Skip to content

Commit 7b0c93d

Browse files
ramsessanchezramsessanchez
authored
Merge branch 'main' into gavinbarron/connect-mggraph-loginhint
2 parents 80c1e8e + 1bd0320 commit 7b0c93d

21 files changed

Lines changed: 195 additions & 43 deletions

‎.azure-pipelines/command-metadata-refresh.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ extends:
148148
git status
149149
git add "$(System.DefaultWorkingDirectory)/config/ModuleMetadata.json"
150150
git commit -m 'Bump module versions after metadata generation.'
151-
git push "https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
151+
git push "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
152152
git status
153153
154154
- ${{ if eq(parameters.CreatePullRequest, true) }}:

‎.azure-pipelines/common-templates/create-pr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,5 +33,5 @@ steps:
3333
3434
git status
3535
gh auth login
36-
git push "https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
36+
git push "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
3737
gh pr create -t $Title -b $Body -B $BaseBranchName -H $Head

‎.azure-pipelines/common-templates/download-openapi-docs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ steps:
9292
git add .
9393
git commit -m 'Weekly OpenApiDocs Download.'
9494
git status
95-
git push --set-upstream "https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git" $(Branch)
95+
git push --set-upstream "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git" $(Branch)
9696
git status
9797
9898
# References

‎.azure-pipelines/common-templates/install-sdk.yml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,24 @@ steps:
55
targetType: 'inline'
66
pwsh: true
77
script: |
8+
# Register the central CFS feed (network-isolation compliance) and install the SDK modules from it.
9+
$token = ConvertTo-SecureString "$env:SYSTEM_ACCESSTOKEN" -AsPlainText -Force
10+
$cred = [System.Management.Automation.PSCredential]::new("azure", $token)
11+
$feedUrl = "https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/PowerShell_V2_Build/nuget/v2"
12+
if (-not (Get-PSRepository -Name PowerShell_V2_Build -ErrorAction SilentlyContinue)) {
13+
Register-PSRepository -Name PowerShell_V2_Build -SourceLocation $feedUrl -InstallationPolicy Trusted -Credential $cred
14+
}
815
try{
916
# Installing Beta module.
10-
Install-Module Microsoft.Graph.Beta -Repository PSGallery -Scope AllUsers -AcceptLicense -SkipPublisherCheck -Force -AllowClobber
17+
Install-Module Microsoft.Graph.Beta -Repository PowerShell_V2_Build -Credential $cred -Scope AllUsers -AcceptLicense -SkipPublisherCheck -Force -AllowClobber
1118
}catch{
1219
echo "Error when installing Beta"
1320
}
1421
try{
1522
# Installing V1 module.
16-
Install-Module Microsoft.Graph -Repository PSGallery -Scope AllUsers -AcceptLicense -SkipPublisherCheck -Force -AllowClobber
23+
Install-Module Microsoft.Graph -Repository PowerShell_V2_Build -Credential $cred -Scope AllUsers -AcceptLicense -SkipPublisherCheck -Force -AllowClobber
1724
}catch{
1825
echo "Error when installing V1"
19-
}
26+
}
27+
env:
28+
SYSTEM_ACCESSTOKEN: $(System.AccessToken)

‎.azure-pipelines/docker-image-refresh.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Copyright (c) Microsoft Corporation. All rights reserved.
2+
# Licensed under the MIT License.
3+
#
4+
# Scheduled rebuild of the microsoftgraph/powershell container image.
5+
#
6+
# Why this pipeline exists:
7+
# The release pipeline (sdk-release.yml) only builds and pushes this image on `v*` tags, so
8+
# between releases the published digest goes stale and keeps accruing Ubuntu USN / PowerShell
9+
# CVEs. That is the root cause of the two S360 "Replace Vulnerable Registry Reference" items.
10+
# This lightweight pipeline rebuilds the image on a cadence against a patched base and pushes a
11+
# fresh digest to :latest, keeping the registry copy patched without re-running the full release.
12+
#
13+
# Setup (one-time): register this YAML as a new pipeline definition in the
14+
# "Graph Developer Experiences" ADO project, targeting the default branch.
15+
name: $(Date:yyyyMMdd)$(Rev:.r)_docker-image-refresh
16+
17+
parameters:
18+
- name: LinuxPool
19+
type: string
20+
default: Azure-Pipelines-1ESPT-ExDShared
21+
22+
variables:
23+
REGISTRY: 'msgraphprodregistry.azurecr.io'
24+
IMAGE_NAME: 'public/microsoftgraph/powershell'
25+
26+
# Rebuild weekly so the image regularly picks up patched OS layers. `always: true` forces a run
27+
# even when there are no new commits (the whole point is to refresh the base image).
28+
schedules:
29+
- cron: "0 6 * * 1" # 06:00 UTC every Monday
30+
displayName: Weekly image refresh
31+
branches:
32+
include:
33+
- main
34+
always: true
35+
36+
# Do not build on every push/PR; the release pipeline already handles tag-driven publishes.
37+
trigger: none
38+
pr: none
39+
40+
resources:
41+
repositories:
42+
- repository: 1ESPipelineTemplates
43+
type: git
44+
name: 1ESPipelineTemplates/1ESPipelineTemplates
45+
ref: refs/tags/release
46+
47+
extends:
48+
template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
49+
parameters:
50+
pool:
51+
name: ${{ parameters.LinuxPool }}
52+
image: ubuntu-latest
53+
os: linux
54+
settings:
55+
networkIsolationPolicy: Permissive
56+
customBuildTags:
57+
- ES365AIMigrationTooling
58+
stages:
59+
- stage: RefreshDockerImage
60+
displayName: 'Refresh docker image'
61+
jobs:
62+
- job: RebuildAndPush
63+
displayName: 'Rebuild and push patched image'
64+
pool:
65+
name: ${{ parameters.LinuxPool }}
66+
image: ubuntu-latest
67+
os: linux
68+
steps:
69+
- checkout: self
70+
71+
- task: AzureCLI@2
72+
displayName: 'Log in to Azure Container Registry'
73+
inputs:
74+
azureSubscription: 'ACR Images Push Service Connection'
75+
scriptType: 'bash'
76+
scriptLocation: 'inlineScript'
77+
inlineScript: |
78+
az acr login --name $(REGISTRY)
79+
80+
- script: |
81+
docker run --privileged --rm tonistiigi/binfmt --install all
82+
displayName: 'Enable multi-platform builds'
83+
84+
- script: |
85+
docker buildx create --use --name refreshbuilder
86+
displayName: 'Set up Docker BuildX'
87+
88+
- bash: |
89+
set -euo pipefail
90+
formatted_date=$(date +"%Y%m%d%H%M%S")
91+
echo "Rebuilding $(REGISTRY)/$(IMAGE_NAME) on a patched base"
92+
docker buildx build \
93+
--platform linux/amd64 \
94+
--push \
95+
-t "$(REGISTRY)/$(IMAGE_NAME):latest" \
96+
-t "$(REGISTRY)/$(IMAGE_NAME):$formatted_date" \
97+
"$(Build.SourcesDirectory)"
98+
displayName: 'Build and push refreshed image'

‎.azure-pipelines/generation-templates/generate-command-metadata.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,5 @@ steps:
3030
git status
3131
git add "$(System.DefaultWorkingDirectory)/src/Authentication/Authentication/custom/common/MgCommandMetadata.json"
3232
git commit -m 'Add generated MgCommandMetadata.json. [run ci]'
33-
git push "https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
33+
git push "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git"
3434
git status

‎.azure-pipelines/weekly-examples-update.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ extends:
9696
git status
9797
git add .
9898
git commit -m "Updating examples"
99-
git push --set-upstream https://$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git $(ComputeBranch.WeeklyExamplesBranch)
99+
git push --set-upstream "https://x-access-token:$(GITHUB_TOKEN)@github.com/microsoftgraph/msgraph-sdk-powershell.git" $(ComputeBranch.WeeklyExamplesBranch)
100100
git status
101101
- template: .azure-pipelines/common-templates/create-pr.yml@self
102102
parameters:

‎Dockerfile‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
1-
FROM mcr.microsoft.com/powershell
1+
# Pin to a maintained Ubuntu 22.04 PowerShell base tag instead of the floating :latest.
2+
# The PowerShell team rebuilds these date-stamped rolling tags with patched OS layers, so a
3+
# scheduled rebuild (see .azure-pipelines/docker-image-refresh.yml) picks up Ubuntu/USN and
4+
# PowerShell CVE fixes and produces a fresh digest, clearing the S360
5+
# "Replace Vulnerable Registry Reference" findings. Override at build time with
6+
# --build-arg PS_BASE_TAG=<tag> (e.g. 7.4-ubuntu-22.04 or lts-ubuntu-22.04).
7+
ARG PS_BASE_TAG=lts-ubuntu-22.04
8+
FROM mcr.microsoft.com/powershell:${PS_BASE_TAG}
29

310
ARG VERSION=latest
411

‎autorest.powershell‎

‎src/Applications/beta/examples/Get-MgBetaServicePrincipalSynchronizationTemplate.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
### Example
2+
3+
```powershell
4+
5+
Import-Module Microsoft.Graph.Beta.Applications
6+
7+
Get-MgBetaServicePrincipalSynchronizationTemplate -ServicePrincipalId $servicePrincipalId
8+
9+
```
10+
This example shows how to use the Get-MgBetaServicePrincipalSynchronizationTemplate Cmdlet.
11+

0 commit comments

Comments
 (0)