Convert dev validation pipeline to 1ES PT (#32)

.config/tsaoptions.json

@@ -0,0 +1,9 @@
+{
+  "notificationAliases": ["onnxruntime-org@microsoft.com"],
+  "areaPath": "ONNX Runtime\\Engineering Systems",
+  "codebaseName": "onnxruntime-swift-package-manager",
+  "instanceUrl": "https://aiinfra.visualstudio.com/",
+  "projectName": "ONNX Runtime",
+  "ignoreBranchName": false,
+  "template": "AIINFRA_TSA"
+}

.pipelines/mac-ios-spm-dev-validation-pipeline.yml

@@ -1,63 +1,40 @@
-  jobs:
+trigger: none
-  - job: j
-    displayName: "Test with latest local ORT native pod"
 
+# The `resources` specify the location and version of the 1ES PT.
+resources:
+  pipelines:
+  - pipeline: 'pod'
+    project: 'Lotus'
+    source: 'onnxruntime-ios-packaging-pipeline'
+  repositories:
+  - repository: 1esPipelines
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines
+  parameters:
+    settings:
+      networkIsolationPolicy: Preferred, GitHub
     pool:
-      vmImage: "macOS-13"
+      name: Azure Pipelines
-
+      image: "macOS-14"
-    variables:
+      os: macOS      
-      artifactsName: "ios_packaging_artifacts_full"
+    sdl:
-
+      sourceAnalysisPool:
-    timeoutInMinutes: 60
+        name: onnxruntime-Win-CPU-2022
-
+        os: windows
-    steps:
+      policheck:
-    - template: templates/use-xcode-version.yml
+        enabled: true
-    
+      credscan:
-    # Download artifacts from a specific pipeline 
+        enabled: true
-    # It consumes a latest dev version ORT iOS Pod which should match with the source code
+      codeql:
-    - task: DownloadPipelineArtifact@2
+        sourceLanguages: python
-      inputs:
+      tsa:
-        buildType: 'specific'
+        enabled: false
-        project: 'Lotus'
+        configFile: '$(Build.SourcesDirectory)\.config\tsaoptions.json'
-        definition: 995          #'definitionid' is obtained from `System.DefinitionId` of ORT CI: onnxruntime-ios-packaging-pipeline
+    stages:
-        buildVersionToDownload: 'latestFromBranch'
+    - stage: Stage
-        branchName: 'refs/heads/main'
+      jobs:
-        targetPath: '$(Build.ArtifactStagingDirectory)'
+      - template: .pipelines/templates/main.yml@self
-
-    - script: |
-        set -e -x
-        ls
-      workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactsName)'
-      displayName: "List staged artifacts"
-
-    - script: |
-        POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-objc*.zip")
-        unzip ${POD_ARCHIVE} -d unzipped
-        cp -rf unzipped/objectivec/ $(Build.SourcesDirectory)/objectivec/
-      workingDirectory: '$(Build.ArtifactStagingDirectory)/$(artifactsName)'
-      displayName: Copy latest dev version ORT objectivec/ source files
-
-    # copy the pod archive to a path relative to Package.swift and set the env var required by Package.swift to use that.
-    # xcodebuild will implicitly use Package.swift and build/run the .testTarget (tests in swift/onnxTests).
-    # once that's done cleanup the copy of the pod zip file
-    - script: |
-        set -e -x
-        cd "$(Build.ArtifactStagingDirectory)/$(artifactsName)"
-        POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-c*.zip")
-
-        shasum -a 256 "$(Build.ArtifactStagingDirectory)/$(artifactsName)/${POD_ARCHIVE}"
-
-        cd "$(Build.SourcesDirectory)"
-        cp "$(Build.ArtifactStagingDirectory)/$(artifactsName)/${POD_ARCHIVE}" swift/
-        export ORT_POD_LOCAL_PATH="swift/${POD_ARCHIVE}"
-        xcodebuild test -scheme onnxruntime-Package -destination 'platform=iOS Simulator,name=iPhone 14'
-
-        xcodebuild test -scheme onnxruntime-Package -destination 'platform=macosx'
-        
-        rm swift/pod-archive-onnxruntime-c-*.zip
-      workingDirectory: "$(Build.SourcesDirectory)"
-      displayName: "Print ORT iOS Pod checksum and Test Package.swift usage"
-
-    - template: templates/component-governance-component-detection-steps.yml
-      parameters:
-        condition: 'succeeded'

.pipelines/official.yml

@@ -0,0 +1,40 @@
+trigger: none
+
+# The `resources` specify the location and version of the 1ES PT.
+resources:
+  pipelines:
+  - pipeline: 'pod'
+    project: 'Lotus'
+    source: 'onnxruntime-ios-packaging-pipeline'
+  repositories:
+  - repository: 1esPipelines
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    settings:
+      networkIsolationPolicy: Preferred, GitHub
+    pool:
+      name: Azure Pipelines
+      image: "macOS-14"
+      os: macOS      
+    sdl:
+      sourceAnalysisPool:
+        name: onnxruntime-Win-CPU-2022
+        os: windows
+      policheck:
+        enabled: true
+      credscan:
+        enabled: true
+      codeql:
+        sourceLanguages: python
+      tsa:
+        enabled: true
+        configFile: '$(Build.SourcesDirectory)\.config\tsaoptions.json'
+    stages:
+    - stage: Stage
+      jobs:
+      - template: .pipelines/templates/main.yml@self

.pipelines/templates/main.yml

@@ -0,0 +1,45 @@
+parameters:
+- name: artifactName
+  type: string
+  default: 'ios_packaging_artifacts_full'
+
+jobs:
+- job: main
+  templateContext:
+    isProduction: false
+    inputs:
+    - input: pipelineArtifact
+      pipeline: 'pod'
+      artifactName: '${{ parameters.artifactName }}'
+      targetPath: '$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}'
+  steps:
+  - script: |
+      set -e -x
+      POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-objc*.zip")
+      unzip ${POD_ARCHIVE} -d unzipped
+      cp -rf unzipped/objectivec/ $(Build.SourcesDirectory)/objectivec/
+    # Corrected variable name to match the parameter
+    workingDirectory: '$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}'
+    displayName: Copy latest dev version ORT objectivec/ source files
+
+  # copy the pod archive to a path relative to Package.swift and set the env var required by Package.swift to use that.
+  # xcodebuild will implicitly use Package.swift and build/run the .testTarget (tests in swift/onnxTests).
+  # once that's done cleanup the copy of the pod zip file
+  - script: |
+      set -e -x
+      # Corrected variable name to match the parameter
+      cd "$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}"
+      POD_ARCHIVE=$(find . -name "pod-archive-onnxruntime-c*.zip")
+
+      shasum -a 256 "$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}/${POD_ARCHIVE}"
+
+      cd "$(Build.SourcesDirectory)"
+      cp "$(Build.ArtifactStagingDirectory)/${{ parameters.artifactName }}/${POD_ARCHIVE}" swift/
+      export ORT_POD_LOCAL_PATH="swift/${POD_ARCHIVE}"
+      xcodebuild test -scheme onnxruntime-Package -destination 'platform=iOS Simulator,name=iPhone 16'
+
+      xcodebuild test -scheme onnxruntime-Package -destination 'platform=macosx'
+
+      rm swift/pod-archive-onnxruntime-c-*.zip
+    workingDirectory: "$(Build.SourcesDirectory)"
+    displayName: "Print ORT iOS Pod checksum and Test Package.swift usage"