Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 994a3b8

Browse files
zoobazooba
authored
Enable publish of Windows releases through Azure Pipelines (GH-14720)
1 parent fb6c1f8 commit 994a3b8

6 files changed

Lines changed: 223 additions & 17 deletions

File tree

‎.azure-pipelines/windows-release.yml‎

Lines changed: 39 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
name: Release_$(Build.SourceBranchName)_$(SourceTag)_$(Date:yyyyMMdd)$(Rev:.rr)
22

3+
variables:
4+
__RealSigningCertificate: 'Python Software Foundation'
35
# QUEUE TIME VARIABLES
4-
# variables:
56
# GitRemote: python
67
# SourceTag:
78
# DoPGO: true
@@ -13,84 +14,116 @@ name: Release_$(Build.SourceBranchName)_$(SourceTag)_$(Date:yyyyMMdd)$(Rev:.rr)
1314
# DoEmbed: true
1415
# DoMSI: true
1516
# DoPublish: false
17+
# PyDotOrgUsername: ''
18+
# PyDotOrgServer: ''
19+
# BuildToPublish: ''
1620

1721
trigger: none
1822
pr: none
1923

2024
stages:
2125
- stage: Build
2226
displayName: Build binaries
27+
condition: and(succeeded(), not(variables['BuildToPublish']))
2328
jobs:
2429
- template: windows-release/stage-build.yml
2530

2631
- stage: Sign
2732
displayName: Sign binaries
2833
dependsOn: Build
34+
condition: and(succeeded(), not(variables['BuildToPublish']))
2935
jobs:
3036
- template: windows-release/stage-sign.yml
3137

3238
- stage: Layout
3339
displayName: Generate layouts
3440
dependsOn: Sign
41+
condition: and(succeeded(), not(variables['BuildToPublish']))
3542
jobs:
3643
- template: windows-release/stage-layout-full.yml
3744
- template: windows-release/stage-layout-embed.yml
3845
- template: windows-release/stage-layout-nuget.yml
3946

4047
- stage: Pack
4148
dependsOn: Layout
49+
condition: and(succeeded(), not(variables['BuildToPublish']))
4250
jobs:
4351
- template: windows-release/stage-pack-nuget.yml
4452

4553
- stage: Test
4654
dependsOn: Pack
55+
condition: and(succeeded(), not(variables['BuildToPublish']))
4756
jobs:
4857
- template: windows-release/stage-test-embed.yml
4958
- template: windows-release/stage-test-nuget.yml
5059

5160
- stage: Layout_MSIX
5261
displayName: Generate MSIX layouts
5362
dependsOn: Sign
54-
condition: and(succeeded(), eq(variables['DoMSIX'], 'true'))
63+
condition: and(succeeded(), and(eq(variables['DoMSIX'], 'true'), not(variables['BuildToPublish'])))
5564
jobs:
5665
- template: windows-release/stage-layout-msix.yml
5766

5867
- stage: Pack_MSIX
5968
displayName: Package MSIX
6069
dependsOn: Layout_MSIX
70+
condition: and(succeeded(), not(variables['BuildToPublish']))
6171
jobs:
6272
- template: windows-release/stage-pack-msix.yml
6373

6474
- stage: Build_MSI
6575
displayName: Build MSI installer
6676
dependsOn: Sign
67-
condition: and(succeeded(), eq(variables['DoMSI'], 'true'))
77+
condition: and(succeeded(), and(eq(variables['DoMSI'], 'true'), not(variables['BuildToPublish'])))
6878
jobs:
6979
- template: windows-release/stage-msi.yml
7080

7181
- stage: Test_MSI
7282
displayName: Test MSI installer
7383
dependsOn: Build_MSI
84+
condition: and(succeeded(), not(variables['BuildToPublish']))
7485
jobs:
7586
- template: windows-release/stage-test-msi.yml
7687

7788
- stage: PublishPyDotOrg
7889
displayName: Publish to python.org
7990
dependsOn: ['Test_MSI', 'Test']
80-
condition: and(succeeded(), eq(variables['DoPublish'], 'true'))
91+
condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), not(variables['BuildToPublish'])))
8192
jobs:
8293
- template: windows-release/stage-publish-pythonorg.yml
8394

8495
- stage: PublishNuget
8596
displayName: Publish to nuget.org
8697
dependsOn: Test
87-
condition: and(succeeded(), eq(variables['DoPublish'], 'true'))
98+
condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), not(variables['BuildToPublish'])))
8899
jobs:
89100
- template: windows-release/stage-publish-nugetorg.yml
90101

91102
- stage: PublishStore
92103
displayName: Publish to Store
93104
dependsOn: Pack_MSIX
94-
condition: and(succeeded(), eq(variables['DoPublish'], 'true'))
105+
condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), not(variables['BuildToPublish'])))
106+
jobs:
107+
- template: windows-release/stage-publish-store.yml
108+
109+
110+
- stage: PublishExistingPyDotOrg
111+
displayName: Publish existing build to python.org
112+
dependsOn: []
113+
condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), variables['BuildToPublish']))
114+
jobs:
115+
- template: windows-release/stage-publish-pythonorg.yml
116+
117+
- stage: PublishExistingNuget
118+
displayName: Publish existing build to nuget.org
119+
dependsOn: []
120+
condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), variables['BuildToPublish']))
121+
jobs:
122+
- template: windows-release/stage-publish-nugetorg.yml
123+
124+
- stage: PublishExistingStore
125+
displayName: Publish existing build to Store
126+
dependsOn: []
127+
condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), variables['BuildToPublish']))
95128
jobs:
96129
- template: windows-release/stage-publish-store.yml

‎.azure-pipelines/windows-release/gpg-sign.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
parameters:
2+
GPGKeyFile: $(GPGKey)
3+
GPGPassphrase: $(GPGPassphrase)
4+
Files: '*'
5+
WorkingDirectory: $(Build.BinariesDirectory)
6+
7+
steps:
8+
- task: DownloadSecureFile@1
9+
name: gpgkey
10+
inputs:
11+
secureFile: ${{ parameters.GPGKeyFile }}
12+
displayName: 'Download GPG key'
13+
14+
- powershell: |
15+
git clone https://github.com/python/cpython-bin-deps --branch gpg --single-branch --depth 1 --progress -v "gpg"
16+
gpg/gpg2.exe --import "$(gpgkey.secureFilePath)"
17+
(gci -File ${{ parameters.Files }}).FullName | %{
18+
gpg/gpg2.exe -ba --batch --passphrase ${{ parameters.GPGPassphrase }} $_
19+
"Made signature for $_"
20+
}
21+
displayName: 'Generate GPG signatures'
22+
workingDirectory: ${{ parameters.WorkingDirectory }}
23+
24+
- powershell: |
25+
$p = gps "gpg-agent" -EA 0
26+
if ($p) { $p.Kill() }
27+
displayName: 'Kill GPG agent'
28+
condition: true

‎.azure-pipelines/windows-release/stage-publish-nugetorg.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,26 @@ jobs:
1414

1515
- task: DownloadBuildArtifacts@0
1616
displayName: 'Download artifact: nuget'
17+
condition: and(succeeded(), not(variables['BuildToPublish']))
1718
inputs:
1819
artifactName: nuget
1920
downloadPath: $(Build.BinariesDirectory)
2021

22+
- task: DownloadBuildArtifacts@0
23+
displayName: 'Download artifact: nuget'
24+
condition: and(succeeded(), variables['BuildToPublish'])
25+
inputs:
26+
artifactName: nuget
27+
downloadPath: $(Build.BinariesDirectory)
28+
buildType: specific
29+
project: cpython
30+
pipeline: Windows-Release
31+
buildVersionToDownload: specific
32+
buildId: $(BuildToPublish)
33+
2134
- task: NuGetCommand@2
2235
displayName: Push packages
23-
condition: and(succeeded(), eq(variables['SigningCertificate'], 'Python Software Foundation'))
36+
condition: and(succeeded(), eq(variables['SigningCertificate'], variables['__RealSigningCertificate']))
2437
inputs:
2538
command: push
2639
packagesToPush: $(Build.BinariesDirectory)\nuget\*.nupkg'

‎.azure-pipelines/windows-release/stage-publish-pythonorg.yml‎

Lines changed: 128 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,31 +4,151 @@ jobs:
44
condition: and(succeeded(), and(eq(variables['DoMSI'], 'true'), eq(variables['DoEmbed'], 'true')))
55

66
pool:
7-
vmName: win2016-vs2017
7+
#vmName: win2016-vs2017
8+
name: 'Windows Release'
89

910
workspace:
1011
clean: all
1112

1213
steps:
13-
- checkout: none
14+
- template: ./checkout.yml
1415

15-
- task: DownloadBuildArtifacts@0
16+
- task: UsePythonVersion@0
17+
displayName: 'Use Python 3.6 or later'
18+
inputs:
19+
versionSpec: '>=3.6'
20+
21+
- task: DownloadPipelineArtifact@1
1622
displayName: 'Download artifact: Doc'
23+
condition: and(succeeded(), not(variables['BuildToPublish']))
1724
inputs:
1825
artifactName: Doc
19-
downloadPath: $(Build.BinariesDirectory)
26+
targetPath: $(Build.BinariesDirectory)\Doc
2027

21-
- task: DownloadBuildArtifacts@0
28+
- task: DownloadPipelineArtifact@1
2229
displayName: 'Download artifact: msi'
30+
condition: and(succeeded(), not(variables['BuildToPublish']))
2331
inputs:
2432
artifactName: msi
25-
downloadPath: $(Build.BinariesDirectory)
33+
targetPath: $(Build.BinariesDirectory)\msi
2634

2735
- task: DownloadBuildArtifacts@0
2836
displayName: 'Download artifact: embed'
37+
condition: and(succeeded(), not(variables['BuildToPublish']))
38+
inputs:
39+
artifactName: embed
40+
downloadPath: $(Build.BinariesDirectory)
41+
42+
43+
- task: DownloadPipelineArtifact@1
44+
displayName: 'Download artifact from $(BuildToPublish): Doc'
45+
condition: and(succeeded(), variables['BuildToPublish'])
46+
inputs:
47+
artifactName: Doc
48+
targetPath: $(Build.BinariesDirectory)\Doc
49+
buildType: specific
50+
project: cpython
51+
pipeline: 21
52+
buildVersionToDownload: specific
53+
buildId: $(BuildToPublish)
54+
55+
- task: DownloadPipelineArtifact@1
56+
displayName: 'Download artifact from $(BuildToPublish): msi'
57+
condition: and(succeeded(), variables['BuildToPublish'])
58+
inputs:
59+
artifactName: msi
60+
targetPath: $(Build.BinariesDirectory)\msi
61+
buildType: specific
62+
project: cpython
63+
pipeline: 21
64+
buildVersionToDownload: specific
65+
buildId: $(BuildToPublish)
66+
67+
- task: DownloadBuildArtifacts@0
68+
displayName: 'Download artifact from $(BuildToPublish): embed'
69+
condition: and(succeeded(), variables['BuildToPublish'])
2970
inputs:
3071
artifactName: embed
3172
downloadPath: $(Build.BinariesDirectory)
73+
buildType: specific
74+
project: cpython
75+
pipeline: Windows-Release
76+
buildVersionToDownload: specific
77+
buildId: $(BuildToPublish)
78+
79+
80+
- template: ./gpg-sign.yml
81+
parameters:
82+
GPGKeyFile: 'python-signing.key'
83+
Files: 'doc\htmlhelp\*.chm, msi\*\*, embed\*.zip'
3284

33-
# TODO: eq(variables['SigningCertificate'], 'Python Software Foundation')
34-
# If we are not real-signed, DO NOT PUBLISH
85+
- powershell: >
86+
$(Build.SourcesDirectory)\Tools\msi\uploadrelease.ps1
87+
-build msi
88+
-user $(PyDotOrgUsername)
89+
-server $(PyDotOrgServer)
90+
-doc_htmlhelp doc\htmlhelp
91+
-embed embed
92+
-skippurge
93+
-skiptest
94+
-skiphash
95+
condition: and(succeeded(), eq(variables['SigningCertificate'], variables['__RealSigningCertificate']))
96+
workingDirectory: $(Build.BinariesDirectory)
97+
displayName: 'Upload files to python.org'
98+
99+
- powershell: >
100+
python
101+
"$(Build.SourcesDirectory)\Tools\msi\purge.py"
102+
(gci msi\*\python-*.exe | %{ $_.Name -replace 'python-(.+?)(-|\.exe).+', '$1' } | select -First 1)
103+
workingDirectory: $(Build.BinariesDirectory)
104+
displayName: 'Purge CDN'
105+
106+
- powershell: |
107+
$failures = 0
108+
gci "msi\*\*-webinstall.exe" -File | %{
109+
$d = mkdir "tests\$($_.BaseName)" -Force
110+
gci $d -r -File | del
111+
$ic = copy $_ $d -PassThru
112+
"Checking layout for $($ic.Name)"
113+
Start-Process -wait $ic "/passive", "/layout", "$d\layout", "/log", "$d\log\install.log"
114+
if (-not $?) {
115+
Write-Error "Failed to validate layout of $($inst.Name)"
116+
$failures += 1
117+
}
118+
}
119+
if ($failures) {
120+
Write-Error "Failed to validate $failures installers"
121+
exit 1
122+
}
123+
#condition: and(succeeded(), eq(variables['SigningCertificate'], variables['__RealSigningCertificate']))
124+
workingDirectory: $(Build.BinariesDirectory)
125+
displayName: 'Test layouts'
126+
127+
- powershell: |
128+
$hashes = gci doc\htmlhelp\python*.chm, msi\*\*.exe, embed\*.zip | `
129+
Sort-Object Name | `
130+
Format-Table Name, @{
131+
Label="MD5";
132+
Expression={(Get-FileHash $_ -Algorithm MD5).Hash}
133+
}, Length -AutoSize | `
134+
Out-String -Width 4096
135+
$d = mkdir "$(Build.ArtifactStagingDirectory)\hashes" -Force
136+
$hashes | Out-File "$d\hashes.txt" -Encoding ascii
137+
$hashes
138+
workingDirectory: $(Build.BinariesDirectory)
139+
displayName: 'Generate hashes'
140+
141+
- powershell: |
142+
"Copying:"
143+
(gci msi\*\python*.asc, doc\htmlhelp\*.asc, embed\*.asc).FullName
144+
$d = mkdir "$(Build.ArtifactStagingDirectory)\hashes" -Force
145+
move msi\*\python*.asc, doc\htmlhelp\*.asc, embed\*.asc $d -Force
146+
gci msi -Directory | %{ move "msi\$_\*.asc" (mkdir "$d\$_" -Force) }
147+
workingDirectory: $(Build.BinariesDirectory)
148+
displayName: 'Copy GPG signatures for build'
149+
150+
- task: PublishPipelineArtifact@0
151+
displayName: 'Publish Artifact: hashes'
152+
inputs:
153+
targetPath: '$(Build.ArtifactStagingDirectory)\hashes'
154+
artifactName: hashes

‎.azure-pipelines/windows-release/stage-publish-store.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,22 @@ jobs:
1414

1515
- task: DownloadBuildArtifacts@0
1616
displayName: 'Download artifact: msixupload'
17+
condition: and(succeeded(), not(variables['BuildToPublish']))
1718
inputs:
1819
artifactName: msixupload
1920
downloadPath: $(Build.BinariesDirectory)
2021

21-
# TODO: eq(variables['SigningCertificate'], 'Python Software Foundation')
22+
- task: DownloadBuildArtifacts@0
23+
displayName: 'Download artifact: msixupload'
24+
condition: and(succeeded(), variables['BuildToPublish'])
25+
inputs:
26+
artifactName: msixupload
27+
downloadPath: $(Build.BinariesDirectory)
28+
buildType: specific
29+
project: cpython
30+
pipeline: Windows-Release
31+
buildVersionToDownload: specific
32+
buildId: $(BuildToPublish)
33+
34+
# TODO: eq(variables['SigningCertificate'], variables['__RealSigningCertificate'])
2235
# If we are not real-signed, DO NOT PUBLISH

‎Tools/msi/uploadrelease.ps1‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,5 +164,4 @@ if (-not $skiphash) {
164164
Out-String -Width 4096
165165
$hashes | clip
166166
$hashes
167-
popd
168167
}

0 commit comments

Comments
 (0)