Migrate release pipelines to ESRP release (#3009)

* Migrate to 1ES pipeline template and ESRP release

* merge

* npm command

* pull script from pipeline artifacts

* prod pipeline

Author: jekloudaMSFT

tools/releases/prod-release.yml

@@ -1,74 +1,108 @@
 trigger: none
 resources:
   repositories:
-    - repository: GovernedTemplates
+    - repository: CustomPipelineTemplates
       type: git
-      name: OneBranch.Pipelines/GovernedTemplates
-      ref: refs/heads/main
+      name: 1ESPipelineTemplates/OfficePipelineTemplates
+      ref: refs/tags/release
   pipelines:
     - pipeline: microsoft-teams-library-js-pipeline
       source: 'microsoft-teams-library-js/M365 Platform/App SDK/OfficeDev.microsoft-teams-library-js'
       project: ISS
 extends:
-  template: v2/Microsoft.Official.yml@GovernedTemplates
+  template: v1/Office.Official.PipelineTemplate.yml@CustomPipelineTemplates
   parameters:
-    platform:
-      name: m365
-      workload: Substrate
-      serviceTreeId: $(serviceTreeId)
-      serviceGroupName: Platform
+    pool:
+      name: Azure-Pipelines-1ESPT-ExDShared
+      image: windows-latest
+      os: windows
+    serviceTreeId: $(serviceTreeId)
+    customBuildTags:
+      - ES365AIMigrationTooling-Release-MOBR
     stages:
       - stage: Prod_Lockbox_Approval_Deployment
         displayName: Lockbox Approval/Deployment
         dependsOn: []
-        variables:
-          stage_type: deployment
-          azure_subscription_ids: $(subscriptionId)
+        templateContext:
+          cloud: Public
+          isProduction: true
+          approval:
+            workflow: lockbox
+            scope:
+              serviceGroupName: Platform
+              subscriptionIds:
+                - $(subscriptionId)
         jobs:
           - job: Agent_job
             condition: or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'))
-            pool:
-              type: release
+            templateContext:
+              type: releaseJob
+              workflow: m365-custom
+              inputs:
+                - input: pipelineArtifact
+                  pipeline: microsoft-teams-library-js-pipeline
+                  artifactName: NPMFeed
+                  targetPath: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/NPMFeed
+                - input: pipelineArtifact
+                  pipeline: microsoft-teams-library-js-pipeline
+                  artifactName: CDNFeed
+                  targetPath: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/CDNFeed
+                - input: pipelineArtifact
+                  pipeline: microsoft-teams-library-js-pipeline
+                  artifactName: scripts
+                  targetPath: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/scripts
             steps:
-              - download: microsoft-teams-library-js-pipeline
               - task: prepare-deployment@1
-                displayName:
+                displayName: Prepare deployment
                 inputs:
                   taskType: credentialFetchTaskAzureRM
                   armserviceconnection: $(serviceConnectionId)
                   subscriptionid: $(subscriptionId)
-              - task: AzureKeyVault@2
-                displayName: 'Azure Key Vault: $(keyVaultName)'
+              - task: AssetRetention@3
+                displayName: ARtifact Retention Orchestrator Workflow (ARROW)
                 inputs:
-                  ConnectedServiceName: $(serviceConnectionId)
-                  KeyVaultName: $(keyVaultName)
-                  SecretsFilter: $(keyVaultSecretsFilter)
+                  ArrowServiceConnection: $(arrowServiceConnectionId)
+                  IsShipped: true
               - task: NodeTool@0
                 displayName: Use Node 18.x
                 inputs:
                   versionSpec: 18.x
-              - task: PowerShell@2
-                displayName: Update npmrc with NPM-TOKEN
-                inputs:
-                  targetType: 'filePath'
-                  filePath: 'tools/releases/powershell-commands/update-npmrc-with-npm-token.ps1'
-                  arguments: -PIPELINE_WORKSPACE $(PIPELINE.WORKSPACE) -NPM_TOKEN $(NPM-TOKEN)
               - task: Npm@1
-                displayName: Publish to npm (tag latest) KV
+                displayName: Build NPM package for release
                 inputs:
                   command: custom
-                  workingDir: $(PIPELINE.WORKSPACE)/microsoft-teams-library-js-pipeline/NPMFeed
+                  workingDir: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/NPMFeed
                   verbose: false
-                  customCommand: publish --tag latest
+                  customCommand: pack
+              - task: EsrpRelease@10
+                displayName: Publish to npm (tag beta) - ESRP release
+                inputs:
+                  connectedservicename: '$(connectedServiceName)'
+                  usemanagedidentity: true
+                  keyvaultname: '$(keyVaultName)'
+                  signcertname: '$(signCertName)'
+                  clientid: '$(clientId)'
+                  intent: 'PackageDistribution'
+                  contenttype: 'npm'
+                  contentsource: 'Folder'
+                  folderlocation: '$(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/NPMFeed'
+                  waitforreleasecompletion: true
+                  owners: $(owners)
+                  approvers: $(approvers)
+                  serviceendpointurl: '$(serviceEndpointUrl)'
+                  mainpublisher: '$(mainPublisher)'
+                  domaintenantid: '$(domainTenantId)'
+                  productstate: 'Latest'
               - task: M365CdnAssetsUpload@3
                 displayName: Push teams-js to M365 1CDN (Prod)
                 inputs:
-                  SourcePath: $(PIPELINE.WORKSPACE)/microsoft-teams-library-js-pipeline/CDNFeed/*
+                  SourcePath: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/CDNFeed/*
                   ConnectedServiceNameARM: $(serviceConnectionId)
                   ContainerName: teams-js
                   AdditionalArgumentsForBlobCopy: --overwrite=false --log-level=INFO --recursive
-              - task: AssetRetention@3
-                displayName: ARtifact Retention Orchestrator Workflow (ARROW)
+              - task: PowerShell@2
+                displayName: View Published Package URLs
                 inputs:
-                  ArrowServiceConnection: $(arrowServiceConnectionId)
-                  IsShipped: true
+                  targetType: 'filePath'
+                  filePath: 'microsoft-teams-library-js-pipeline/scripts/view-published-pkg-urls.ps1'
+                  arguments: -PIPELINE_WORKSPACE $(System.DefaultWorkingDirectory)

tools/releases/sdf-release.yml

@@ -1,10 +1,10 @@
 trigger: none
 resources:
   repositories:
-    - repository: GovernedTemplates
+    - repository: CustomPipelineTemplates
       type: git
-      name: OneBranch.Pipelines/GovernedTemplates
-      ref: refs/heads/main
+      name: 1ESPipelineTemplates/OfficePipelineTemplates
+      ref: refs/tags/release
   pipelines:
     - pipeline: microsoft-teams-library-js-pipeline
       source: 'microsoft-teams-library-js/M365 Platform/App SDK/OfficeDev.microsoft-teams-library-js'
@@ -13,28 +13,50 @@ variables:
   - name: System.Debug
     value: true
 extends:
-  template: v2/Microsoft.Official.yml@GovernedTemplates
+  template: v1/Office.Official.PipelineTemplate.yml@CustomPipelineTemplates
   parameters:
-    platform:
-      name: m365
-      workload: Substrate
-      serviceTreeId: $(serviceTreeId)
-      serviceGroupName: Platform
+    pool:
+      name: Azure-Pipelines-1ESPT-ExDShared
+      image: windows-latest
+      os: windows
+    serviceTreeId: $(serviceTreeId)
+    customBuildTags:
+      - ES365AIMigrationTooling-Release-MOBR
     stages:
       - stage: Prod_Lockbox_Approval_Deployment
         displayName: Lockbox Approval/Deployment
         dependsOn: []
-        variables:
-          stage_type: deployment
-          azure_subscription_ids: $(subscriptionId)
+        templateContext:
+          cloud: Public
+          isProduction: false
+          approval:
+            workflow: lockbox
+            scope:
+              serviceGroupName: Platform
+              subscriptionIds:
+                - $(subscriptionId)
         jobs:
           - job: Agent_job
-            pool:
-              type: release
+            templateContext:
+              type: releaseJob
+              workflow: m365-custom
+              inputs:
+                - input: pipelineArtifact
+                  pipeline: microsoft-teams-library-js-pipeline
+                  artifactName: NPMFeed
+                  targetPath: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/NPMFeed
+                - input: pipelineArtifact
+                  pipeline: microsoft-teams-library-js-pipeline
+                  artifactName: CDNFeed
+                  targetPath: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/CDNFeed
+                - input: pipelineArtifact
+                  pipeline: microsoft-teams-library-js-pipeline
+                  artifactName: scripts
+                  targetPath: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/scripts
+
             steps:
-              - download: microsoft-teams-library-js-pipeline
               - task: prepare-deployment@1
-                displayName:
+                displayName: Prepare deployment
                 inputs:
                   taskType: credentialFetchTaskAzureRM
                   armserviceconnection: $(serviceConnectionId)
@@ -44,33 +66,40 @@ extends:
                 inputs:
                   ArrowServiceConnection: $(arrowServiceConnectionId)
                   IsShipped: true
-              - task: AzureKeyVault@2
-                displayName: 'Azure Key Vault: $(keyVaultName)'
-                inputs:
-                  ConnectedServiceName: $(serviceConnectionId)
-                  KeyVaultName: $(keyVaultName)
-                  SecretsFilter: $(keyVaultSecretsFilter)
               - task: NodeTool@0
                 displayName: Use Node 18.x
                 inputs:
                   versionSpec: 18.x
-              - task: PowerShell@2
-                displayName: Update npmrc with NPM-TOKEN
-                inputs:
-                  targetType: 'filePath'
-                  filePath: 'tools/releases/powershell-commands/update-npmrc-with-npm-token.ps1'
-                  arguments: -PIPELINE_WORKSPACE $(PIPELINE.WORKSPACE) -NPM_TOKEN $(NPM-TOKEN)
               - task: Npm@1
-                displayName: Publish to npm (tag beta) KV
+                displayName: Build NPM package for release
                 inputs:
                   command: custom
-                  workingDir: $(PIPELINE.WORKSPACE)/microsoft-teams-library-js-pipeline/NPMFeed
+                  workingDir: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/NPMFeed
                   verbose: false
-                  customCommand: publish  --tag beta
+                  customCommand: pack
+              - task: EsrpRelease@10
+                displayName: Publish to npm (tag beta) - ESRP release
+                inputs:
+                  connectedservicename: '$(connectedServiceName)'
+                  usemanagedidentity: true
+                  keyvaultname: '$(keyVaultName)'
+                  signcertname: '$(signCertName)'
+                  clientid: '$(clientId)'
+                  intent: 'PackageDistribution'
+                  contenttype: 'npm'
+                  contentsource: 'Folder'
+                  folderlocation: '$(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/NPMFeed'
+                  waitforreleasecompletion: true
+                  owners: $(owners)
+                  approvers: $(approvers)
+                  serviceendpointurl: '$(serviceEndpointUrl)'
+                  mainpublisher: '$(mainPublisher)'
+                  domaintenantid: '$(domainTenantId)'
+                  productstate: 'Beta'
               - task: M365CdnAssetsUpload@3
                 displayName: Push teams-js to M365 1CDN (SDF)
                 inputs:
-                  SourcePath: $(PIPELINE.WORKSPACE)/microsoft-teams-library-js-pipeline/CDNFeed/*
+                  SourcePath: $(System.DefaultWorkingDirectory)/microsoft-teams-library-js-pipeline/CDNFeed/*
                   ConnectedServiceNameARM: $(serviceConnectionId)
                   Environment: PublicCloudSDF
                   ContainerName: teams-js
@@ -79,5 +108,5 @@ extends:
                 displayName: View Published Package URLs
                 inputs:
                   targetType: 'filePath'
-                  filePath: 'tools/releases/powershell-commands/view-published-pkg-urls.ps1'
-                  arguments: -PIPELINE_WORKSPACE $(PIPELINE.WORKSPACE)
+                  filePath: 'microsoft-teams-library-js-pipeline/scripts/view-published-pkg-urls.ps1'
+                  arguments: -PIPELINE_WORKSPACE $(System.DefaultWorkingDirectory)