "1.0"
+                },
+                {
+                    "keyCode": "CP-230012",
+                    "operationSetCode": "SigntoolVerify",
+                    "parameters": [],
+                    "toolName": "sign",
+                    "toolVersion": "1.0"
+                }
+            ]

.azure-pipelines/common-templates/install-tools.yml

@@ -0,0 +1,33 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+steps:
+  - task: UseDotNet@2
+    displayName: "Use .NET 2" # needed for ESRP signing
+    inputs:
+      version: 2.x
+
+  - task: UseDotNet@2
+    displayName: "Use .NET 8" # needed for ESRP v5 signing
+    inputs:
+      version: 8.x
+
+  - task: UseDotNet@2
+    displayName: Use .NET SDK
+    inputs:
+      debugMode: false
+      version: 7.x
+
+  - task: NuGetToolInstaller@1
+    displayName: Install Nuget
+
+  - task: NuGetAuthenticate@1
+
+  - task: PowerShell@2
+    displayName: Version Check
+    inputs:
+      targetType: inline
+      pwsh: true
+      script: |
+        Write-Output $PSVersionTable
+

.azure-pipelines/common-templates/security-post-checks.yml

@@ -0,0 +1,53 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+steps:
+  - task: CodesignValidation@0
+
+  - task: SdtReport@1
+    displayName: "Security Analysis Report"
+    continueOnError: true
+    condition: succeededOrFailed()
+    inputs:
+      AllTools: false
+      APIScan: false
+      BinSkim: false
+      BinSkimBreakOn: "WarningAbove"
+      CodesignValidation: true
+      CodesignValidationBreakOn: "WarningAbove"
+      CredScan: true
+      FortifySCA: false
+      FxCop: false
+      ModernCop: false
+      MSRD: false
+      PoliCheck: true
+      PoliCheckBreakOn: "Severity1"
+      RoslynAnalyzers: true
+      RoslynAnalyzersBreakOn: "WarningAbove"
+      SDLNativeRules: false
+      Semmle: false
+      TSLint: false
+      TSLintBreakOn: "WarningAbove"
+      ToolLogsNotFoundAction: "Standard"
+
+  - task: PublishSecurityAnalysisLogs@3
+    displayName: "Publish Security Analysis Logs"
+    inputs:
+      ArtifactName: "CodeAnalysisLogs"
+      ArtifactType: "Container"
+      AllTools: false
+      AntiMalware: false
+      APIScan: false
+      BinSkim: false
+      CodesignValidation: true
+      CredScan: true
+      FortifySCA: false
+      FxCop: false
+      ModernCop: true
+      MSRD: false
+      PoliCheck: true
+      RoslynAnalyzers: true
+      SDLNativeRules: false
+      Semmle: false
+      TSLint: false
+      WebScout: false
+      ToolLogsNotFoundAction: "Standard"