trigger: none

pr:
  branches:
    include:
      - main
  paths:
    include:
      - eng/pipelines/aggregate-reports.yml

variables:
  - template: /eng/pipelines/templates/variables/globals.yml

stages:
  - stage: AggregateReports
    displayName: Aggregate Reports

    jobs:
      - job: Reporting
        displayName: Generate reports (with build)
        timeoutInMinutes: 180

        pool:
          name: 'azsdk-pool-mms-ubuntu-2004-general'
          vmImage: 'MMSUbuntu20.04'

        steps:
        - template: /eng/pipelines/templates/steps/generate-project-list-and-cache-maven-repository.yml
          parameters:
            JobType: 'Reporting'
            Artifacts:
              - name: aggregate-reports # fake artifact name
                groupId: reports # fake group Id

        # We `install` the code quality reports tooling into our local m2 cache separately from building the Maven project
        # reports. This means it is available as part of that, but also so that this is not documented in the project report.
        - template: /eng/pipelines/templates/steps/install-reporting-tools.yml

        - task: Maven@3
          displayName: 'Build All Libraries'
          inputs:
            mavenPomFile: pom.xml
            options: '$(DefaultOptions) -T 2C -DskipTests -Dgpg.skip -Dmaven.javadoc.skip=true -Dcodesnippet.skip=true -Dcheckstyle.skip=true -Dspotbugs.skip=true -Djacoco.skip=true -Drevapi.skip=true'
            mavenOptions: '$(MemoryOptions) $(LoggingOptions)'
            javaHomeOption: 'JDKVersion'
            jdkVersionOption: $(JavaBuildVersion)
            jdkArchitectureOption: 'x64'
            publishJUnitResults: false
            goals: 'clean install'

        - pwsh: |
            New-Item eng/bomgenerator/inputdir -ItemType directory
            Copy-Item sdk/boms/azure-sdk-bom/pom.xml eng/bomgenerator/inputdir/
            Copy-Item eng/versioning/version_client.txt eng/bomgenerator/inputdir/
          displayName: Copy input files for BOM generation

        - task: Maven@3
          condition: succeededOrFailed()
          displayName: 'Generate BOM Reports'
          inputs:
            mavenPomFile: eng/bomgenerator/pom.xml
            options: '$(DefaultOptions)'
            mavenOptions: '$(MemoryOptions) $(LoggingOptions)'
            javaHomeOption: 'JDKVersion'
            jdkVersionOption: $(JavaBuildVersion)
            jdkArchitectureOption: 'x64'
            publishJUnitResults: false
            goals: 'clean package'

        # Generate the pom file with all the modules required for creating an aggregate code coverage report
        - task: PythonScript@0
          displayName: 'Generate pom for aggregate JavaDoc report'
          inputs:
            scriptPath: 'eng/scripts/generate_aggregate_pom.py'
            arguments: '--groups com.azure --type javadoc --exclude-project-list com.azure:azure-cosmos-benchmark,com.azure:azure-cosmos-dotnet-benchmark,com.azure:azure-messaging-servicebus-stress,com.azure:azure-messaging-eventhubs-stress'
            workingDirectory: '$(System.DefaultWorkingDirectory)'

        - task: Maven@3
          displayName: 'Generate Aggregate JavaDocs'
          inputs:
            mavenPomFile: aggregate-pom.xml
            options: '$(DefaultOptions) -T 2C -Dinclude-non-shipping-modules'
            mavenOptions: '$(MemoryOptions) $(LoggingOptions)'
            javaHomeOption: 'JDKVersion'
            jdkVersionOption: $(JavaBuildVersion)
            jdkArchitectureOption: 'x64'
            publishJUnitResults: false
            goals: 'javadoc:aggregate'

        - pwsh: |
            $(Build.SourcesDirectory)/eng/DependencyGraph/gen-dep-graph-data.ps1
          displayName: Generate Interdependency Report Data

        - pwsh: |
            Copy-Item -Path target/site/apidocs -Destination $(Build.ArtifactStagingDirectory)/staging/apidocs -Force -Recurse
            Copy-Item eng/code-quality-reports/src/main/resources/index.html $(Build.ArtifactStagingDirectory)
            Copy-Item eng/code-quality-reports/src/main/resources/dependency-allowlist.html $(Build.ArtifactStagingDirectory)/staging
            Copy-Item data.js $(Build.ArtifactStagingDirectory)/staging
            ls -R $(Build.ArtifactStagingDirectory)/staging
          displayName: 'Copy reports to artifact staging'

        - pwsh: |
            Copy-Item eng/bomgenerator/outputdir/dependency_conflictlist.html $(Build.ArtifactStagingDirectory)/staging
          displayName: 'Copy BOM report to artifact staging'
          condition: succeededOrFailed()

        - publish: $(Build.ArtifactStagingDirectory)
          condition: succeededOrFailed()
          displayName: 'Publish Report Artifacts'
          artifact: reports

        - template: /eng/pipelines/templates/steps/upload-repository-on-failure.yml

      - job: Compliance
        displayName: Analyze (no build)
        timeoutInMinutes: 120
        variables:
          - template: /eng/pipelines/templates/variables/globals.yml
          - name: DisableDockerDetector
            value: false

        pool:
          # CredScan build task is Windows only (https://aka.ms/credscan).
          name: 'azsdk-pool-mms-win-2022-general'
          vmImage: 'windows-2022'
        steps:
        - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
          # ComponentGovernance is currently unable to run on pull requests of public projects. Running on non-PR
          # builds should be sufficient.
          # Only run if building all libraries succeeded.
          condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'))
          displayName: 'Component Detection'

        - task: ms.nuget-security-analysis.nuget-security-analysis.nuget-security-analysis@0
          # Use the same conditions as the Component Detection
          condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'))
          displayName: 'Secure Supply Chain Analysis'

        # Run link verification at the end as it will run no matter the pipeline passing or failing.
        # If this task fails with an error it shouldn't prevent aggregate reports from being generated.
        - template: /eng/common/pipelines/templates/steps/verify-links.yml
          parameters:
            Directory: ""
            CheckLinkGuidance: $true
            Condition: succeededOrFailed()

  - stage: ComplianceTools
    displayName: Compliance Tools
    dependsOn: []

    jobs:
      - job: ComplianceTools
        timeoutInMinutes: 120

        pool:
          name: azsdk-pool-mms-win-2022-general
          vmImage: windows-2022

        steps:
          - template: /eng/common/pipelines/templates/steps/policheck.yml
            parameters:
              ExclusionDataBaseFileName: "JavaPoliCheckExclusion"
              PublishAnalysisLogs: false

          - template: /eng/common/pipelines/templates/steps/credscan.yml
            parameters:
              BaselineFilePath: $(Build.SourcesDirectory)\eng\java.gdnbaselines

          - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
            displayName: 'Publish Security Analysis Logs'
            condition: succeededOrFailed()
