From 6d96245bc4f8596c1191baac3e08d9a1600d2d7d Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Tue, 15 Jul 2025 16:46:52 -0700 Subject: [PATCH 01/11] 1ES PT --- .config/tsaoptions.json | 9 ++ .../mac-ios-spm-dev-validation-pipeline.yml | 97 +++++++------------ .pipelines/official.yml | 38 ++++++++ .pipelines/templates/main.yml | 45 +++++++++ 4 files changed, 128 insertions(+), 61 deletions(-) create mode 100644 .config/tsaoptions.json create mode 100644 .pipelines/official.yml create mode 100644 .pipelines/templates/main.yml diff --git a/.config/tsaoptions.json b/.config/tsaoptions.json new file mode 100644 index 0000000..00090af --- /dev/null +++ b/.config/tsaoptions.json @@ -0,0 +1,9 @@ +{ + "notificationAliases": ["xiaowuhu@microsoft.com"], + "areaPath": "ONNX Runtime\\Extensions", + "codebaseName": "onnxconverter-common", + "instanceUrl": "https://aiinfra.visualstudio.com/", + "projectName": "ONNX Runtime", + "ignoreBranchName": true, + "template": "AIINFRA_TSA" +} diff --git a/.pipelines/mac-ios-spm-dev-validation-pipeline.yml b/.pipelines/mac-ios-spm-dev-validation-pipeline.yml index 2a99b2b..b718b9f 100644 --- a/.pipelines/mac-ios-spm-dev-validation-pipeline.yml +++ b/.pipelines/mac-ios-spm-dev-validation-pipeline.yml @@ -1,63 +1,38 @@ - jobs: - - job: j - displayName: "Test with latest local ORT native pod" +trigger: none +# The `resources` specify the location and version of the 1ES PT. +resources: + pipelines: + - pipeline: 'pod' + project: 'Lotus' + source: 'onnxruntime-ios-packaging-pipeline' + repositories: + - repository: 1esPipelines + type: git + name: 1ESPipelineTemplates/1ESPipelineTemplates + ref: refs/tags/release + +extends: + template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines + parameters: pool: - vmImage: "macOS-13" - - variables: - artifactsName: "ios_packaging_artifacts_full" - - timeoutInMinutes: 60 - - steps: - - template: templates/use-xcode-version.yml - - # Download artifacts from a specific pipeline - # It consumes a latest dev version ORT iOS Pod which should match with the source code - - task: DownloadPipelineArtifact@2 - inputs: - buildType: 'specific' - project: 'Lotus' - definition: 995 #'definitionid' is obtained from `System.DefinitionId` of ORT CI: onnxruntime-ios-packaging-pipeline - buildVersionToDownload: 'latestFromBranch' - branchName: 'refs/heads/main' - targetPath: '$(Build.ArtifactStagingDirectory)' - - - script: | - set -e -x - ls - workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactsName)' - displayName: "List staged artifacts" - - - script: | - POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-objc*.zip") - unzip ${POD_ARCHIVE} -d unzipped - cp -rf unzipped/objectivec/ $(Build.SourcesDirectory)/objectivec/ - workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactsName)' - displayName: Copy latest dev version ORT objectivec/ source files - - # copy the pod archive to a path relative to Package.swift and set the env var required by Package.swift to use that. - # xcodebuild will implicitly use Package.swift and build/run the .testTarget (tests in swift/onnxTests). - # once that's done cleanup the copy of the pod zip file - - script: | - set -e -x - cd "$(Build.ArtifactStagingDirectory)/$(artifactsName)" - POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-c*.zip") - - shasum -a 256 "$(Build.ArtifactStagingDirectory)/$(artifactsName)/${POD_ARCHIVE}" - - cd "$(Build.SourcesDirectory)" - cp "$(Build.ArtifactStagingDirectory)/$(artifactsName)/${POD_ARCHIVE}" swift/ - export ORT_POD_LOCAL_PATH="swift/${POD_ARCHIVE}" - xcodebuild test -scheme onnxruntime-Package -destination 'platform=iOS Simulator,name=iPhone 14' - - xcodebuild test -scheme onnxruntime-Package -destination 'platform=macosx' - - rm swift/pod-archive-onnxruntime-c-*.zip - workingDirectory: "$(Build.SourcesDirectory)" - displayName: "Print ORT iOS Pod checksum and Test Package.swift usage" - - - template: templates/component-governance-component-detection-steps.yml - parameters: - condition: 'succeeded' \ No newline at end of file + name: Azure Pipelines + image: "macOS-13" + os: macOS + sdl: + sourceAnalysisPool: + name: onnxruntime-Win-CPU-2022 + os: windows + policheck: + enabled: true + credscan: + enabled: true + codeql: + sourceLanguages: python + tsa: + enabled: false + configFile: '$(Build.SourcesDirectory)\.config\tsaoptions.json' + stages: + - stage: Stage + jobs: + - template: .pipelines/templates/main.yml@self \ No newline at end of file diff --git a/.pipelines/official.yml b/.pipelines/official.yml new file mode 100644 index 0000000..3a91380 --- /dev/null +++ b/.pipelines/official.yml @@ -0,0 +1,38 @@ +trigger: none + +# The `resources` specify the location and version of the 1ES PT. +resources: + pipelines: + - pipeline: 'pod' + project: 'Lotus' + source: 'onnxruntime-ios-packaging-pipeline' + repositories: + - repository: 1esPipelines + type: git + name: 1ESPipelineTemplates/1ESPipelineTemplates + ref: refs/tags/release + +extends: + template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines + parameters: + pool: + name: Azure Pipelines + image: "macOS-13" + os: macOS + sdl: + sourceAnalysisPool: + name: onnxruntime-Win-CPU-2022 + os: windows + policheck: + enabled: true + credscan: + enabled: true + codeql: + sourceLanguages: python + tsa: + enabled: true + configFile: '$(Build.SourcesDirectory)\.config\tsaoptions.json' + stages: + - stage: Stage + jobs: + - template: .pipelines/templates/main.yml@self \ No newline at end of file diff --git a/.pipelines/templates/main.yml b/.pipelines/templates/main.yml new file mode 100644 index 0000000..f793343 --- /dev/null +++ b/.pipelines/templates/main.yml @@ -0,0 +1,45 @@ +jobs: +- job: main + templateContext: + isProduction: false + inputs: + - input: pipelineArtifact + pipeline: 'pod' + artifactName: 'ios_packaging_artifacts_full' + targetPath: '$(Build.ArtifactStagingDirectory)/ios_packaging_artifacts_full' + steps: + - task: UsePythonVersion@0 + inputs: + versionSpec: '3.x' + architecture: 'x64' + - task: PipAuthenticate@1 + displayName: 'Pip Authenticate' + inputs: + artifactFeeds: 'Lotus' + - script: | + POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-objc*.zip") + unzip ${POD_ARCHIVE} -d unzipped + cp -rf unzipped/objectivec/ $(Build.SourcesDirectory)/objectivec/ + workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactsName)' + displayName: Copy latest dev version ORT objectivec/ source files + + # copy the pod archive to a path relative to Package.swift and set the env var required by Package.swift to use that. + # xcodebuild will implicitly use Package.swift and build/run the .testTarget (tests in swift/onnxTests). + # once that's done cleanup the copy of the pod zip file + - script: | + set -e -x + cd "$(Build.ArtifactStagingDirectory)/$(artifactsName)" + POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-c*.zip") + + shasum -a 256 "$(Build.ArtifactStagingDirectory)/$(artifactsName)/${POD_ARCHIVE}" + + cd "$(Build.SourcesDirectory)" + cp "$(Build.ArtifactStagingDirectory)/$(artifactsName)/${POD_ARCHIVE}" swift/ + export ORT_POD_LOCAL_PATH="swift/${POD_ARCHIVE}" + xcodebuild test -scheme onnxruntime-Package -destination 'platform=iOS Simulator,name=iPhone 14' + + xcodebuild test -scheme onnxruntime-Package -destination 'platform=macosx' + + rm swift/pod-archive-onnxruntime-c-*.zip + workingDirectory: "$(Build.SourcesDirectory)" + displayName: "Print ORT iOS Pod checksum and Test Package.swift usage" \ No newline at end of file From 271184daab064bf1617870e248d5220f6e98133c Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Tue, 15 Jul 2025 16:48:24 -0700 Subject: [PATCH 02/11] update --- .pipelines/templates/main.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.pipelines/templates/main.yml b/.pipelines/templates/main.yml index f793343..497d236 100644 --- a/.pipelines/templates/main.yml +++ b/.pipelines/templates/main.yml @@ -17,11 +17,12 @@ jobs: inputs: artifactFeeds: 'Lotus' - script: | - POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-objc*.zip") - unzip ${POD_ARCHIVE} -d unzipped - cp -rf unzipped/objectivec/ $(Build.SourcesDirectory)/objectivec/ - workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactsName)' - displayName: Copy latest dev version ORT objectivec/ source files + set -e -x + POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-objc*.zip") + unzip ${POD_ARCHIVE} -d unzipped + cp -rf unzipped/objectivec/ $(Build.SourcesDirectory)/objectivec/ + workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactsName)' + displayName: Copy latest dev version ORT objectivec/ source files # copy the pod archive to a path relative to Package.swift and set the env var required by Package.swift to use that. # xcodebuild will implicitly use Package.swift and build/run the .testTarget (tests in swift/onnxTests). From 34849117626cf9af4eb77a24cf22f2baf426b2ef Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Tue, 15 Jul 2025 16:52:25 -0700 Subject: [PATCH 03/11] update --- .pipelines/templates/main.yml | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/.pipelines/templates/main.yml b/.pipelines/templates/main.yml index 497d236..dd79078 100644 --- a/.pipelines/templates/main.yml +++ b/.pipelines/templates/main.yml @@ -1,3 +1,8 @@ +parameters: +- name: artifactName + type: string + default: 'ios_packaging_artifacts_full' + jobs: - job: main templateContext: @@ -5,8 +10,8 @@ jobs: inputs: - input: pipelineArtifact pipeline: 'pod' - artifactName: 'ios_packaging_artifacts_full' - targetPath: '$(Build.ArtifactStagingDirectory)/ios_packaging_artifacts_full' + artifactName: '${{ parameters.artifactName }}' + targetPath: '$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}' steps: - task: UsePythonVersion@0 inputs: @@ -21,7 +26,8 @@ jobs: POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-objc*.zip") unzip ${POD_ARCHIVE} -d unzipped cp -rf unzipped/objectivec/ $(Build.SourcesDirectory)/objectivec/ - workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactsName)' + # Corrected variable name to match the parameter + workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactName)' displayName: Copy latest dev version ORT objectivec/ source files # copy the pod archive to a path relative to Package.swift and set the env var required by Package.swift to use that. @@ -29,18 +35,19 @@ jobs: # once that's done cleanup the copy of the pod zip file - script: | set -e -x - cd "$(Build.ArtifactStagingDirectory)/$(artifactsName)" + # Corrected variable name to match the parameter + cd "$(Build.ArtifactStagingDirectory)/$(artifactName)" POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-c*.zip") - shasum -a 256 "$(Build.ArtifactStagingDirectory)/$(artifactsName)/${POD_ARCHIVE}" + shasum -a 256 "$(Build.ArtifactStagingDirectory)/$(artifactName)/${POD_ARCHIVE}" cd "$(Build.SourcesDirectory)" - cp "$(Build.ArtifactStagingDirectory)/$(artifactsName)/${POD_ARCHIVE}" swift/ + cp "$(Build.ArtifactStagingDirectory)/$(artifactName)/${POD_ARCHIVE}" swift/ export ORT_POD_LOCAL_PATH="swift/${POD_ARCHIVE}" xcodebuild test -scheme onnxruntime-Package -destination 'platform=iOS Simulator,name=iPhone 14' xcodebuild test -scheme onnxruntime-Package -destination 'platform=macosx' - + rm swift/pod-archive-onnxruntime-c-*.zip workingDirectory: "$(Build.SourcesDirectory)" - displayName: "Print ORT iOS Pod checksum and Test Package.swift usage" \ No newline at end of file + displayName: "Print ORT iOS Pod checksum and Test Package.swift usage" From 0ee96ab33a5a115c19b459a8c02b96f36fc6d256 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Tue, 15 Jul 2025 16:56:10 -0700 Subject: [PATCH 04/11] update --- .config/tsaoptions.json | 6 +++--- .pipelines/templates/main.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.config/tsaoptions.json b/.config/tsaoptions.json index 00090af..7a1f6b0 100644 --- a/.config/tsaoptions.json +++ b/.config/tsaoptions.json @@ -1,9 +1,9 @@ { - "notificationAliases": ["xiaowuhu@microsoft.com"], + "notificationAliases": ["onnxruntime-org@microsoft.com"], "areaPath": "ONNX Runtime\\Extensions", - "codebaseName": "onnxconverter-common", + "codebaseName": "onnxruntime-swift-package-manager", "instanceUrl": "https://aiinfra.visualstudio.com/", "projectName": "ONNX Runtime", - "ignoreBranchName": true, + "ignoreBranchName": false, "template": "AIINFRA_TSA" } diff --git a/.pipelines/templates/main.yml b/.pipelines/templates/main.yml index dd79078..936b231 100644 --- a/.pipelines/templates/main.yml +++ b/.pipelines/templates/main.yml @@ -27,7 +27,7 @@ jobs: unzip ${POD_ARCHIVE} -d unzipped cp -rf unzipped/objectivec/ $(Build.SourcesDirectory)/objectivec/ # Corrected variable name to match the parameter - workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactName)' + workingDirectory: '$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}' displayName: Copy latest dev version ORT objectivec/ source files # copy the pod archive to a path relative to Package.swift and set the env var required by Package.swift to use that. @@ -36,13 +36,13 @@ jobs: - script: | set -e -x # Corrected variable name to match the parameter - cd "$(Build.ArtifactStagingDirectory)/$(artifactName)" + cd "$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}" POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-c*.zip") - shasum -a 256 "$(Build.ArtifactStagingDirectory)/$(artifactName)/${POD_ARCHIVE}" + shasum -a 256 "$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}/${POD_ARCHIVE}" cd "$(Build.SourcesDirectory)" - cp "$(Build.ArtifactStagingDirectory)/$(artifactName)/${POD_ARCHIVE}" swift/ + cp "$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}/${POD_ARCHIVE}" swift/ export ORT_POD_LOCAL_PATH="swift/${POD_ARCHIVE}" xcodebuild test -scheme onnxruntime-Package -destination 'platform=iOS Simulator,name=iPhone 14' From 8d850f8f4c96d908d757984a4991acdd49de8c67 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Tue, 15 Jul 2025 17:00:07 -0700 Subject: [PATCH 05/11] 1ES PT --- .pipelines/mac-ios-spm-dev-validation-pipeline.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.pipelines/mac-ios-spm-dev-validation-pipeline.yml b/.pipelines/mac-ios-spm-dev-validation-pipeline.yml index b718b9f..449e627 100644 --- a/.pipelines/mac-ios-spm-dev-validation-pipeline.yml +++ b/.pipelines/mac-ios-spm-dev-validation-pipeline.yml @@ -15,6 +15,8 @@ resources: extends: template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines parameters: + settings: + networkIsolationPolicy: Preferred, GitHub pool: name: Azure Pipelines image: "macOS-13" From b28c460003396325d63c897c6b2b2bab2fdc35ce Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Tue, 15 Jul 2025 17:08:55 -0700 Subject: [PATCH 06/11] Remove extra jobs --- .pipelines/templates/main.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.pipelines/templates/main.yml b/.pipelines/templates/main.yml index 936b231..54c328f 100644 --- a/.pipelines/templates/main.yml +++ b/.pipelines/templates/main.yml @@ -13,14 +13,6 @@ jobs: artifactName: '${{ parameters.artifactName }}' targetPath: '$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}' steps: - - task: UsePythonVersion@0 - inputs: - versionSpec: '3.x' - architecture: 'x64' - - task: PipAuthenticate@1 - displayName: 'Pip Authenticate' - inputs: - artifactFeeds: 'Lotus' - script: | set -e -x POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-objc*.zip") From 974cea418e6ea6e81820027720e1dcae45ce1b95 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Tue, 15 Jul 2025 17:09:43 -0700 Subject: [PATCH 07/11] update --- .pipelines/official.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.pipelines/official.yml b/.pipelines/official.yml index 3a91380..0ff76d1 100644 --- a/.pipelines/official.yml +++ b/.pipelines/official.yml @@ -15,6 +15,8 @@ resources: extends: template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines parameters: + settings: + networkIsolationPolicy: Preferred, GitHub pool: name: Azure Pipelines image: "macOS-13" From 208bcda3de8456125efc6beaf32b4993abcd7396 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Tue, 15 Jul 2025 17:12:49 -0700 Subject: [PATCH 08/11] Update ADO PATH --- .config/tsaoptions.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/tsaoptions.json b/.config/tsaoptions.json index 7a1f6b0..5108b2b 100644 --- a/.config/tsaoptions.json +++ b/.config/tsaoptions.json @@ -1,6 +1,6 @@ { "notificationAliases": ["onnxruntime-org@microsoft.com"], - "areaPath": "ONNX Runtime\\Extensions", + "areaPath": "ONNX Runtime\\Engineering Systems", "codebaseName": "onnxruntime-swift-package-manager", "instanceUrl": "https://aiinfra.visualstudio.com/", "projectName": "ONNX Runtime", From ba6e1a6e922a538ceda075444ac7985570d39c04 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Wed, 16 Jul 2025 22:34:51 -0700 Subject: [PATCH 09/11] Update official.yml --- .pipelines/official.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.pipelines/official.yml b/.pipelines/official.yml index 0ff76d1..38cb5dd 100644 --- a/.pipelines/official.yml +++ b/.pipelines/official.yml @@ -19,7 +19,7 @@ extends: networkIsolationPolicy: Preferred, GitHub pool: name: Azure Pipelines - image: "macOS-13" + image: "macOS-14" os: macOS sdl: sourceAnalysisPool: @@ -37,4 +37,4 @@ extends: stages: - stage: Stage jobs: - - template: .pipelines/templates/main.yml@self \ No newline at end of file + - template: .pipelines/templates/main.yml@self From 97f21b15c29b4f6182b4ec6fda96591a4a7f20a4 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Wed, 16 Jul 2025 22:35:12 -0700 Subject: [PATCH 10/11] Update mac-ios-spm-dev-validation-pipeline.yml --- .pipelines/mac-ios-spm-dev-validation-pipeline.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.pipelines/mac-ios-spm-dev-validation-pipeline.yml b/.pipelines/mac-ios-spm-dev-validation-pipeline.yml index 449e627..d3f9765 100644 --- a/.pipelines/mac-ios-spm-dev-validation-pipeline.yml +++ b/.pipelines/mac-ios-spm-dev-validation-pipeline.yml @@ -19,7 +19,7 @@ extends: networkIsolationPolicy: Preferred, GitHub pool: name: Azure Pipelines - image: "macOS-13" + image: "macOS-14" os: macOS sdl: sourceAnalysisPool: @@ -37,4 +37,4 @@ extends: stages: - stage: Stage jobs: - - template: .pipelines/templates/main.yml@self \ No newline at end of file + - template: .pipelines/templates/main.yml@self From 4ec6a36a11764d774bf1ad9925385abb85043467 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Wed, 16 Jul 2025 22:40:53 -0700 Subject: [PATCH 11/11] Update main.yml --- .pipelines/templates/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pipelines/templates/main.yml b/.pipelines/templates/main.yml index 54c328f..0f81c00 100644 --- a/.pipelines/templates/main.yml +++ b/.pipelines/templates/main.yml @@ -36,7 +36,7 @@ jobs: cd "$(Build.SourcesDirectory)" cp "$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}/${POD_ARCHIVE}" swift/ export ORT_POD_LOCAL_PATH="swift/${POD_ARCHIVE}" - xcodebuild test -scheme onnxruntime-Package -destination 'platform=iOS Simulator,name=iPhone 14' + xcodebuild test -scheme onnxruntime-Package -destination 'platform=iOS Simulator,name=iPhone 16' xcodebuild test -scheme onnxruntime-Package -destination 'platform=macosx'