Migration from ADO to Github Actions 3

.github/actions/analyze.yml

@@ -0,0 +1,201 @@
+parameters:
+  analyzeARMTemplates: true
+  analyzeBinaries: true
+  analyzePackages: true
+  runAntiMalware: true
+  credScanDirectory: '$(Build.SourcesDirectory)'
+
+steps:
+- task: UseDotNet@2
+  displayName: Use .NET Core sdk
+  inputs:
+    useGlobalJson: true
+
+- ${{ if eq(parameters.analyzeBinaries, 'true') }}:
+  - task: DownloadBuildArtifacts@0
+    displayName: 'Download Binaries'
+    inputs:
+      buildType: 'current'
+      downloadType: 'single'
+      downloadPath: '$(Agent.TempDirectory)/artifacts'
+      artifactName: 'deploy'
+
+- ${{ if eq(parameters.analyzePackages, 'true') }}:
+  - task: DownloadBuildArtifacts@0
+    displayName: 'Download NuGet Packages'
+    inputs:
+      buildType: 'current'
+      downloadType: 'single'
+      downloadPath: '$(Build.SourcesDirectory)/artifacts'
+      artifactName: 'nuget'
+
+- ${{ if eq(parameters.analyzeBinaries, 'true') }}:
+  - task: ExtractFiles@1
+    displayName: 'Extract Stu3 Web Server Binaries'
+    inputs:
+      archiveFilePatterns: '$(Agent.TempDirectory)/artifacts/deploy/Microsoft.Health.Fhir.Stu3.Web.zip'
+      destinationFolder: '$(Build.SourcesDirectory)/artifacts/web/Stu3'
+  - task: ExtractFiles@1
+    displayName: 'Extract R4 Web Server Binaries'
+    inputs:
+      archiveFilePatterns: '$(Agent.TempDirectory)/artifacts/deploy/Microsoft.Health.Fhir.R4.Web.zip'
+      destinationFolder: '$(Build.SourcesDirectory)/artifacts/web/r4'
+  - task: ExtractFiles@1
+    displayName: 'Extract R4B Web Server Binaries'
+    inputs:
+      archiveFilePatterns: '$(Agent.TempDirectory)/artifacts/deploy/Microsoft.Health.Fhir.R4B.Web.zip'
+      destinationFolder: '$(Build.SourcesDirectory)/artifacts/web/r4b'
+  - task: ExtractFiles@1
+    displayName: 'Extract R5 Web Server Binaries'
+    inputs:
+      archiveFilePatterns: '$(Agent.TempDirectory)/artifacts/deploy/Microsoft.Health.Fhir.R5.Web.zip'
+      destinationFolder: '$(Build.SourcesDirectory)/artifacts/web/r5'
+
+- ${{ if eq(parameters.runAntiMalware, 'true') }}:
+  - task: AntiMalware@4
+    inputs:
+      InputType: 'Basic'
+      ScanType: 'CustomScan'
+      FileDirPath: '$(Build.SourcesDirectory)'
+      EnableServices: true
+      TreatSignatureUpdateFailureAs: 'Standard'
+      SignatureFreshness: 'OneDay'
+      TreatStaleSignatureAs: 'Error'
+
+- ${{ if eq(parameters.analyzeARMTemplates, 'true') }}:
+  - task: Armory@2
+    inputs:
+      targetDirectory: '$(Build.SourcesDirectory)/samples/templates'
+      targetFiles: 'f|*.json'
+      excludePassesFromLog: false
+
+  - task: TemplateAnalyzer@3  
+    displayName: 'Run Template Analyzer'  
+    inputs:   
+        ToolVersion: Latest
+        AnalyzeDirectory: '$(Build.SourcesDirectory)/samples/templates'
+        Verbose: false
+        IncludeNonSecurityRules: true
+
+- task: CredScan@3
+  inputs:
+    scanFolder: ${{ parameters.credScanDirectory }}
+    outputFormat: 'pre'
+    suppressionsFile: 'CredScanSuppressions.json'
+    verboseOutput: true
+
+- task: CSRF@1
+  inputs:
+      Path: '$(Build.SourcesDirectory)'
+      ToolVersion: Latest
+
+- task: Trivy@1
+  displayName: 'Run Trivy'
+  inputs:
+    Target: '$(Build.SourcesDirectory)/build/docker'
+    Severities: all
+    VulTypes: all
+
+- task: PSScriptAnalyzer@1
+  displayName: 'Run PSScriptAnalyzer'
+  inputs:
+    Path: '$(Build.SourcesDirectory)'
+    Settings: required
+    IgnorePattern: .gdn
+    Recurse: true
+
+- task: RoslynAnalyzers@3
+  inputs:
+    userProvideBuildInfo: 'msBuildInfo'
+    msBuildArchitecture: 'DotNetCore'
+    msBuildCommandline: 'dotnet build $(Build.SourcesDirectory)/Microsoft.Health.Fhir.sln --configuration $(buildConfiguration) -p:ContinuousIntegrationBuild=true -f net8.0'
+
+- task: BinSkim@4
+  inputs:
+    toolVersion:        Latest
+    InputType:          Basic
+    Function:           analyze
+    AnalyzeTargetGlob:  'f|$(Agent.TempDirectory)/artifacts/**/*Microsoft.Health.*.dll'
+
+ ## PoliCheck@2 does not need to be added since it is run internally
+
+ ## Tools that are no longer supported:
+ # AutoApplicability@1, CodeMetrics@1, VulnerabilityAssessment@0
+
+- task: SdtReport@2
+  condition: succeededOrFailed()
+  continueOnError: True
+  inputs:
+    GdnExportAllTools: false
+    GdnExportGdnToolArmory: ${{ eq(parameters.analyzeARMTemplates, 'true') }}
+    GdnExportGdnToolCredScan: true
+    GdnExportGdnToolCSRF: true
+    GdnExportGdnToolRoslynAnalyzers: true
+    BinSkim: true
+    CredScan: true
+
+- task: PublishSecurityAnalysisLogs@3
+  condition: succeededOrFailed()
+  continueOnError: True
+  inputs:
+    ArtifactName: 'CodeAnalysisLogs'
+    ArtifactType: 'Container'
+    AllTools: false
+    AntiMalware: ${{ eq(parameters.runAntiMalware, 'true') }}
+    APIScan: false
+    Armory: ${{ eq(parameters.analyzeARMTemplates, 'true') }}
+    Bandit: false
+    BinSkim: false
+    CodesignValidation: false
+    CredScan: true
+    CSRF: true
+    ESLint: false
+    Flawfinder: false
+    FortifySCA: false
+    FxCop: false
+    ModernCop: false
+    MSRD: false
+    PoliCheck: false
+    RoslynAnalyzers: true
+    SDLNativeRules: false
+    Semmle: false
+    SpotBugs: false
+    TSLint: false
+    WebScout: false
+    ToolLogsNotFoundAction: 'Standard'
+
+- task: PostAnalysis@2
+  condition: succeededOrFailed()
+  inputs:
+    GdnBreakAllTools: false
+    GdnBreakGdnToolArmory: ${{ eq(parameters.analyzeARMTemplates, 'true') }}
+    GdnBreakGdnToolCredScan: true
+    GdnBreakGdnToolCSRF: true
+    GdnBreakGdnToolRoslynAnalyzers: true
+    BinSkim: true
+    CredScan: true
+
+- task: TSAUpload@2
+  condition: and(succeeded(), eq(variables['build.sourceBranch'], 'refs/heads/main'))
+  displayName: 'TSA upload'
+  inputs:
+    tsaVersion: 'TsaV2' 
+    codebase: 'NewOrUpdate'
+    GdnPublishTsaOnboard: false
+    GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)\build\jobs\tsaconfig.gdntsa'
+    GdnPublishTsaExportedResultsPublishable: true
+
+- task: DeleteFiles@1
+  displayName: 'Delete files to make space'
+  inputs:
+    SourceFolder: '$(Build.SourcesDirectory)'
+    Contents: '**\*'
+
+- task: DropValidatorTask@0
+  displayName: 'SBOM Validator and Publisher Task'
+  inputs:
+    BuildDropPath: '$(Agent.TempDirectory)/artifacts/deploy'
+    OutputPath: 'output.json'
+    ValidateSignature: true
+    Verbosity: 'Verbose'
+    continueOnError: true

.github/actions/build.yml

@@ -0,0 +1,88 @@
+parameters:
+  # Default values
+  unitTest: true
+  codeCoverage: false
+  componentGovernance: false
+  packageArtifacts: false
+  packageIntegrationTests: false
+  targetBuildFramework: ''
+
+steps:
+- task: UseDotNet@2
+  displayName: 'Use .NET SDK'
+  inputs:
+    useGlobalJson: true
+
+- ${{ if eq(parameters.targetBuildFramework, '') }}:
+  - task: DotNetCoreCLI@2
+    displayName: 'dotnet build $(buildConfiguration)'
+    inputs:
+      command: build
+      arguments: '--configuration $(buildConfiguration) -p:ContinuousIntegrationBuild=true -p:AssemblyVersion="$(assemblySemVer)" -p:FileVersion="$(assemblySemFileVer)" -p:InformationalVersion="$(informationalVersion)" -p:Version="$(majorMinorPatch)" -warnaserror'
+      workingDirectory: $(System.DefaultWorkingDirectory)
+
+- ${{ if ne(parameters.targetBuildFramework, '') }}:
+  - task: DotNetCoreCLI@2
+    displayName: 'dotnet build $(buildConfiguration)'
+    inputs:
+      command: build
+      arguments: '--configuration $(buildConfiguration) -p:ContinuousIntegrationBuild=true -p:AssemblyVersion="$(assemblySemVer)" -p:FileVersion="$(assemblySemFileVer)" -p:InformationalVersion="$(informationalVersion)" -p:Version="$(majorMinorPatch)" -warnaserror -f ${{parameters.targetBuildFramework}}'
+      workingDirectory: $(System.DefaultWorkingDirectory)
+
+- ${{ if eq(parameters.unitTest, 'true') }}:
+  - task: DotNetCoreCLI@2
+    displayName: 'dotnet test'
+    inputs:
+      command: test
+      projects: '**/*UnitTests/*.csproj'
+      arguments: '--configuration $(buildConfiguration) --no-build -f ${{parameters.targetBuildFramework}}'
+      testRunTitle: 'Unit Tests'
+
+- ${{ if eq(parameters.codeCoverage, 'true') }}:
+  - task: DotNetCoreCLI@2
+    displayName: 'dotnet test with coverage'
+    inputs:
+      command: test
+      projects: '**/*UnitTests/*.csproj'
+      arguments: '--configuration $(buildConfiguration) --no-build --collect "XPlat Code Coverage" -s "$(build.sourcesDirectory)/CodeCoverage.runsettings" -v normal -f ${{parameters.targetBuildFramework}}'
+      testRunTitle: 'Unit Tests'
+  - task: reportgenerator@5
+    displayName: 'aggregate code coverage'
+    condition: succeededOrFailed()
+    inputs:
+      reports: '$(Agent.TempDirectory)/*/coverage.cobertura.xml'
+      reporttypes: 'Cobertura'
+      targetdir: '$(Agent.TempDirectory)/coverage'
+  - task: PublishCodeCoverageResults@1
+    displayName: 'publish code coverage'
+    condition: succeededOrFailed()
+    inputs:
+      codeCoverageTool: 'Cobertura'
+      failIfCoverageEmpty: true
+      summaryFileLocation: '$(Agent.TempDirectory)/coverage/Cobertura.xml'
+  - task: PublishBuildArtifacts@1
+    displayName: 'publish Cobertura.xml'
+    inputs:
+      pathToPublish: '$(Agent.TempDirectory)/coverage/Cobertura.xml'
+      artifactName: 'IntegrationTests'
+      artifactType: 'container'
+
+- ${{ if eq(parameters.packageArtifacts, 'true') }}:
+  # https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/secure-supply-chain/ado-sbom-generator
+  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
+    displayName: 'SBOM Generation Task'
+    inputs:
+      BuildDropPath: '$(build.artifactStagingDirectory)'
+      BuildComponentPath: '$(Build.SourcesDirectory)'
+  - task: PublishBuildArtifacts@1
+    displayName: 'Publish SBOM Artifacts'
+    inputs:
+      pathToPublish: '$(build.artifactStagingDirectory)'
+      artifactName: 'deploy'
+      artifactType: 'container'
+
+- ${{ if eq(parameters.packageArtifacts, 'true') }}:
+  - template: package.yml
+
+- ${{ if eq(parameters.packageIntegrationTests, 'true') }}:
+  - template: package-integration-tests.yml

.github/actions/clean-storage-accounts/action.yml

@@ -0,0 +1,30 @@
+name: clean storage Accounts
+description: Removes blob containers from test storage accounts
+
+inputs:
+  environmentName:
+    description: Deployment environment name
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Clean Storage Accounts
+      uses: azure/powershell@v2
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+          $currentUtcTime = [DateTime]::UtcNow
+          Get-AzContext
+          $storageAccounts = Get-AzStorageAccount -ResourceGroupName ${{ inputs.environmentName }}
+          foreach ($storageAccount in $storageAccounts) {
+
+              $storageContainers = Get-AzStorageContainer -Name * -Context $storageAccount.Context
+              foreach ($container in $storageContainers) {
+                  $ageDiff = $currentUtcTime - $container.CloudBlobContainer.Properties.LastModified.UtcDateTime
+                  if($ageDiff.TotalDays -ge 3) {
+                      Write-Host "Deleting container $($container.Name)"
+                      $container.CloudBlobContainer.Delete()
+                  }
+              }
+          }

.github/actions/cleanup-integration-test-databases/action.yml

@@ -0,0 +1,25 @@
+name: cleanup integration test databases
+description: Deletes databases used for integration tests from previous runs
+
+inputs:
+  environmentName:
+    description: Deployment environment name
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Remove Integration Test Databases
+      uses: azure/powershell@v1
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+          Get-AzContext
+          $testNamePatterns = @("SNAPSHOT*","FHIRCOMPATIBILITYTEST*","FHIRINTEGRATIONTEST*","FHIRRESOURCECHANGEDISABLEDTEST*","BASE*","SNAPSHOT*")
+          foreach ($pattern in $testNamePatterns) {
+            $resources = Get-AzResource -ResourceGroupName ${{ inputs.environmentName }} -ResourceType 'Microsoft.Sql/servers/databases' -Name $pattern
+            foreach ($resource in $resources) {
+              Write-Host "Cleaning up $($resource.ResourceName)"
+              Remove-AzResource -ResourceId $resource.ResourceId -Force
+            }
+          }

.github/actions/docker-add-tag.yml

@@ -0,0 +1,28 @@
+
+parameters:
+- name: sourceTag
+  type: string
+- name: targetTag
+  type: string
+
+jobs:
+- job: DockerAddTag
+  pool:
+    name: '$(DefaultLinuxPool)'
+    vmImage: '$(LinuxVmImage)'
+  steps:
+  - task: AzureCLI@2
+    displayName: 'Azure CLI: InlineScript'
+    inputs:
+      azureSubscription: $(ConnectedServiceName)
+      scriptType: bash
+      scriptLocation: inlineScript
+      inlineScript: |
+        az acr login -n $(azureContainerRegistry)
+        for v in stu3 r4 r4b r5; do
+          sourceImage="$(azureContainerRegistry)/${v}_fhir-server:${{parameters.sourceTag}}"
+          targetImage="$(azureContainerRegistry)/${v}_fhir-server:${{parameters.targetTag}}"
+          docker pull $sourceImage
+          docker tag $sourceImage $targetImage
+          docker push $targetImage
+        done