Use the managed pipeline template during publishing.

build-tests/rush-amazon-s3-build-cache-plugin-integration-test/docker-compose.yml

@@ -7,9 +7,6 @@ services:
     ports:
       - '9000:9000'
       - '9001:9001'
-    environment:
-      MINIO_ROOT_USER: minio
-      MINIO_ROOT_PASSWORD: minio123
     healthcheck:
       test: ['CMD', 'curl', '-f', 'http://localhost:9000/minio/health/live']
       interval: 30s

build-tests/rush-redis-cobuild-plugin-integration-test/src/testLockProvider.ts

@@ -10,7 +10,7 @@ import { OperationStatus, type ICobuildContext, RushSession } from '@microsoft/r
 
 const options: IRedisCobuildLockProviderOptions = {
   url: 'redis://localhost:6379',
-  password: 'redis123'
+  password: 'redis123' // [SuppressMessage("Microsoft.Security", "CS001:SecretInline", Justification="Password used in unit test.")]
 };
 
 const rushSession: RushSession = new RushSession({

common/changes/@microsoft/rush/1es-templates_2023-10-24-00-46.json

@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "comment": "",
+      "type": "none",
+      "packageName": "@microsoft/rush"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "[email protected]"
+}

common/config/azure-pipelines/npm-publish-rush.yaml

@@ -1,41 +1,60 @@
-pool:
-  vmImage: 'ubuntu-latest'
-
 variables:
   - name: FORCE_COLOR
     value: 1
   - name: SourceBranch
     value: $[ replace(replace(resources.repositories.self.ref, 'refs/heads/', ''), 'refs/pull/', 'refs/remotes/pull/') ]
 
-steps:
-  - checkout: self
-    persistCredentials: true
-
-  - template: templates/install-node.yaml
-
-  - template: templates/build.yaml
-
-  - template: templates/bump-versions.yaml
-    parameters:
-      VersionPolicyName: noRush
-      BranchName: $(SourceBranch)
-
-  - template: templates/bump-versions.yaml
-    parameters:
-      VersionPolicyName: rush
-      BranchName: $(SourceBranch)
-
-  - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js'
-    displayName: 'Prepublish workaround for rush-lib'
-
-  - template: templates/publish.yaml
-    parameters:
-      VersionPolicyName: noRush
-      BranchName: $(SourceBranch)
-
-  - template: templates/publish.yaml
-    parameters:
-      VersionPolicyName: rush
-      BranchName: $(SourceBranch)
-
-  - template: templates/record-published-versions.yaml
+resources:
+  repositories:
+    - repository: 1esPipelines
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    pool:
+      name: Azure-Pipelines-1ESPT-ExDShared
+      os: windows
+    stages:
+      - stage:
+        jobs:
+          - job:
+            templateContext:
+              outputs:
+                - output: pipelineArtifact
+                  targetPath: $(Build.ArtifactStagingDirectory)/published-versions
+                  artifactName: published-versions
+            steps:
+              - checkout: self
+                persistCredentials: true
+
+              - template: /common/config/azure-pipelines/templates/install-node.yaml@self
+
+              - template: /common/config/azure-pipelines/templates/build.yaml@self
+
+              - template: /common/config/azure-pipelines/templates/bump-versions.yaml@self
+                parameters:
+                  VersionPolicyName: noRush
+                  BranchName: $(SourceBranch)
+
+              - template: /common/config/azure-pipelines/templates/bump-versions.yaml@self
+                parameters:
+                  VersionPolicyName: rush
+                  BranchName: $(SourceBranch)
+
+              - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js'
+                displayName: 'Prepublish workaround for rush-lib'
+
+              - template: /common/config/azure-pipelines/templates/publish.yaml@self
+                parameters:
+                  VersionPolicyName: noRush
+                  BranchName: $(SourceBranch)
+
+              - template: /common/config/azure-pipelines/templates/publish.yaml@self
+                parameters:
+                  VersionPolicyName: rush
+                  BranchName: $(SourceBranch)
+
+              - template: /common/config/azure-pipelines/templates/record-published-versions.yaml@self

common/config/azure-pipelines/npm-publish.yaml

@@ -1,28 +1,47 @@
-pool:
-  vmImage: 'ubuntu-latest'
-
 variables:
   - name: FORCE_COLOR
     value: 1
   - name: SourceBranch
     value: $[ replace(replace(resources.repositories.self.ref, 'refs/heads/', ''), 'refs/pull/', 'refs/remotes/pull/') ]
 
-steps:
-  - checkout: self
-    persistCredentials: true
+resources:
+  repositories:
+    - repository: 1esPipelines
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    pool:
+      name: Azure-Pipelines-1ESPT-ExDShared
+      os: windows
+    stages:
+      - stage:
+        jobs:
+          - job:
+            templateContext:
+              outputs:
+                - output: pipelineArtifact
+                  targetPath: $(Build.ArtifactStagingDirectory)/published-versions
+                  artifactName: published-versions
+            steps:
+              - checkout: self
+                persistCredentials: true
 
-  - template: templates/install-node.yaml
+              - template: /common/config/azure-pipelines/templates/install-node.yaml@self
 
-  - template: templates/build.yaml
+              - template: /common/config/azure-pipelines/templates/build.yaml@self
 
-  - template: templates/bump-versions.yaml
-    parameters:
-      VersionPolicyName: noRush
-      BranchName: $(SourceBranch)
+              - template: /common/config/azure-pipelines/templates/bump-versions.yaml@self
+                parameters:
+                  VersionPolicyName: noRush
+                  BranchName: $(SourceBranch)
 
-  - template: templates/publish.yaml
-    parameters:
-      VersionPolicyName: noRush
-      BranchName: $(SourceBranch)
+              - template: /common/config/azure-pipelines/templates/publish.yaml@self
+                parameters:
+                  VersionPolicyName: noRush
+                  BranchName: $(SourceBranch)
 
-  - template: templates/record-published-versions.yaml
+              - template: /common/config/azure-pipelines/templates/record-published-versions.yaml@self

common/config/azure-pipelines/templates/record-published-versions.yaml

@@ -1,6 +1,7 @@
 steps:
   - script: 'node repo-scripts/repo-toolbox/lib/start.js record-versions --out-file $(Build.ArtifactStagingDirectory)/published-versions/published-versions.json'
     displayName: 'Record Published Versions'
-  - publish: $(Build.ArtifactStagingDirectory)/published-versions
-    artifact: published-versions
-    displayName: 'Publish Artifact: published-versions'
+  # Published by the 1ES template
+  # - publish: $(Build.ArtifactStagingDirectory)/published-versions
+  #   artifact: published-versions
+  #   displayName: 'Publish Artifact: published-versions'

common/config/azure-pipelines/vscode-extension-publish.yaml

@@ -1,28 +1,42 @@
-pool:
-  vmImage: 'ubuntu-latest'
-
 variables:
   - name: FORCE_COLOR
     value: 1
 
-steps:
-  - checkout: self
-    persistCredentials: true
+resources:
+  repositories:
+    - repository: 1esPipelines
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    pool:
+      name: Azure-Pipelines-1ESPT-ExDShared
+      os: windows
+    stages:
+      - stage:
+        jobs:
+          - job:
+            steps:
+              - checkout: self
+                persistCredentials: true
 
-  - template: templates/install-node.yaml
+              - template: /common/config/azure-pipelines/templates/install-node.yaml@self
 
-  - template: templates/build.yaml
-    parameters:
-      BuildParameters: >
-        --to rushstack
-      PerformValidation: false
+              - template: /common/config/azure-pipelines/templates/build.yaml@self
+                parameters:
+                  BuildParameters: >
+                    --to rushstack
+                  PerformValidation: false
 
-  - script: node $(Build.SourcesDirectory)/common/scripts/install-run-rushx.js package
-    workingDirectory: $(Build.SourcesDirectory)/vscode-extensions/rush-vscode-extension
-    displayName: 'Package vscode extension'
+              - script: node $(Build.SourcesDirectory)/common/scripts/install-run-rushx.js package
+                workingDirectory: $(Build.SourcesDirectory)/vscode-extensions/rush-vscode-extension
+                displayName: 'Package vscode extension'
 
-  - script: node $(Build.SourcesDirectory)/common/scripts/install-run-rushx.js deploy
-    workingDirectory: $(Build.SourcesDirectory)/vscode-extensions/rush-vscode-extension
-    displayName: 'Publish vscode extension'
-    env:
-      VSCE_PAT: $(vscePat)
+              - script: node $(Build.SourcesDirectory)/common/scripts/install-run-rushx.js deploy
+                workingDirectory: $(Build.SourcesDirectory)/vscode-extensions/rush-vscode-extension
+                displayName: 'Publish vscode extension'
+                env:
+                  VSCE_PAT: $(vscePat)

rush-plugins/rush-redis-cobuild-plugin/src/test/RedisCobuildLockProvider.test.ts

@@ -85,7 +85,7 @@ describe(RedisCobuildLockProvider.name, () => {
 
   it('expands options with environment variables', () => {
     const expectedOptions = {
-      password: 'redis123'
+      password: 'redis123' // [SuppressMessage("Microsoft.Security", "CS001:SecretInline", Justification="Password used in unit test.")]
     };
     const actualOptions = RedisCobuildLockProvider.expandOptionsWithEnvironmentVariables(
       {