azure-pipelines.yml

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

trigger:
  branches:
    include:
      - master
      - 202???
  paths:
    exclude:
      - .github

pr:
  branches:
    include:
      - master
      - 202???
  paths:
    exclude:
      - .github

name: $(TeamProject)_$(Build.DefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)

resources:
  repositories:
  - repository: sonic-mgmt
    type: github
    name: sonic-net/sonic-mgmt
    ref: master
    endpoint: sonic-net
  - repository: buildimage
    type: github
    name: sonic-net/sonic-buildimage
    endpoint: sonic-net
    ref: master

parameters:
- name: TIMEOUT_IN_MINUTES_PR_TEST
  type: number
  default: 480

- name: CHECKOUT_SONIC_MGMT
  type: boolean
  default: true

variables:
- template: .azure-pipelines/azure-pipelines-repd-build-variables.yml@buildimage
- template: .azure-pipelines/template-variables.yml@buildimage
- name: CACHE_MODE
  value: rcache
- name: ENABLE_FIPS
  value: y
- name: BUILD_BRANCH
  ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
    value: $(System.PullRequest.TargetBranch)
  ${{ else }}:
    value: $(Build.SourceBranchName)

stages:
- stage: BuildVS
  pool: sonicso1ES-amd64
  jobs:
  - template: .azure-pipelines/azure-pipelines-build.yml
    parameters:
      buildOptions: 'USERNAME=admin SONIC_BUILD_JOBS=$(nproc) BUILD_MULTIASIC_KVM=y INCLUDE_DHCP_SERVER=y ${{ variables.VERSION_CONTROL_OPTIONS }}'
      jobGroups:
      - name: vs
  - template: .azure-pipelines/azure-pipelines-build.yml
    parameters:
      buildOptions: 'USERNAME=admin SONIC_BUILD_JOBS=$(nproc) ${{ variables.VERSION_CONTROL_OPTIONS }}'
      jobGroups:
      - name: vpp
        continueOnError: true
  - template: .azure-pipelines/azure-pipelines-build.yml
    parameters:
      buildOptions: 'USERNAME=admin SONIC_BUILD_JOBS=2 ${{ variables.VERSION_CONTROL_OPTIONS }}'
      jobGroups:
      - name: alpinevs
        continueOnError: true

- stage: Build
  pool: sonicso1ES-amd64
  dependsOn: []
  jobs:
  - template: .azure-pipelines/azure-pipelines-build.yml
    parameters:
      buildOptions: 'USERNAME=admin SONIC_BUILD_JOBS=$(nproc) ${{ variables.VERSION_CONTROL_OPTIONS }}'
      jobGroups:
      - name: broadcom
        variables:
          swi_image: yes
          docker_syncd_rpc_image: yes
          dbg_image: yes
          platform_rpc: brcm
          INCLUDE_RESTAPI: y
      - name: mellanox
        variables:
          dbg_image: yes
          docker_syncd_rpc_image: yes
          session_monitor: yes
          platform_rpc: mlnx
      - name: marvell-prestera-arm64
        pool: sonicso1ES-arm64
        variables:
           PLATFORM_NAME: marvell-prestera
           PLATFORM_ARCH: arm64
      - name: marvell-prestera-armhf
        pool: sonicso1ES-armhf
        timeoutInMinutes: 1200
        variables:
          PLATFORM_NAME: marvell-prestera
          PLATFORM_ARCH: armhf
          INCLUDE_RESTAPI: y
      - name: nvidia-bluefield
        pool: sonicso1ES-arm64
        variables:
          PLATFORM_ARCH: arm64
      - name: aspeed-arm64
        pool: sonicso1ES-arm64
        variables:
          PLATFORM_NAME: aspeed
          PLATFORM_ARCH: arm64

- stage: Test
  dependsOn: BuildVS
  condition: and(succeeded(), and(ne(stageDependencies.BuildVS.outputs['vs.SetVar.SKIP_VSTEST'], 'YES'), in(dependencies.BuildVS.result, 'Succeeded', 'SucceededWithIssues')))
  variables:
  - group: SONiC-Elastictest
  - name: inventory
    value: veos_vtb
  - name: testbed_file
    value: vtestbed.csv
  - name: PTF_MODIFIED
    # $[ coalesce(stageDependencies.BuildVS.vs.outputs['PublishAndSetPtfTag.PTF_MODIFIED'], stageDependencies.BuildVS.vs.outputs['script.PTF_MODIFIED'], stageDependencies.BuildVS.vs.outputs['script1.PTF_MODIFIED'], 'False') ]
    # Disable in-PR testing of docker-ptf image; To be re-enabled after image can be uploaded to approved ACR
    value: 'False' 

# For every test job:
# continueOnError: false means it's a required test job and will block merge if it fails
# continueOnError: true means it's an optional test job and will not block merge even though it fails(unless a required test job depends on its result)

  jobs:
  - job: debug_variables
    pool: sonic-ubuntu-1c
    displayName: "Debug PTF_MODIFIED Variable"
    steps:
    - script: |
        echo "PTF_MODIFIED variable value: $(PTF_MODIFIED)"
        echo "Debug: Checking if PTF_MODIFIED is being passed correctly from BuildVS stage"
        if [ "$(PTF_MODIFIED)" = "True" ]; then
          echo "SUCCESS: PTF_MODIFIED is True"
        elif [ "$(PTF_MODIFIED)" = "False" ]; then
          echo "INFO: PTF_MODIFIED is False"
        else
          echo "ERROR: PTF_MODIFIED has unexpected value: $(PTF_MODIFIED)"
        fi
      displayName: "Debug PTF_MODIFIED Variable"

  - job:
    pool: sonictest
    displayName: "vstest"
    condition: false # agent pool don't work. disable this job to unblock PRs.
    timeoutInMinutes: 60
    steps:
    - template: .azure-pipelines/cleanup.yml
    - checkout: self
      clean: true
      submodules: recursive
      displayName: 'Checkout code'

    - script: |
        sudo rm -rf ../target
        sudo rm -rf ../*.deb
      displayName: "Cleanup"

    - task: DownloadPipelineArtifact@2
      inputs:
        artifact: sonic-buildimage.vs
      displayName: "Download sonic-buildimage.vs artifact"

    - script: |
        sudo src/sonic-swss-common/.azure-pipelines/build_and_install_module.sh
      displayName: "Install kernel modules"

    - script: |
        sudo apt-get update
        sudo apt-get install -y make libtool m4 autoconf dh-exec debhelper cmake pkg-config \
                         libhiredis-dev libnl-3-dev libnl-genl-3-dev libnl-route-3-dev libnl-nf-3-dev swig \
                         libpython2.7-dev libboost-dev libboost-serialization-dev uuid-dev libzmq5 libzmq3-dev  python3-pip \
                         cmake libgtest-dev libgmock-dev libyang-dev nlohmann-json3-dev
        sudo pip3 install pytest
        cd src/sonic-swss-common
        ./autogen.sh
        dpkg-buildpackage -rfakeroot -us -uc -b -j$(nproc)
        sudo dpkg -i --force-confask,confnew ../libswsscommon_*.deb
        sudo dpkg -i ../python3-swsscommon_*.deb
      displayName: "Compile sonic swss common"

    - script: |
        sudo docker load -i ../target/docker-sonic-vs.gz
        docker tag docker-sonic-vs:latest docker-sonic-vs:$(Build.BuildNumber)
        username=$(id -un)

        trap "docker ps; docker images; ip netns list; \
              docker rmi docker-sonic-vs:$(Build.BuildNumber); \
              ip netns list | grep -E [-]srv[0-9]+ | awk '{print $1}' | xargs -I {} sudo ip netns delete {}; \
              sudo chown -R ${username}.${username} .; \
              sudo chown -R ${username}.${username} $(System.DefaultWorkingDirectory)" EXIT
        pushd platform/vs/tests
        sudo py.test -v --junitxml=tr.xml --imgname=docker-sonic-vs:$(Build.BuildNumber)
      displayName: "Run vs tests"

    - task: PublishTestResults@2
      inputs:
        testResultsFiles: '**/tr.xml'
        testRunTitle: vstest

  # KVM based PR test jobs
  - template: .azure-pipelines/pr_test_template.yml@sonic-mgmt
    parameters:
      CHECKOUT_SONIC_MGMT: ${{ parameters.CHECKOUT_SONIC_MGMT }}
      PTF_MODIFIED: $(PTF_MODIFIED)

# Unified SBOM-based vulnerability scan — informational, runs after
# both build stages so every CycloneDX SBOM produced is in scope.
# Lives in its own stage (not inside Test) because the Test stage
# dependsOn BuildVS only — putting the scan there meant the .bin
# SBOMs from the Build stage (broadcom, mellanox, etc.) hadn't been
# uploaded as artifacts yet when the scan ran. VulnScan dependsOn
# BuildVS + Build so the scan only fires once every *.cdx.json
# sidecar this pipeline produces is on the artifact server.
#
# Runs after Test (rather than in parallel with it) is fine — this
# is non-gating telemetry, and putting it in its own stage avoids
# duplicating the Test stage's KVM-test machinery just to add deps.
#
# docker-sonic-mgmt is scanned by its own pipeline
# (.azure-pipelines/docker-sonic-mgmt.yml) and is intentionally out
# of scope here: the main pipeline never builds it, so there is no
# docker-sonic-mgmt.gz.sbom.cdx.json artifact for this scan to
# consume. The scan step logs a one-line pointer to the other
# pipeline so readers don't wonder why ptf is listed and mgmt isn't.
- stage: VulnScan
  displayName: "Vuln Scan"
  dependsOn:
    - BuildVS
    - Build
  # Disabled for now; remove this `condition: false` (or change to
  # `not(canceled())`) to re-enable the SBOM-based vulnerability
  # scan stage. The SBOM artifacts themselves continue to be
  # produced when ENABLE_SBOM=y — only the post-build scan is gated.
  condition: false
  jobs:
  - job: sbom_vuln_scan
    displayName: "[OPTIONAL] SBOM-based vulnerability scan (all artifacts)"
    pool: sonic-ubuntu-1c
    continueOnError: true
    timeoutInMinutes: 60
    steps:
    - checkout: self
      clean: true
      fetchDepth: 1
    - task: DownloadPipelineArtifact@2
      inputs:
        # Narrow to aggregate SBOMs only: the top-level installer
        # (sonic-<platform>.bin / .swi / .img.gz) and the standalone
        # test-container SBOMs (docker-*.gz.sbom.cdx.json — note the
        # .sbom. infix that distinguishes them from per-container
        # recipe fragments). The recipe-emit fragments under
        # target/debs/, target/python-wheels/, and target/docker-*.gz.cdx.json
        # are build-internal plumbing; scanning them duplicates work
        # already done by the .bin aggregate scan.
        patterns: |
          **/target/sonic-*.bin.cdx.json
          **/target/sonic-*.swi.cdx.json
          **/target/sonic-*.img.gz.cdx.json
          **/target/docker-*.gz.sbom.cdx.json
      displayName: "Download aggregate SBOM sidecars"
    - script: |
        set -ex
        sudo apt-get install -y python3-pip jq
      displayName: "Install dependencies"
    - script: |
        set +e
        OVERALL_RC=0
        FOUND=0
        mkdir -p $(Build.ArtifactStagingDirectory)/sbom-vuln
        shopt -s nullglob globstar
        # Note for log readers: docker-sonic-mgmt is built and scanned
        # in its own pipeline (.azure-pipelines/docker-sonic-mgmt.yml).
        # Its vuln report lives there as the sbom-vuln-scan-results
        # artifact of that pipeline's runs. That's why ptf appears
        # below but mgmt does not.
        echo "Note: docker-sonic-mgmt is scanned in .azure-pipelines/docker-sonic-mgmt.yml; not built in this pipeline."
        echo ""
        # Walk only the aggregate SBOMs at the top of each artifact's
        # target/ directory. Recipe fragments under target/debs/ or
        # target/python-wheels/ are not matched by these patterns.
        for sbom in \
            $(Pipeline.Workspace)/*/target/sonic-*.bin.cdx.json \
            $(Pipeline.Workspace)/*/target/sonic-*.swi.cdx.json \
            $(Pipeline.Workspace)/*/target/sonic-*.img.gz.cdx.json \
            $(Pipeline.Workspace)/*/target/docker-*.gz.sbom.cdx.json
        do
          FOUND=$((FOUND+1))
          # Derive a short name for this scan's outputs. Test-container
          # SBOMs include a `.sbom` infix on disk (e.g. docker-ptf.gz.sbom.cdx.json)
          # to distinguish them from per-container recipe fragments
          # (docker-ptf.gz.cdx.json); strip it so the per-artifact
          # output names match the underlying artifact extension:
          #   sonic-broadcom.bin.cdx.json     -> sonic-broadcom.bin{.txt,.cdx.json}
          #   docker-ptf.gz.sbom.cdx.json     -> docker-ptf.gz{.txt,.cdx.json}
          name=$(basename "$sbom" .cdx.json)
          name="${name%.sbom}"
          # Azure Pipelines log-folding directive — wrap each SBOM's
          # output so the log view shows a collapsible section per
          # scan rather than one giant concatenated stream.
          echo "##[group]SBOM vuln scan: $name"
          python3 scripts/sbom_vuln_scan.py \
            --vex vex \
            --min-severity medium \
            --fail-on medium \
            --format both \
            --output "$(Build.ArtifactStagingDirectory)/sbom-vuln/${name}.cdx.json" \
            "$sbom" \
            | tee "$(Build.ArtifactStagingDirectory)/sbom-vuln/${name}.txt"
          RC=${PIPESTATUS[0]}
          if [ "$RC" != "0" ]; then OVERALL_RC=$RC; fi
          echo "##[endgroup]"
        done
        if [ "$FOUND" = "0" ]; then
          echo "::error::No SBOM files found under $(Pipeline.Workspace) — were the build stages invoked with ENABLE_SBOM=y?"
          exit 1
        fi
        echo ""
        echo "=== SBOM vulnerability scan: $FOUND SBOM(s) scanned ==="
        exit $OVERALL_RC
      displayName: "SBOM vulnerability scan (all artifacts)"
    - publish: $(Build.ArtifactStagingDirectory)/sbom-vuln
      artifact: sbom-vuln-scan-results
      displayName: "Publish SBOM vuln-scan results"
      condition: always()
      continueOnError: true