@@ -16,31 +16,31 @@ parameters:
1616 type : string
1717 default : $(Agent.TempDirectory)/MicroBuild
1818
19- # Name of the pipeline variable to set with the signing env file path.
20- # When set, a signing env file is written after plugin installation and
21- # the specified pipeline variable is set to its path via logging directive,
22- # allowing downstream steps to reference it as $(variableName).
23- # When empty, no env file is created (non-signing jobs).
24- - name : envFileVariableName
19+ # Name of the pipeline variable to set with the signing docker run options.
20+ # The variable will contain both the MicroBuild plugin volume mount and
21+ # the --env-file flag, ready to pass as extraDockerRunOptions to run-imagebuilder.
22+ - name : dockerRunOptionsVariableName
2523 type : string
26- default : " "
2724
2825steps :
29- # Install .NET SDK on Linux - needed to download the MicroBuild plugin nupkgs when nuget.exe is unavailable.
30- # Install to an isolated location so the repo's global.json doesn't interfere.
31- - task : UseDotNet@2
26+ # Install .NET 8.0 SDK for MicroBuild plugin installation using dotnet-install.sh.
27+ # We avoid UseDotNet@2 because it sets DOTNET_ROOT globally, which breaks PowerShell
28+ # (pwsh) on Azure Linux 3 where pwsh requires the .NET 9.0 runtime from the system
29+ # .NET installation. Instead, we install to an isolated directory and only expose it
30+ # to the MicroBuild task via its env block.
31+ - powershell : >
32+ $(engDockerToolsPath)/Install-DotNetSdk.ps1
33+ -InstallPath "${{ parameters.microBuildOutputFolder }}/.dotnet"
34+ -Channel "8.0"
3235displayName : Install .NET SDK for MicroBuild Plugin
3336 condition : and(succeeded(), ${{ parameters.condition }})
34- inputs :
35- packageType : sdk
36- version : 8.0.x
37- installationPath : ${{ parameters.microBuildOutputFolder }}/.dotnet
3837
3938# Create a global.json in the MicroBuild folder that pins to the installed SDK.
40- # This prevents the repo's global.json from causing SDK resolution failures.
39+ # This prevents the repo's global.json from causing SDK resolution failures
40+ # when MicroBuild runs dotnet restore from this directory.
4141- script : |
4242 mkdir -p ${{ parameters.microBuildOutputFolder }}
43- version=$(dotnet --version)
43+ version=$(${{ parameters.microBuildOutputFolder }}/.dotnet/ dotnet --version)
4444 cat > ${{ parameters.microBuildOutputFolder }}/global.json << EOF
4545 {
4646 "sdk": {
@@ -69,56 +69,56 @@ steps:
6969 TeamName : $(TeamName)
7070 MicroBuildOutputFolderOverride : $(Agent.TempDirectory)/MicroBuild
7171 SYSTEM_ACCESSTOKEN : $(System.AccessToken)
72+ PATH : ${{ parameters.microBuildOutputFolder }}/.dotnet:$(PATH)
7273
73- # Configure ImageBuilder docker run options and write env file for signing.
74- # Sets imageBuilderDockerRunExtraOptions with the plugin volume mount and,
75- # when envFileVariableName is provided, writes a signing env file and sets
76- # the named pipeline variable to its path via logging directive.
77- - ${{ if ne(parameters.envFileVariableName, '') }} :
78- - task : PowerShell@2
79- displayName : Configure ImageBuilder Signing Options
80- condition : and(succeeded(), ${{ parameters.condition }})
81- inputs :
82- targetType : ' inline'
83- script : |
84- # Mount the MicroBuild signing plugin directory (contains DDSignFiles.dll and esrpcli.dll).
85- $imageBuilderDockerRunExtraOptions = "-v $env:MBSIGN_APPFOLDER`:/microbuild"
86- Write-Host "MicroBuild signing enabled, mounting $env:MBSIGN_APPFOLDER to /microbuild"
87- Write-Host "##vso[task.setvariable variable=imageBuilderDockerRunExtraOptions]$imageBuilderDockerRunExtraOptions"
74+ # Configure docker run options for signing.
75+ # Writes an env file with signing variables and sets $(signingDockerRunOptions)
76+ # with both the MicroBuild plugin volume mount and the --env-file flag.
77+ - task : PowerShell@2
78+ displayName : Configure ImageBuilder Signing Options
79+ condition : and(succeeded(), ${{ parameters.condition }})
80+ inputs :
81+ targetType : ' inline'
82+ script : |
83+ # Write the signing env file for docker --env-file.
84+ # Docker reads this file on the host before creating the container,
85+ # so no volume mount is needed for the file itself.
86+ $envFilePath = "$(Agent.TempDirectory)/imagebuilder-signing.env"
87+ $envFileContent = @(
88+ # MicroBuild plugin variables for DDSignFiles.dll
89+ "MBSIGN_APPFOLDER=/microbuild"
90+ "VSENGESRPSSL"
91+ "USEESRPCLI"
92+ "MBSIGN_CONNECTEDSERVICE"
8893
89- # Write the signing env file for docker --env-file.
90- # Docker reads this file on the host before creating the container,
91- # so no volume mount is needed for the file itself.
92- $envFilePath = "$(Agent.TempDirectory)/imagebuilder-signing.env"
93- $envFileContent = @(
94- # MicroBuild plugin variables for DDSignFiles.dll
95- "MBSIGN_APPFOLDER=/microbuild"
96- "VSENGESRPSSL"
97- "USEESRPCLI"
98- "MBSIGN_CONNECTEDSERVICE"
94+ # Container-local temp/workspace paths (host paths aren't accessible inside the container)
95+ "MBSIGNTEMPDIR=/tmp/MicroBuildSign"
96+ "PIPELINE_WORKSPACE=$(Build.ArtifactStagingDirectory)"
97+ "AGENT_TEMPDIRECTORY=/tmp"
9998
100- # Container-local temp/workspace paths (host paths aren't accessible inside the container)
101- "MBSIGNTEMPDIR=/tmp/MicroBuildSign"
102- "PIPELINE_WORKSPACE=$(Build.ArtifactStagingDirectory)"
103- "AGENT_TEMPDIRECTORY=/tmp"
99+ # Azure DevOps pipeline variables for ESRP bearer token auth (ESRPUtils.GetAccountInfo)
100+ "SYSTEM_TEAMFOUNDATIONCOLLECTIONURI"
101+ "BUILD_BUILDID"
102+ "SYSTEM_TEAMPROJECT"
103+ "BUILD_SOURCEBRANCH"
104104
105- # Azure DevOps pipeline variables for ESRP bearer token auth (ESRPUtils.GetAccountInfo)
106- "SYSTEM_TEAMFOUNDATIONCOLLECTIONURI"
107- "BUILD_BUILDID"
108- "SYSTEM_TEAMPROJECT"
109- "BUILD_SOURCEBRANCH"
105+ # Azure DevOps pipeline variables for ESRP CLI federated token (ESRPCliDll.GetFederatedTokenData)
106+ "SYSTEM_JOBID"
107+ "SYSTEM_PLANID"
108+ "SYSTEM_TEAMPROJECTID"
109+ "SYSTEM_HOSTTYPE"
110+ "SYSTEM_COLLECTIONURI"
110111
111- # Azure DevOps pipeline variables for ESRP CLI federated token (ESRPCliDll.GetFederatedTokenData)
112- "SYSTEM_JOBID"
113- "SYSTEM_PLANID"
114- "SYSTEM_TEAMPROJECTID"
115- "SYSTEM_HOSTTYPE"
116- "SYSTEM_COLLECTIONURI"
112+ # Azure DevOps pipeline variables for DDSignFilesConfiguration
113+ "BUILD_DEFINITIONNAME"
114+ "BUILD_BUILDNUMBER"
115+ )
117116
118- # Azure DevOps pipeline variables for DDSignFilesConfiguration
119- "BUILD_DEFINITIONNAME"
120- "BUILD_BUILDNUMBER"
121- )
117+ $envFileContent | Set-Content -Path $envFilePath -Encoding utf8NoBOM
122118
123- $envFileContent | Set-Content -Path $envFilePath -Encoding utf8NoBOM
124- Write-Host "##vso[task.setvariable variable=${{ parameters.envFileVariableName }}]$envFilePath"
119+ # Compose docker run options for signing:
120+ # - Volume mount for MicroBuild plugin directory (DDSignFiles.dll and esrpcli.dll)
121+ # - Env file with signing environment variables
122+ $signingDockerRunOptions = "-v $env:MBSIGN_APPFOLDER`:/microbuild --env-file `"$envFilePath`""
123+ Write-Host "signingDockerRunOptions: $signingDockerRunOptions"
124+ Write-Host "##vso[task.setvariable variable=${{ parameters.dockerRunOptionsVariableName }}]$signingDockerRunOptions"
0 commit comments