azure-pipelines.yml

resources:
- repo: self

trigger:
  batch: true
  branches:
    include:
    - '*'
    exclude:
    - 'release*'

pr:
  branches:
    include:
    - '*'

variables:
- template: ${{ variables.Pipeline.Workspace }}/.azure-pipelines/templates/variables.yml
- ${{ if eq(variables['System.TeamProject'], 'release') }}:
  - group: 'AME ESRP Variable Group'
  - group: 'esrp-signing-codes'
- name: Codeql.Enabled
  value: false
- name: ComponentDetection.ForceScan
  value: eq(variables['Build.SourceBranch'], 'refs/heads/release')

# Standalone tarball and Cask parameters
- name: standalone_python_version
  value: '3.14'

parameters:
- name: architectures
  type: object
  default:
  - name: AMD64
    value: amd64
    pool: pool-ubuntu-latest-multi-core
  - name: ARM64
    value: arm64
    pool: pool-ubuntu-latest-arm64

# Azure Linux versions to build in parallel. AZL3 is the current stable release;
# AZL4 is being onboarded (currently beta) to pick up the patched OpenSSL and
# resolve the S360 vulnerability. Both are built and published side-by-side
# until AZL4 reaches GA and AZL3 is deprecated.
- name: azureLinuxVersions
  type: object
  default:
  - name: '3.0'
    tag: '3.0'
    image: mcr.microsoft.com/azurelinux/base/core:3.0
  - name: '4.0 (Beta)'
    tag: '4.0'
    image: mcr.microsoft.com/azurelinux-beta/base/core:4.0

jobs:
- job: CheckPullRequest
  displayName: "Check the Format of Pull Request Title and Content"
  condition: and(succeeded(), in(variables['System.PullRequest.TargetBranch'], 'dev', 'release', 'main'))

  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - bash: |
      echo "Check Title of Pull Request: #$(System.PullRequest.PullRequestNumber)"
      title=$(curl https://api.github.com/repos/$(Build.Repository.Name)/pulls/$(System.PullRequest.PullRequestNumber) | jq -r '.title')
      echo $title
      body=$(curl https://api.github.com/repos/$(Build.Repository.Name)/pulls/$(System.PullRequest.PullRequestNumber) | jq -r '.body')
      echo $body
      if [ "$(System.PullRequest.TargetBranch)" != "release" ] && echo $title | grep -iqF hotfix:; then
        echo "Hotfix PR should target release branch."
        exit 1
      fi
      if [ "$(System.PullRequest.TargetBranch)" == "main" ]; then
        echo "Feature PR should target dev branch."
        exit 1
      fi
      python scripts/ci/check_pull_request.py "$title" "$body"

- job: RejectPullRequestToMasterBranch
  displayName: "Reject Pull Request To Master Branch"
  condition: and(succeeded(), eq(variables['System.PullRequest.TargetBranch'], 'master'))

  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - bash: |
      echo "Reject pull request directly to master branch"
      exit 1

- job: CredentialScanner
  displayName: "Credential Scanner"
  pool:
    name: ${{ variables.windows_pool }}
  steps:
  - task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@3
    displayName: 'Run Credential Scanner'
    inputs:
      toolVersion: '2.1.17'
      suppressionsFile: './scripts/ci/credscan/CredScanSuppressions.json'

  - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
    displayName: 'Post Analysis'
    inputs:
      GdnBreakAllTools: false
      GdnBreakGdnToolCredScan: true
      GdnBreakGdnToolCredScanSeverity: Error

- job: PolicyCheck
  displayName: "Policy Check"
  pool:
    name: ${{ variables.windows_pool }}
  steps:
  - task: securedevelopmentteam.vss-secure-development-tools.build-task-policheck.PoliCheck@2
    displayName: 'Run Policy Check'
    inputs:
      targetType: F
      result: PoliCheckResult.xml

  - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
    displayName: 'Post Analysis'
    inputs:
      GdnBreakAllTools: false
      GdnBreakGdnToolPoliCheck: true
      GdnBreakGdnToolPoliCheckSeverity: Error

- job: ExtractMetadata
  displayName: Extract Metadata

  condition: succeeded()
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - task: Bash@3
    displayName: 'Extract Version'
    inputs:
      targetType: 'filePath'
      filePath: scripts/release/get_version.sh


  - task: PublishPipelineArtifact@0
    displayName: 'Publish Artifact: metadata'
    inputs:
      TargetPath: $(Build.ArtifactStagingDirectory)
      ArtifactName: metadata

- job: VerifyLinuxRequirements
  displayName: 'Verify src/azure-cli/requirements.*.Linux.txt'
  condition: succeeded()
  pool:
    name: ${{ variables.ubuntu_pool }}

  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'

  - bash: ./scripts/ci/dependency_check.sh
    displayName: 'Verify src/azure-cli/requirements.py3.Linux.txt'

- job: VerifyDarwinRequirements
  displayName: 'Verify src/azure-cli/requirements.*.Darwin.txt'
  condition: succeeded()
  pool:
    vmImage: ${{ variables.macos_pool }}

  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'

  - bash: ./scripts/ci/dependency_check.sh
    displayName: 'Verify src/azure-cli/requirements.py3.Darwin.txt'

- job: VerifyWindowsRequirements
  displayName: 'Verify src/azure-cli/requirements.*.Windows.txt'
  condition: succeeded()
  pool:
    name: ${{ variables.windows_pool }}

  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'

  - task: BatchScript@1
    inputs:
      filename: ./scripts/ci/dependency_check.bat
    displayName: 'Verify src/azure-cli/requirements.py3.Windows.txt'

- job: VerifyVersions
  displayName: Verify Command Module Versions
  condition: and(succeeded(), or(eq(variables['Build.SourceBranch'], 'refs/heads/release'), eq(variables['System.PullRequest.TargetBranch'], 'release')))

  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'
  - template: .azure-pipelines/templates/azdev_setup.yml
  - bash: |
      set -ev
      . env/bin/activate
      azdev verify history

    displayName: 'Verify History'

- job: BuildWindowsMSI
  displayName: Build Windows MSI
  strategy:
    matrix:
      x86:
        Platform: x86
      x64:
        Platform: x64

  dependsOn: ExtractMetadata
  condition: succeeded()
  pool:
    name: ${{ variables.windows_pool }}
  steps:
  - task: DownloadPipelineArtifact@1
    displayName: 'Download Build Artifacts'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
      artifactName: metadata

  - task: PipAuthenticate@1
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    displayName: 'Pip Authenticate'
    inputs:
      artifactFeeds: $(AZURE_ARTIFACTS_FEEDS)

  - script: |
      set ARCH=$(Platform)
      set TARGET=msi
      set /p CLI_VERSION=<$(System.ArtifactsDirectory)/metadata/version
      set
      
      build_scripts/windows/scripts/build.cmd
    displayName: 'Build Windows MSI'

  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
    displayName: 'SBOM'
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    inputs:
      BuildDropPath: 'build_scripts/windows/out/'

  - task: PublishPipelineArtifact@0
    displayName: 'Publish Artifact: MSI'
    inputs:
      TargetPath: 'build_scripts/windows/out/'
      ArtifactName: msi-$(Platform)

- job: BuildWindowsZIP
  displayName: Build Windows ZIP
  strategy:
    matrix:
      x64:
        Platform: x64

  dependsOn: ExtractMetadata
  condition: succeeded()
  pool:
    name: ${{ variables.windows_pool }}
  steps:
    - task: DownloadPipelineArtifact@1
      displayName: 'Download Build Artifacts'
      inputs:
        TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
        artifactName: metadata

    - task: PipAuthenticate@1
      condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
      displayName: 'Pip Authenticate'
      inputs:
        artifactFeeds: $(AZURE_ARTIFACTS_FEEDS)

    - script: |
        set ARCH=$(Platform)
        set TARGET=zip
        set /p CLI_VERSION=<$(System.ArtifactsDirectory)/metadata/version
        set
        
        build_scripts/windows/scripts/build.cmd
      displayName: 'Build Windows ZIP'

    - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
      displayName: 'SBOM'
      condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
      inputs:
        BuildDropPath: 'build_scripts/windows/out/'

    - task: PublishPipelineArtifact@0
      displayName: 'Publish Artifact: ZIP'
      inputs:
        TargetPath: 'build_scripts/windows/out/'
        ArtifactName: zip-$(Platform)

- job: TestMsiInstallation
  displayName: Test MSI Installation
  strategy:
    matrix:
      x86:
        Platform: x86
      x64:
        Platform: x64

  dependsOn: BuildWindowsMSI
  condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
  pool:
    name: ${{ variables.windows_pool }}
  steps:
  - task: DownloadPipelineArtifact@1
    displayName: 'Download Build Artifacts'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
      artifactName: metadata

  - task: DownloadPipelineArtifact@1
    displayName: 'Download Build Artifacts'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/msi'
      artifactName: msi-$(Platform)

  - task: PowerShell@2
    displayName: Install and Load CLI
    inputs:
      filePath: build_scripts\windows\scripts\test_msi_installation.ps1

- job: TestZipInstallation
  displayName: Test ZIP Installation
  dependsOn: BuildWindowsZIP
  strategy:
    matrix:
      x64:
        Platform: x64
  condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
  pool:
    name: ${{ variables.windows_pool }}
  steps:
  - task: DownloadPipelineArtifact@1
    displayName: 'Download Build Artifacts'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
      artifactName: metadata

  - task: DownloadPipelineArtifact@1
    displayName: 'Download Build Artifacts'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/zip'
      artifactName: zip-$(Platform)

  - task: PowerShell@2
    displayName: Expand and Load CLI
    inputs:
      filePath: build_scripts\windows\scripts\test_zip_installation.ps1

- job: BuildDockerImageAzureLinux
  displayName: Build Docker Image Azure Linux
  dependsOn: BuildRpmPackagesAzureLinux
  strategy:
    matrix:
      ${{ each azl in parameters.azureLinuxVersions }}:
        ${{ each arch in parameters.architectures }}:
          Azure Linux ${{ azl.name }} ${{ arch.name }}:
            pool: ${{ arch.pool }}
            artifactName: docker-azurelinux${{ azl.tag }}-${{ arch.value }}
            dockerfile: azure-linux.dockerfile
            packageArtifactName: rpm-azurelinux${{ azl.tag }}-${{ arch.value }}
            image: ${{ azl.image }}
  pool:
    name: $(pool)
  steps:
    - bash: ./scripts/ci/install_docker.sh
      displayName: Install Docker
    - task: DownloadPipelineArtifact@1
      displayName: 'Download Build Artifacts'
      inputs:
        TargetPath: '$(Build.ArtifactStagingDirectory)/docker'
        artifactName: $(packageArtifactName)
    - bash: |
        set -ex
        mkdir docker-temp
        mv $(Build.ArtifactStagingDirectory)/docker/*.rpm ./docker-temp/azure-cli.rpm
        
        bash scripts/release/docker/pipeline.sh
      displayName: 'Build Docker'

    - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
      displayName: 'SBOM'
      condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
      inputs:
        BuildDropPath: $(Build.ArtifactStagingDirectory)
        DockerImagesToScan: 'clibuild$BUILD_BUILDNUMBER:latest'

    - task: PublishPipelineArtifact@0
      inputs:
        TargetPath: $(Build.ArtifactStagingDirectory)
        ArtifactName: $(artifactName)

- job: TestDockerImageAzureLinux
  displayName: Test Docker Image Azure Linux
  dependsOn:
    - BuildDockerImageAzureLinux
    - ExtractMetadata
  strategy:
    matrix:
      ${{ each azl in parameters.azureLinuxVersions }}:
        ${{ each arch in parameters.architectures }}:
          Azure Linux ${{ azl.name }} ${{ arch.name }}:
            pool: ${{ arch.pool }}
            artifactName: docker-azurelinux${{ azl.tag }}-${{ arch.value }}
  pool:
    name: $(pool)
  steps:
    - task: DownloadPipelineArtifact@1
      displayName: 'Download Metadata'
      inputs:
        TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
        artifactName: metadata

    - task: DownloadPipelineArtifact@1
      displayName: 'Download Docker Image'
      inputs:
        TargetPath: '$(Build.ArtifactStagingDirectory)/docker'
        artifactName: $(artifactName)

    - bash: ./scripts/ci/install_docker.sh
      displayName: Install Docker

    - bash: |
        set -exv
        
        CLI_VERSION=`cat $SYSTEM_ARTIFACTSDIRECTORY/metadata/version`
        IMAGE_NAME=clibuild$BUILD_BUILDNUMBER:latest
        TAR_FILE=$SYSTEM_ARTIFACTSDIRECTORY/docker/docker-azure-cli-$CLI_VERSION.tar
        
        echo "== Test docker image =="
        
        docker load < $TAR_FILE
        docker run $IMAGE_NAME /bin/bash -c "time az self-test && time az --version && tdnf list --installed && sleep 5"
      displayName: 'Bash Script'

- job: BuildPythonWheel
  displayName: Build Python Wheels

  dependsOn: ExtractMetadata
  condition: succeeded()
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'

  - task: PipAuthenticate@1
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    displayName: 'Pip Authenticate'
    inputs:
      artifactFeeds: $(AZURE_ARTIFACTS_FEEDS)

  - script: |
      if [[ "$(Build.Reason)" == "PullRequest" ]]; then
        branch=$(System.PullRequest.TargetBranch)
      else
        branch=$(Build.SourceBranchName)
      fi
      scripts/release/pypi/build.sh $branch
    displayName: 'Run Wheel Build Script'

  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
    displayName: 'SBOM'
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    inputs:
      BuildDropPath: $(Build.ArtifactStagingDirectory)

  - task: PublishPipelineArtifact@0
    displayName: 'Publish Artifact: pypi'
    inputs:
      TargetPath: $(Build.ArtifactStagingDirectory)
      ArtifactName: pypi

- job: TestPythonWheel
  displayName: Test Python Wheels
  strategy:
    matrix:
      Python312:
        python.version: '3.12'
      Python314:
        python.version: '3.14'
  dependsOn: BuildPythonWheel
  condition: succeeded()
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - task: DownloadPipelineArtifact@1
    displayName: 'Download Metadata'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
      artifactName: metadata
  - task: DownloadPipelineArtifact@1
    displayName: 'Download PyPI Packages'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/pypi'
      artifactName: pypi
  - task: UsePythonVersion@0
    displayName: 'Use Python $(python.version)'
    inputs:
      versionSpec: '$(python.version)'
  - bash: |
      #!/usr/bin/env bash
      set -ex
      
      CLI_VERSION=`cat $BUILD_ARTIFACTSTAGINGDIRECTORY/metadata/version`
      echo "== Testing pip install on $PYTHON_VERSION =="
      cd $BUILD_ARTIFACTSTAGINGDIRECTORY/pypi
      pip install --find-links ./ azure_cli-$CLI_VERSION*whl && az self-test && az --version && sleep 5
    displayName: 'Test pip Install'

- job: TestCore
  displayName: Unit Test for Core
  timeoutInMinutes: 10
  pool:
    name: ${{ variables.ubuntu_pool }}
  strategy:
    matrix:
      Python312:
        python.version: '3.12'
      Python314:
        python.version: '3.14'
  steps:
  - template: .azure-pipelines/templates/automation_test.yml
    parameters:
      pythonVersion: '$(python.version)'
      module: 'azure-cli-core'

- job: TestPackagingMetadata
  displayName: Test Packaging Metadata
  timeoutInMinutes: 10
  pool:
    name: ${{ variables.ubuntu_pool }}
  strategy:
    matrix:
      Python310:
        python.version: '3.10'
      Python314:
        python.version: '3.14'
  steps:
  - task: UsePythonVersion@0
    inputs:
      versionSpec: '$(python.version)'
  - bash: |
      set -e
      python -m pip install docutils requests packaging tomli
      python -B -m unittest discover -s tools/automation/tests -t tools -p 'test_*.py' -v
      python -B scripts/ci/check_package_versions.py
    displayName: Validate source metadata and packaging automation

- job: TestTelemetry
  displayName: Unit Test for Telemetry
  timeoutInMinutes: 10
  pool:
    name: ${{ variables.ubuntu_pool }}
  strategy:
    matrix:
      Python312:
        python.version: '3.12'
      Python314:
        python.version: '3.14'
  steps:
  - template: .azure-pipelines/templates/automation_test.yml
    parameters:
      pythonVersion: '$(python.version)'
      module: 'azure-cli-telemetry'

- job: IntegrationTestAgainstProfiles
  displayName: Integration Test against Profiles
  dependsOn: BuildPythonWheel
  condition: succeeded()
  timeoutInMinutes: 20

  pool:
    name: ${{ variables.ubuntu_pool }}
  strategy:
    matrix:
      Python312:
        python.version: '3.12'
      Python314:
        python.version: '3.14'
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python $(python.version)'
    inputs:
      versionSpec: '$(python.version)'
  - bash: pip install --upgrade pip wheel build "setuptools>=78.1.1"
    displayName: 'Install pip and wheel'
  - bash: ./scripts/ci/test_profile_integration.sh
    displayName: 'Run Integration Test against Profiles'

- job: TestExtensionsLoading
  displayName: Test Extensions Loading
  condition: succeeded()
  timeoutInMinutes: 80

  pool:
    name: ${{ variables.ubuntu_pool }}
  strategy:
    matrix:
      Python314:
        python.version: '3.14'
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python $(python.version)'
    inputs:
      versionSpec: '$(python.version)'
  - bash: pip install --upgrade pip wheel build "setuptools>=78.1.1,<81"
    displayName: 'Install pip and wheel setuptools'
  - bash: ./scripts/ci/test_extensions.sh
    displayName: 'Load extensions'

# ============================================================================
# HOMEBREW CASK JOBS (Pre-built, signed, notarized binaries)
# Phase 1 runs in all projects; Phases 2-3 require the release project
# because ESRP resources are not available elsewhere.
# ============================================================================

# Phase 1: Build unsigned tarballs (ARM64 + Intel)
- template: .azure-pipelines/templates/macos/macos-build-jobs.yml
  parameters:
    PythonVersion: $(standalone_python_version)
    MacosArm64Image: ${{ variables.macos_arm64_pool }}
    MacosIntelImage: ${{ variables.macos_intel_pool }}
    condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
    dependsOn: ['ExtractMetadata']

- template: .azure-pipelines/templates/linux/linux-build-jobs.yml
  parameters:
    PythonVersion: $(standalone_python_version)
    LinuxArm64Pool: ${{ variables.ubuntu_arm64_pool }}
    LinuxX64Pool: ${{ variables.ubuntu_pool }}
    condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
    dependsOn: ['ExtractMetadata']

# Phase 2: Sign and notarize via ESRP
- ${{ if eq(variables['System.TeamProject'], 'release') }}:
  - template: .azure-pipelines/templates/macos/macos-sign-notarize-jobs.yml
    parameters:
      MacosArm64Image: ${{ variables.macos_arm64_pool }}
      MacosIntelImage: ${{ variables.macos_intel_pool }}
      BundleId: 'com.microsoft.azure.cli'
      PythonVersion: $(standalone_python_version)
      ESRPServiceConnection: 'ame_esrp_connection'
      UseCurrentPipelineArtifacts: true
      dependsOn: ['VerifyMacOSCli']

# Phase 3: Generate cask and test via temp tap
- ${{ if eq(variables['System.TeamProject'], 'release') }}:
  - template: .azure-pipelines/templates/standalone/cask-generation-and-tests.yml
    parameters:
      MacosArm64Image: ${{ variables.macos_arm64_pool }}
      MacosIntelImage: ${{ variables.macos_intel_pool }}
      LinuxArm64Pool: ${{ variables.ubuntu_arm64_pool }}
      LinuxX64Pool: ${{ variables.ubuntu_pool }}
      PythonVersion: $(standalone_python_version)
      GitHubRepo: $(Build.Repository.Name)
      Debug: false
      CaskDependsOn: ['CreateMacOSFinalTarball', 'BuildLinuxCli']
      MacosDependsOn: ['CreateMacOSFinalTarball']
      LinuxDependsOn: ['BuildLinuxCli']

- job: BuildRpmPackagesAzureLinux
  displayName: Build Rpm Package
  condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
  strategy:
    matrix:
      ${{ each azl in parameters.azureLinuxVersions }}:
        ${{ each arch in parameters.architectures }}:
          Azure Linux ${{ azl.name }} ${{ arch.name }}:
            image: ${{ azl.image }}
            artifact: rpm-azurelinux${{ azl.tag }}-${{ arch.value }}
            pool: ${{ arch.pool }}
  pool:
    name: $(pool)
  steps:
  - bash: ./scripts/ci/install_docker.sh
    displayName: Install Docker

  - task: PipAuthenticate@1
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    displayName: 'Pip Authenticate'
    inputs:
      artifactFeeds: $(AZURE_ARTIFACTS_FEEDS)

  - task: Bash@3
    displayName: 'Build Rpm Package: Azure Linux'
    inputs:
      targetType: 'filePath'
      filePath: scripts/release/rpm/pipeline_azurelinux.sh

  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
    displayName: 'SBOM'
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    inputs:
      BuildDropPath: $(Build.ArtifactStagingDirectory)

  - task: PublishPipelineArtifact@0
    displayName: 'Publish Artifact: rpm-azurelinux'
    inputs:
      TargetPath: $(Build.ArtifactStagingDirectory)
      ArtifactName: $(artifact)

- job: TestRpmPackagesAzureLinux
  displayName: Test Rpm Package
  timeoutInMinutes: 180
  dependsOn:
  - BuildRpmPackagesAzureLinux
  - ExtractMetadata
  condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
  pool:
    name: $(pool)
  strategy:
    matrix:
      ${{ each azl in parameters.azureLinuxVersions }}:
        ${{ each arch in parameters.architectures }}:
          Azure Linux ${{ azl.name }} ${{ arch.name }}:
            image: ${{ azl.image }}
            artifact: rpm-azurelinux${{ azl.tag }}-${{ arch.value }}
            pool: ${{ arch.pool }}
  steps:
  - task: DownloadPipelineArtifact@1
    displayName: 'Download Metadata'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
      artifactName: metadata

  - task: DownloadPipelineArtifact@1
    displayName: 'Download Build Artifacts'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/rpm'
      artifactName: $(artifact)

  - bash: ./scripts/ci/install_docker.sh
    displayName: Install Docker

  - bash: |
      set -ex

      CLI_VERSION=`cat $SYSTEM_ARTIFACTSDIRECTORY/metadata/version`
      RPM_NAME=$(find $SYSTEM_ARTIFACTSDIRECTORY/rpm/ -type f -name "azure-cli-$CLI_VERSION-1.*.rpm" -printf '%f\n')

      echo "== Test rpm package on ${IMAGE} =="
      docker pull $IMAGE
      docker run --rm -e RPM_NAME=$RPM_NAME -v $SYSTEM_ARTIFACTSDIRECTORY/rpm:/mnt/rpm -v $(pwd):/azure-cli $IMAGE /bin/bash "/azure-cli/scripts/release/rpm/test_azurelinux_in_docker.sh"

    displayName: 'Test Rpm Package Azure Linux'

# TODO: rpmbuild on Red Hat UBI 8 is slow for unknown reason. Still working with Red Hat to investigate.
- job: BuildRpmPackages
  displayName: Build Rpm Packages
  # Do not run this job for Pull Requests due to the slowness
  condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
  pool:
    name: $(pool)
  strategy:
    matrix:
      ${{ each arch in parameters.architectures }}:
        Red Hat Universal Base Image 8 ${{ arch.name }}:
          dockerfile: ubi
          image: registry.access.redhat.com/ubi8/ubi:8.4
          artifact: rpm-ubi8-${{ arch.value }}
          python_package: python3.12
          pool: ${{ arch.pool }}
        Red Hat Universal Base Image 9 ${{ arch.name }}:
          dockerfile: ubi
          image: registry.access.redhat.com/ubi9/ubi:9.0.0
          artifact: rpm-ubi9-${{ arch.value }}
          python_package: python3.12
          pool: ${{ arch.pool }}
        Red Hat Universal Base Image 10 ${{ arch.name }}:
          dockerfile: ubi
          image: registry.access.redhat.com/ubi10/ubi:10.0
          artifact: rpm-ubi10-${{ arch.value }}
          python_package: python3.12
          pool: ${{ arch.pool }}
  steps:
  - bash: ./scripts/ci/install_docker.sh
    displayName: Install Docker
  - task: PipAuthenticate@1
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    displayName: 'Pip Authenticate'
    inputs:
      artifactFeeds: $(AZURE_ARTIFACTS_FEEDS)
  - task: Bash@3
    displayName: 'Build Rpm Package'
    inputs:
      targetType: 'filePath'
      filePath: scripts/release/rpm/pipeline.sh
  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
    displayName: 'SBOM'
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    inputs:
      BuildDropPath: $(Build.ArtifactStagingDirectory)
  - task: PublishPipelineArtifact@0
    displayName: 'Publish Artifact: rpm'
    inputs:
      TargetPath: $(Build.ArtifactStagingDirectory)
      ArtifactName: $(artifact)


- job: TestRpmPackage
  displayName: Test Rpm Package
  timeoutInMinutes: 180
  dependsOn:
    - BuildRpmPackages
    - ExtractMetadata
  condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
  pool:
    name: $(pool)
  strategy:
    matrix:
      ${{ each arch in parameters.architectures }}:
        Red Hat Universal Base Image 8 ${{ arch.name }}:
          artifact: rpm-ubi8-${{ arch.value }}
          distro: el8
          image: registry.access.redhat.com/ubi8/ubi:8.4
          python_package: python3.12
          python_cmd: python3.12
          pip_cmd: pip3.12
          pool: ${{ arch.pool }}
        Red Hat Universal Base Image 9 ${{ arch.name }}:
          artifact: rpm-ubi9-${{ arch.value }}
          distro: el9
          image: registry.access.redhat.com/ubi9/ubi:9.0.0
          python_package: python3.12
          python_cmd: python3.12
          pip_cmd: pip3.12
          pool: ${{ arch.pool }}
        Red Hat Universal Base Image 10 ${{ arch.name }}:
          artifact: rpm-ubi10-${{ arch.value }}
          distro: el10
          image: registry.access.redhat.com/ubi10/ubi:10.0
          python_package: python3.12
          python_cmd: python3.12
          pip_cmd: pip3.12
          pool: ${{ arch.pool }}
  steps:
  - task: DownloadPipelineArtifact@1
    displayName: 'Download Metadata'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
      artifactName: metadata

  - task: DownloadPipelineArtifact@1
    displayName: 'Download Build Artifacts'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/rpm'
      artifactName: $(artifact)

  - bash: ./scripts/ci/install_docker.sh
    displayName: Install Docker

  - bash: |
      set -ex
      
      CLI_VERSION=`cat $SYSTEM_ARTIFACTSDIRECTORY/metadata/version`
      RPM_NAME=$(find $SYSTEM_ARTIFACTSDIRECTORY/rpm/ -type f -name "azure-cli-$CLI_VERSION-1.${DISTRO}.*.rpm" -printf '%f\n')
      
      echo "== Test rpm package on ${IMAGE} =="
      docker pull $IMAGE
      docker run --rm -e RPM_NAME=$RPM_NAME -e PYTHON_PACKAGE=${PYTHON_PACKAGE} -e PYTHON_CMD=${PYTHON_CMD} -e PIP_CMD=${PIP_CMD} -v $SYSTEM_ARTIFACTSDIRECTORY/rpm:/mnt/rpm -v $(pwd):/azure-cli $IMAGE /bin/bash "/azure-cli/scripts/release/rpm/test_rpm_in_docker.sh"

    displayName: 'Test Rpm Package'

- job: BuildDebPackages
  displayName: Build Deb Packages
  condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
  pool:
    name: $(pool)
  strategy:
    matrix:
      ${{ each arch in parameters.architectures }}:
        # https://wiki.ubuntu.com/Releases
        Jammy ${{ arch.name }}:
          # 22.04
          deb_system: ubuntu
          distro: jammy
          arch: ${{ arch.value }}
          pool: ${{ arch.pool }}

        Noble ${{ arch.name }}:
          # 24.04
          deb_system: ubuntu
          distro: noble
          arch: ${{ arch.value }}
          pool: ${{ arch.pool }}

        Resolute ${{ arch.name }}:
          # 26.04
          deb_system: ubuntu
          distro: resolute
          arch: ${{ arch.value }}
          pool: ${{ arch.pool }}

        # https://wiki.debian.org/DebianReleases
        Bookworm ${{ arch.name }}:
          # 12
          deb_system: debian
          distro: bookworm
          arch: ${{ arch.value }}
          pool: ${{ arch.pool }}
  steps:
  - bash: ./scripts/ci/install_docker.sh
    displayName: Install Docker
  - task: PipAuthenticate@1
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    displayName: 'Pip Authenticate'
    inputs:
      artifactFeeds: $(AZURE_ARTIFACTS_FEEDS)
  - task: Bash@3
    displayName: 'Build $(deb_system) $(distro) $(arch) Package'
    inputs:
      targetType: 'filePath'
      filePath: scripts/release/debian/pipeline.sh
    env:
      DISTRO_BASE_IMAGE: mcr.microsoft.com/mirror/docker/library/$(deb_system):$(distro)

  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
    displayName: 'SBOM'
    condition: startsWith(variables['Build.SourceBranch'], 'refs/heads/release')
    inputs:
      BuildDropPath: $(Build.ArtifactStagingDirectory)

  - task: PublishPipelineArtifact@0
    displayName: 'Publish Artifact: $(deb_system) $(distro) $(arch)'
    inputs:
      TargetPath: $(Build.ArtifactStagingDirectory)
      ArtifactName: $(deb_system)-$(distro)-$(arch)

- job: TestDebPackages
  timeoutInMinutes: 180
  displayName: Test Deb Packages
  dependsOn:
  - BuildDebPackages
  condition: and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI', 'Manual', 'Schedule'))
  strategy:
    matrix:
      ${{ each arch in parameters.architectures }}:
        Resolute ${{ arch.name }}:
          deb_system: ubuntu
          distro: resolute
          arch: ${{ arch.value }}
          pool: ${{ arch.pool }}
        Jammy ${{ arch.name }}:
          deb_system: ubuntu
          distro: jammy
          arch: ${{ arch.value }}
          pool: ${{ arch.pool }}
        Noble ${{ arch.name }}:
          deb_system: ubuntu
          distro: noble
          arch: ${{ arch.value }}
          pool: ${{ arch.pool }}
        Bookworm ${{ arch.name }}:
          deb_system: debian
          distro: bookworm
          arch: ${{ arch.value }}
          pool: ${{ arch.pool }}
  pool:
    name: $(pool)
  steps:
  - bash: ./scripts/ci/install_docker.sh
    displayName: Install Docker
  - task: DownloadPipelineArtifact@1
    displayName: 'Download Metadata'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/metadata'
      artifactName: metadata

  - task: DownloadPipelineArtifact@1
    displayName: 'Download $(deb_system):$(distro) $(arch) Build'
    inputs:
      TargetPath: '$(Build.ArtifactStagingDirectory)/debian'
      artifactName: $(deb_system)-$(distro)-$(arch)

  - task: Bash@3
    displayName: 'Test $(deb_system) $(distro) $(arch) Package'
    env:
      DISTRO_BASE_IMAGE: mcr.microsoft.com/mirror/docker/library/$(deb_system):$(distro)
    inputs:
      targetType: 'inline'
      script: |
        set -exv
        CLI_VERSION=`cat $SYSTEM_ARTIFACTSDIRECTORY/metadata/version`
        
        echo "== Test debian package on ${DISTRO} =="
        docker pull ${DISTRO_BASE_IMAGE}
        docker run --rm -e DISTRO=${DISTRO} -e CLI_VERSION=$CLI_VERSION -v $SYSTEM_ARTIFACTSDIRECTORY/debian:/mnt/artifacts -v $(pwd):/azure-cli ${DISTRO_BASE_IMAGE} /bin/bash "/azure-cli/scripts/release/debian/test_deb_in_docker.sh"

- job: VerifyLatestIndices
  displayName: "Verify latest index assets"
  timeoutInMinutes: 20
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'
  - template: .azure-pipelines/templates/azdev_setup.yml
  - bash: |
      set -ev
      . env/bin/activate
      azdev latest-index verify --repo .
    displayName: 'Verify generated latest indices'

- job: CheckStyle
  displayName: "Check CLI Style"
  timeoutInMinutes: 120
  pool:
    name: ${{ variables.ubuntu_multi_core_pool }}
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'
  - template: .azure-pipelines/templates/azdev_setup.yml
  - bash: |
      set -ev
      . env/bin/activate
      azdev style

- job: CheckHeaders
  displayName: "Check License, History, and DocMap"
  condition: and(not(contains(variables['Build.SourceBranch'], 'lts')), not(contains(variables['System.PullRequest.TargetBranch'], 'lts')))
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'
  - template: .azure-pipelines/templates/azdev_setup.yml
  - bash: |
      set -ev
      . env/bin/activate
      azdev verify license
      azdev verify history
      azdev verify document-map

- job: PerformanceCheck
  displayName: "PerformanceCheck"
  strategy:
    matrix:
      Python312:
        python.version: '3.12'
      Python314:
        python.version: '3.14'
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python $(python.version)'
    inputs:
      versionSpec: '$(python.version)'
  - template: .azure-pipelines/templates/azdev_setup.yml
  - bash: |
      set -ev
      . env/bin/activate
      azdev perf load-times
    displayName: "Load Performance"
  # - bash: |
  #     set -ev
  #     . env/bin/activate

  #     azdev perf benchmark "version" "network vnet -h" "rest -h" "storage account"
  #   displayName: "Execution Performance"

- job: CheckExternalUrls
  displayName: "Check External Source URLs"
  condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
    - task: UsePythonVersion@0
      displayName: 'Use Python 3.14'
      inputs:
        versionSpec: '3.14'
    - bash: |
        #!/usr/bin/env bash
        set -ev
        # External URL exclusions are maintained in scripts/ci/external_url_exclusions.json.
        git fetch origin --depth=1 $(System.PullRequest.TargetBranch)
        python scripts/ci/validate_external_source_urls.py --src=HEAD --tgt=origin/$(System.PullRequest.TargetBranch)
      displayName: 'Validate External Source URLs'

- job: CheckLinter
  displayName: "Check CLI Linter"

  pool:
    name: ${{ variables.ubuntu_multi_core_pool }}
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.14'
    inputs:
      versionSpec: '3.14'
  - template: .azure-pipelines/templates/azdev_setup.yml
  - bash: |
      set -ev
      . env/bin/activate
      python scripts/ci/service_name.py
      if [[ "$(System.PullRequest.TargetBranch)" != "" ]]; then
        # If CI is set to shallow fetch, target branch should be expilictly fetched.
        git fetch origin --depth=1 $(System.PullRequest.TargetBranch)
        azdev linter --ci-exclusions --min-severity medium --repo=./ --src=HEAD --tgt=origin/$(System.PullRequest.TargetBranch)
      else
        azdev linter --ci-exclusions --min-severity medium
      fi

- job: AzdevScan
  condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
  displayName: "Secret Scan"
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
    - task: UsePythonVersion@0
      displayName: 'Use Python 3.14'
      inputs:
        versionSpec: '3.14'
    - template: .azure-pipelines/templates/azdev_setup.yml
    - bash: |
        set -ev
        . env/bin/activate
        git fetch origin --depth=1 $(System.PullRequest.TargetBranch)
        declare -A secret_files
        IFS_OLD=${IFS}
        IFS=$'\n'
        for FILE in `git diff --name-only --diff-filter=AM origin/$(System.PullRequest.TargetBranch)` ; do
          echo $FILE
          detected=$(azdev scan -f "$FILE" --continue-on-failure | python -c "import sys, json; print(json.load(sys.stdin)['secrets_detected'])")
          if [ $detected == 'True' ]; then
            printf "\033[0;31mDetected secrets from %s, You can run 'azdev mask' to remove secrets.\033[0m\n" "$FILE"
            secret_files+=$FILE
          fi
        done
        IFS=${IFS_OLD}
        if [ "${#secret_files[@]}" -gt 0 ]; then
          exit 1
        fi

- job: CodegenCoverage
  condition: in(variables['Build.Reason'], 'BatchedCI', 'IndividualCI')
  timeoutInMinutes: 180
  displayName: "Codegen Coverage"
  continueOnError: true
  pool:
    name: ${{ variables.ubuntu_pool }}
  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.11'
    inputs:
      versionSpec: '3.11'
  - template: .azure-pipelines/templates/azdev_setup.yml
  - bash: |
      set -ev
      . env/bin/activate
      # clone azure-cli-extensions
      cd ..
      git clone --depth 1 -b main https://github.com/Azure/azure-cli-extensions.git ./azure-cli-extensions
      azdev extension repo add ./azure-cli-extensions
      azdev extension add "*"
      pip install msrestazure markupsafe==2.0.1
      # Some extension will change the dependence, so run `azdev setup` again after all extensions installed.
      azdev setup -c ./s -r ./azure-cli-extensions

      mkdir -p /tmp/module_stats

      find /mnt/vss/_work/1/s/src/azure-cli/azure/cli/command_modules/ -mindepth 1 -maxdepth 1 -type d -printf "%f\n" | grep -v '^__pycache__$' > /mnt/vss/_work/1/s/scripts/ci/core_modules.txt
      echo "=== Core Modules ==="
      cat /mnt/vss/_work/1/s/scripts/ci/core_modules.txt

      find /mnt/vss/_work/1/azure-cli-extensions/src/ -mindepth 1 -maxdepth 1 -type d -printf "%f\n" | grep -v '^__pycache__$' > /mnt/vss/_work/1/s/scripts/ci/extension_modules.txt
      echo "=== Extension Modules ==="
      cat /mnt/vss/_work/1/s/scripts/ci/extension_modules.txt

      for module in $(cat /mnt/vss/_work/1/s/scripts/ci/core_modules.txt); do
        azdev statistics list-command-table $module --statistics-only > /tmp/module_stats/${module}.json || true
      done

      for module in $(cat /mnt/vss/_work/1/s/scripts/ci/extension_modules.txt); do
        azdev statistics list-command-table $module --statistics-only > /tmp/module_stats/${module}.json || true
      done
      azdev statistics list-command-table --statistics-only > /tmp/codegen_report.json || true
      python /mnt/vss/_work/1/s/scripts/ci/codegen_report.py
    env:
      BUILD_ID: $(Build.BuildId)
      BUILD_BRANCH: $(Build.SourceBranchName)
    enabled: true