Repository: Azure/azure-functions-nodejs-worker
Pull request #765: Migrating the NuGet Publishing Pipeline to 1ES
Author: login: swapnil-nagar
Created: 2025-03-14T23:55:35Z | Merged: 2025-03-19T16:16:30Z

Description 

Migrated worker release pipeline to 1ES. 

Key Information

1. Created a new build pipeline dedicated to worker release.
2. Tied the official build to release pipeline.
3. Publish package to nuget.

Proof
https://azfunc.visualstudio.com/internal/_build/results?buildId=206711&view=results



Diff:
diff --git a/azure-pipelines/templates/worker.yml b/azure-pipelines/templates/worker.yml
new file mode 100644
index 00000000..f8d0cf6e
--- /dev/null
+++ b/azure-pipelines/templates/worker.yml
@@ -0,0 +1,18 @@
+jobs:
+    - job: CreateWorkerRelease
+      displayName: 'Publish NodeJs Worker to Nuget'
+      templateContext:
+          outputParentDirectory: $(Build.ArtifactStagingDirectory)
+          outputs:
+              - output: nuget
+                condition: and(succeeded(), ${{ eq(parameters.IsPrerelease, true) }})
+                packagesToPush: '$(Build.ArtifactStagingDirectory)/dropOutput/*.nupkg'
+                publishVstsFeed: 'e6a70c92-4128-439f-8012-382fe78d6396/eb652719-f36a-4e78-8541-e13a3cd655f9'
+                nuGetFeedType: internal
+                allowPackageConflicts: true
+      steps:
+          - task: NuGetToolInstaller@1
+            displayName: 'Use NuGet 5x'
+            inputs:
+                versionSpec: 5.x
+                checkLatest: true
diff --git a/azure-pipelines/worker-build.yml b/azure-pipelines/worker-build.yml
new file mode 100644
index 00000000..14e8c1e9
--- /dev/null
+++ b/azure-pipelines/worker-build.yml
@@ -0,0 +1,47 @@
+parameters:
+    - name: IsPrerelease
+      type: boolean
+      default: true
+
+pr: none
+
+resources:
+    repositories:
+        - repository: 1es
+          type: git
+          name: 1ESPipelineTemplates/1ESPipelineTemplates
+          ref: refs/tags/release
+
+extends:
+    template: v1/1ES.Official.PipelineTemplate.yml@1es
+    parameters:
+        pool:
+            name: 1es-pool-azfunc
+            image: 1es-windows-2022
+            os: windows
+        sdl:
+            codeql:
+                runSourceLanguagesInSourceAnalysis: true
+
+        stages:
+            - stage: Build
+              dependsOn: []
+              jobs:
+                  - job:
+                    templateContext:
+                        outputs:
+                            - output: pipelineArtifact
+                              path: $(Build.ArtifactStagingDirectory)/dropOutput
+                              artifact: drop
+                              sbomBuildDropPath: '$(Build.ArtifactStagingDirectory)/dropInput'
+                              sbomPackageName: 'Azure Functions Node.js Worker'
+                              # The list of components can't be determined from the webpacked file in the staging dir, so reference the original node_modules folder
+                              sbomBuildComponentPath: '$(Build.SourcesDirectory)/node_modules'
+                    steps:
+                        - template: /azure-pipelines/templates/build.yml@self
+                          parameters:
+                              IsPrerelease: ${{ parameters.IsPrerelease }}
+            - stage: PublishNuget
+              dependsOn: [Build]
+              jobs:
+                  - template: /azure-pipelines/templates/worker.yml@self


Reviews:
user: login: hallvictoria
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T20:39:17Z
user: login: hallvictoria
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T20:39:47Z
user: login: hallvictoria
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T20:40:34Z
user: login: swapnil-nagar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T20:46:21Z
user: login: swapnil-nagar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T20:47:10Z
user: login: swapnil-nagar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T20:48:38Z
user: login: swapnil-nagar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-18T17:53:08Z
user: login: swapnil-nagar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-18T17:54:05Z
user: login: hallvictoria
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-18T21:21:30Z

Review comments:
diff_hunk: @@ -0,0 +1,53 @@
+parameters:
+  - name: IsPrerelease
+    type: boolean
+    default: true
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - v3.x
path: azure-pipelines/worker-build.yml
user: login: hallvictoria
body: The worker release pipeline will trigger off of every merge to v3.x. Can you make it a manual pipeline / configure it so that it runs only when the worker version is bumped?
created_at: 2025-03-17T20:39:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,53 @@
+parameters:
+  - name: IsPrerelease
+    type: boolean
+    default: true
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - v3.x
+
+pr: none
+
+resources:
+    repositories:
+        - repository: 1es
+          type: git
+          name: 1ESPipelineTemplates/1ESPipelineTemplates
+          ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1es
+  parameters:
+    pool:
+      name: 1es-pool-azfunc
+      image: 1es-windows-2022
+      os: windows
+    sdl:
+      codeql:
+        runSourceLanguagesInSourceAnalysis: true
+
+    stages:
+      - stage: Build
+        dependsOn: []
+        jobs:
+          - job:
+            templateContext:
+              outputs:
+                - output: pipelineArtifact
+                  path: $(Build.ArtifactStagingDirectory)/dropOutput
+                  artifact: drop
+                  sbomBuildDropPath: '$(Build.ArtifactStagingDirectory)/dropInput'
+                  sbomPackageName: 'Azure Functions Node.js Worker'
+                  # The list of components can't be determined from the webpacked file in the staging dir, so reference the original node_modules folder
+                  sbomBuildComponentPath: '$(Build.SourcesDirectory)/node_modules'
+            steps:
+              - template: /azure-pipelines/templates/build.yml@self
+                parameters:
+                  IsPrerelease: ${{ parameters.IsPrerelease }}
path: azure-pipelines/worker-build.yml
user: login: hallvictoria
body: If the pipeline is only run for releases, this variable isn't needed / can be set to True
created_at: 2025-03-17T20:39:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,53 @@
+parameters:
+  - name: IsPrerelease
+    type: boolean
+    default: true
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - v3.x
+
+pr: none
+
+resources:
+    repositories:
+        - repository: 1es
+          type: git
+          name: 1ESPipelineTemplates/1ESPipelineTemplates
+          ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1es
+  parameters:
+    pool:
+      name: 1es-pool-azfunc
+      image: 1es-windows-2022
+      os: windows
+    sdl:
+      codeql:
+        runSourceLanguagesInSourceAnalysis: true
+
+    stages:
+      - stage: Build
+        dependsOn: []
+        jobs:
+          - job:
+            templateContext:
+              outputs:
+                - output: pipelineArtifact
path: azure-pipelines/worker-build.yml
user: login: hallvictoria
body: nit (possibly future change): since this code is shared w/ the official build pipeline, can you refactor it into a separate template to be reference in both pipelines?
created_at: 2025-03-17T20:40:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,53 @@
+parameters:
+  - name: IsPrerelease
+    type: boolean
+    default: true
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - v3.x
path: azure-pipelines/worker-build.yml
user: login: swapnil-nagar
body: There is no schedule for this pipeline, it is meant to be manual only.

That is good suggestion. But, as we do not persist the version for worker anywhere, I am not certain how would ensure worker version is bumped.

Alternatively, what we can do it we can have the preRelease tag which is checked by default and we wont publish to nuget when preRelease tag is false. But when we need to release a new worker version we will trigger this pipeline manually.
created_at: 2025-03-17T20:46:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,53 @@
+parameters:
+  - name: IsPrerelease
+    type: boolean
+    default: true
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - v3.x
+
+pr: none
+
+resources:
+    repositories:
+        - repository: 1es
+          type: git
+          name: 1ESPipelineTemplates/1ESPipelineTemplates
+          ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1es
+  parameters:
+    pool:
+      name: 1es-pool-azfunc
+      image: 1es-windows-2022
+      os: windows
+    sdl:
+      codeql:
+        runSourceLanguagesInSourceAnalysis: true
+
+    stages:
+      - stage: Build
+        dependsOn: []
+        jobs:
+          - job:
+            templateContext:
+              outputs:
+                - output: pipelineArtifact
+                  path: $(Build.ArtifactStagingDirectory)/dropOutput
+                  artifact: drop
+                  sbomBuildDropPath: '$(Build.ArtifactStagingDirectory)/dropInput'
+                  sbomPackageName: 'Azure Functions Node.js Worker'
+                  # The list of components can't be determined from the webpacked file in the staging dir, so reference the original node_modules folder
+                  sbomBuildComponentPath: '$(Build.SourcesDirectory)/node_modules'
+            steps:
+              - template: /azure-pipelines/templates/build.yml@self
+                parameters:
+                  IsPrerelease: ${{ parameters.IsPrerelease }}
path: azure-pipelines/worker-build.yml
user: login: swapnil-nagar
body: Actually, let me use preRelease variable, to add a condition to nuget to only publish when it is not a pre-release.
created_at: 2025-03-17T20:47:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,53 @@
+parameters:
+  - name: IsPrerelease
+    type: boolean
+    default: true
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - v3.x
+
+pr: none
+
+resources:
+    repositories:
+        - repository: 1es
+          type: git
+          name: 1ESPipelineTemplates/1ESPipelineTemplates
+          ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1es
+  parameters:
+    pool:
+      name: 1es-pool-azfunc
+      image: 1es-windows-2022
+      os: windows
+    sdl:
+      codeql:
+        runSourceLanguagesInSourceAnalysis: true
+
+    stages:
+      - stage: Build
+        dependsOn: []
+        jobs:
+          - job:
+            templateContext:
+              outputs:
+                - output: pipelineArtifact
path: azure-pipelines/worker-build.yml
user: login: swapnil-nagar
body: Sure, once this PR is in I will refactor.
created_at: 2025-03-17T20:48:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,53 @@
+parameters:
+  - name: IsPrerelease
+    type: boolean
+    default: true
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - v3.x
path: azure-pipelines/worker-build.yml
user: login: swapnil-nagar
body: Removed the branch trigger
created_at: 2025-03-18T17:53:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,53 @@
+parameters:
+  - name: IsPrerelease
+    type: boolean
+    default: true
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - v3.x
+
+pr: none
+
+resources:
+    repositories:
+        - repository: 1es
+          type: git
+          name: 1ESPipelineTemplates/1ESPipelineTemplates
+          ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1es
+  parameters:
+    pool:
+      name: 1es-pool-azfunc
+      image: 1es-windows-2022
+      os: windows
+    sdl:
+      codeql:
+        runSourceLanguagesInSourceAnalysis: true
+
+    stages:
+      - stage: Build
+        dependsOn: []
+        jobs:
+          - job:
+            templateContext:
+              outputs:
+                - output: pipelineArtifact
+                  path: $(Build.ArtifactStagingDirectory)/dropOutput
+                  artifact: drop
+                  sbomBuildDropPath: '$(Build.ArtifactStagingDirectory)/dropInput'
+                  sbomPackageName: 'Azure Functions Node.js Worker'
+                  # The list of components can't be determined from the webpacked file in the staging dir, so reference the original node_modules folder
+                  sbomBuildComponentPath: '$(Build.SourcesDirectory)/node_modules'
+            steps:
+              - template: /azure-pipelines/templates/build.yml@self
+                parameters:
+                  IsPrerelease: ${{ parameters.IsPrerelease }}
path: azure-pipelines/worker-build.yml
user: login: swapnil-nagar
body: Added the preRelease==false as a mandatory condition for nuget release.
created_at: 2025-03-18T17:54:05Z
author_association: CONTRIBUTOR

PR comments:
user: login: swapnil-nagar
created_at: 2025-03-19T16:06:28Z
body: /azp run
author_association: CONTRIBUTOR
user: login: azure-pipelines[bot]
created_at: 2025-03-19T16:06:40Z
body: <samp>
Azure Pipelines successfully started running 1 pipeline(s).<br>

</samp>
author_association: NONE