Skip to content

[release/v7.4.15] Fix the APIScan pipeline #27282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SeeminglyScience merged 1 commit into from
Apr 16, 2026
Merged

[release/v7.4.15] Fix the APIScan pipeline #27282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .pipelines/apiscan-gen-notice.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,11 +83,11 @@ extends:
break: true # always break the build on binskim issues in addition to TSA upload
policheck:
break: true # always break the build on policheck issues. You can disable it by setting to 'false'
# APIScan requires a non-Ready-To-Run build
# APIScan requires a non-Ready-To-Run build
apiscan:
enabled: true
softwareName: "PowerShell" # Default is repo name
versionNumber: "7.5" # Default is build number
versionNumber: "7.6" # Default is build number
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

versionNumber is hard-coded to "7.6", which can easily drift from the branch/version this pipeline is running for (and requires manual updates). Prefer omitting versionNumber to use the default build number, or set it based on a branch/version variable appropriate for this release branch.

Suggested change
versionNumber: "7.6" # Default is build number

Copilot uses AI. Check for mistakes.
isLargeApp: false # Default: false.
symbolsFolder: $(SymbolsServerUrl);$(ob_outputDirectory)
#softwareFolder - relative path to a folder to be scanned. Default value is root of artifacts folder.
Expand Down
55 changes: 19 additions & 36 deletions .pipelines/templates/compliance/apiscan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ jobs:
- name: branchCounter
value: $[counter(variables['branchCounterKey'], 1)]
- group: DotNetPrivateBuildAccess
- group: Azure Blob variable group
- group: ReleasePipelineSecrets
- group: mscodehub-feed-read-general
- group: mscodehub-feed-read-akv
Expand Down Expand Up @@ -72,34 +71,6 @@ jobs:
workingDirectory: '$(repoRoot)'
retryCountOnTaskFailure: 2

- task: AzurePowerShell@5
displayName: Download winverify-private Artifacts
inputs:
azureSubscription: az-blob-cicd-infra
scriptType: inlineScript
azurePowerShellVersion: LatestVersion
workingDirectory: '$(repoRoot)'
pwsh: true
inline: |
# download smybols for getfilesiginforedist.dll
$downloadsDirectory = '$(Build.ArtifactStagingDirectory)/downloads'
$uploadedDirectory = '$(Build.ArtifactStagingDirectory)/uploaded'
$storageAccountName = "pscoretestdata"
$containerName = 'winverify-private'
$winverifySymbolsPath = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)/winverify-symbols' -Force
$dllName = 'getfilesiginforedist.dll'
$winverifySymbolsDllPath = Join-Path $winverifySymbolsPath $dllName

$context = New-AzStorageContext -StorageAccountName $storageAccountName -UseConnectedAccount

Get-AzStorageBlobContent -Container $containerName -Blob $dllName -Destination $winverifySymbolsDllPath -Context $context

- pwsh: |
Get-ChildItem -Path '$(System.ArtifactsDirectory)/winverify-symbols'
displayName: Capture winverify-private Artifacts
workingDirectory: '$(repoRoot)'
condition: succeededOrFailed()

- task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step.
displayName: 🔏 CodeQL 3000 Init
condition: eq(variables['CODEQL_ENABLED'], 'true')
Expand All @@ -118,23 +89,35 @@ jobs:
Remove-Item -Recurse -Force $OutputFolder/ref
}

Copy-Item -Path "$OutputFolder\*" -Destination '$(ob_outputDirectory)' -Recurse -Verbose
$Destination = '$(ob_outputDirectory)'
if (-not (Test-Path $Destination)) {
Write-Verbose -Verbose -Message "Creating destination folder '$Destination'"
$null = mkdir $Destination
}

Copy-Item -Path "$OutputFolder\*" -Destination $Destination -Recurse -Verbose
workingDirectory: '$(repoRoot)'
displayName: 'Build PowerShell Source'

- pwsh: |
# Only key windows runtimes
Get-ChildItem -Path '$(ob_outputDirectory)\runtimes\*' -File -Recurse | Where-Object {$_.FullName -notmatch '.*\/runtimes\/win'} | Foreach-Object {
# Only keep windows runtimes
Write-Verbose -Verbose -Message "Deleting non-win-x64 runtimes ..."
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The verbose message says "Deleting non-win-x64 runtimes ..." but the filter keeps any runtime folder whose path matches \runtimes\win (including win and other win-* RIDs). Update the message (or the filter) so the log accurately reflects what's being deleted/kept.

Suggested change
Write-Verbose -Verbose -Message "Deleting non-win-x64 runtimes ..."
Write-Verbose -Verbose -Message "Deleting non-Windows runtimes ..."

Copilot uses AI. Check for mistakes.
Get-ChildItem -Path '$(ob_outputDirectory)\runtimes\*' | Where-Object {$_.FullName -notmatch '.*\\runtimes\\win'} | Foreach-Object {
Write-Verbose -Verbose -Message "Deleting $($_.FullName)"
Remove-Item -Force -Verbose -Path $_.FullName
Remove-Item -Path $_.FullName -Recurse -Force
}

# Temporarily remove runtimes/win-x64 due to issues with that runtime
Get-ChildItem -Path '$(ob_outputDirectory)\runtimes\*' -File -Recurse | Where-Object {$_.FullName -match '.*\/runtimes\/win-x86\/'} | Foreach-Object {
# Remove win-x86/arm/arm64 runtimes due to issues with those runtimes
Write-Verbose -Verbose -Message "Temporarily deleting win-x86/arm/arm64 runtimes ..."
Get-ChildItem -Path '$(ob_outputDirectory)\runtimes\*' | Where-Object {$_.FullName -match '.*\\runtimes\\win-(x86|arm)'} | Foreach-Object {
Write-Verbose -Verbose -Message "Deleting $($_.FullName)"
Remove-Item -Force -Verbose -Path $_.FullName
Remove-Item -Path $_.FullName -Recurse -Force
}

Write-Host
Write-Verbose -Verbose -Message "Show content in 'runtimes' folder:"
Get-ChildItem -Path '$(ob_outputDirectory)\runtimes'
Write-Host
workingDirectory: '$(repoRoot)'
displayName: 'Remove unused runtimes'

Expand Down
Loading