- Hopefully fixed expansion of stage dependencies.

- Moved secrets_stage dependency into stages.

Author: paulmedynski

eng/pipelines/common/templates/stages/ci-run-tests-stage.yml

@@ -3,13 +3,20 @@
 # The .NET Foundation licenses this file to you under the MIT license.          #
 # See the LICENSE file in the project root for more information.                #
 #################################################################################
+
+# This stage depends on the secrets_stage.
+
 parameters:
   - name: abstractionsArtifactsName
     type: string
 
   - name: abstractionsPackageVersion
     type: string
 
+  - name: additionalDependsOn
+    type: object
+    default: []
+
   - name: buildConfiguration
     type: string
     values:
@@ -20,10 +27,6 @@ parameters:
     type: boolean
     default: false
 
-  - name: dependsOn
-    type: object
-    default: []
-
   - name: mdsArtifactsName
     type: string
     default: MDS.Artifacts
@@ -45,10 +48,6 @@ parameters:
       - Project
       - Package
 
-  # The SA password to set when configuring SQL Server.
-  - name: saPassword
-    type: string
-
   - name: testConfigurations
     type: object
 
@@ -60,7 +59,15 @@ stages:
 - ${{ each config in parameters.testConfigurations }}:
   - ${{ each image in config.value.images }}:
     - stage: ${{ image.key }}
-      dependsOn: ${{ parameters.dependsOn }}
+      dependsOn:
+        - secrets_stage
+        - ${{ parameters.additionalDependsOn }}
+
+      variables:
+        # Bring the SA password from the secrets_stage into scope here.
+        - name: saPassword
+          value: $[stageDependencies.secrets_stage.secrets_job.outputs['SaPassword.Value']]
+
       jobs:
       - ${{ each targetFramework in config.value.TargetFrameworks }}:
         - ${{ each platform in config.value.buildPlatforms }}:
@@ -91,7 +98,7 @@ stages:
                   configSqlFor: ${{ config.value.configSqlFor }}
                   operatingSystem: ${{ config.value.operatingSystem }}
                   isArm64: ${{ eq(config.value.isArm64, 'true') }}
-                  saPassword: ${{ parameters.saPassword }}
+                  saPassword: $(saPassword)
                   ${{if ne(config.value.configProperties, '{}') }}:
                     ${{ each x86TF in config.value.configProperties.x86TestTargetFrameworks }}:
                       ${{ if eq(x86TF, targetFramework) }}:
@@ -128,7 +135,7 @@ stages:
                     configSqlFor: ${{ config.value.configSqlFor }}
                     operatingSystem: ${{ config.value.operatingSystem }}
                     isArm64: ${{ eq(config.value.isArm64, 'true') }}
-                    saPassword: ${{ parameters.saPassword }}
+                    saPassword: $(saPassword)
                     ${{if and(eq(usemanagedSNI, false), ne(config.value.configProperties, '{}')) }}:
                       ${{ each x86TF in config.value.configProperties.x86TestTargetFrameworks }}:
                         ${{ if eq(x86TF, targetFramework) }}:

eng/pipelines/dotnet-sqlclient-ci-core.yml

@@ -178,33 +178,26 @@ stages:
       # When building via packages, we must depend on the Abstractions and MDS
       # packages.
       ${{ if eq(parameters.referenceType, 'Package') }}:
-        dependsOn:
-          - secrets_stage
+        additionalDependsOn:
           - build_abstractions_package_stage
           - build_mds_akv_packages_stage
-      ${{ else }}:
-        dependsOn:
-          - secrets_stage
       dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
       mdsArtifactsName: $(mdsArtifactsName)
       mdsPackageVersion: $(mdsPackageVersion)
       referenceType: ${{ parameters.referenceType }}
-      saPassword: $[stageDependencies.secrets_stage.secrets_job.outputs['SaPassword.Value']]
 
   # Run the stress tests, if desired.
   - ${{ if eq(parameters.enableStressTests, true) }}:
     - template: /eng/pipelines/stages/stress-tests-ci-stage.yml@self
       parameters:
         buildConfiguration: ${{ parameters.buildConfiguration }}
-        dependsOn:
-          - secrets_stage
+        additionalDependsOn:
           - build_mds_akv_packages_stage
           - build_azure_package_stage
         mdsArtifactsName: $(mdsArtifactsName)
         mdsPackageVersion: $(mdsPackageVersion)
         azurePackageVersion: $(azurePackageVersion)
         dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
-        saPassword: $[stageDependencies.secrets_stage.secrets_job.outputs['SaPassword.Value']]
 
   # Run the MDS and AKV tests.
   - template: /eng/pipelines/common/templates/stages/ci-run-tests-stage.yml@self
@@ -216,20 +209,15 @@ stages:
       abstractionsPackageVersion: $(abstractionsPackageVersion)
       mdsArtifactsName: $(mdsArtifactsName)
       mdsPackageVersion: $(mdsPackageVersion)
-      saPassword: $[stageDependencies.secrets_stage.secrets_job.outputs['SaPassword.Value']]
       testJobTimeout: ${{ parameters.testJobTimeout }}
 
       # When testing MDS via packages, we must depend on the Abstractions,
       # MDS, and Azure packages.
       ${{ if eq(parameters.referenceType, 'Package') }}:
-        dependsOn:
-          - secrets_stage
+        additionalDependsOn:
           - build_abstractions_package_stage
           - build_mds_akv_packages_stage
           - build_azure_package_stage
-      ${{ else }}:
-        dependsOn:
-          - secrets_stage
 
       # Steps to run prior to building and running tests on each job.
       prebuildSteps:

eng/pipelines/stages/build-azure-package-ci-stage.yml

@@ -20,6 +20,8 @@
 # The packages are published to pipeline artifacts with the name specified by
 # the azureArtifactsName parameter.
 #
+# This stage depends on the secrets_stage.
+#
 # This template defines a stage named 'build_azure_package_stage' that
 # can be depended on by downstream stages.
 
@@ -38,6 +40,11 @@ parameters:
   - name: abstractionsPackageVersion
     type: string
 
+  # Additional stages we depend on, if any.
+  - name: additionalDependsOn
+    type: object
+    default: []
+
   # The name of the pool to use for jobs that require customized VM images.
   - name: adoPoolName
     type: string
@@ -79,11 +86,6 @@ parameters:
     type: boolean
     default: false
 
-  # The stages we depend on, if any.
-  - name: dependsOn
-    type: object
-    default: []
-
   # The dotnet CLI verbosity to use.
   - name: dotnetVerbosity
     type: string
@@ -119,16 +121,19 @@ parameters:
     - Package
     - Project
 
-  # The SA password to set when configuring SQL Server.
-  - name: saPassword
-    type: string
-
 stages:
 
   - stage: build_azure_package_stage
     displayName: Build Azure Package
 
-    dependsOn: ${{ parameters.dependsOn }}
+    dependsOn:
+      - secrets_stage
+      - ${{ parameters.additionalDependsOn }}
+
+    variables:
+      # Bring the SA password from the secrets_stage into scope here.
+      - name: saPassword
+        value: $[stageDependencies.secrets_stage.secrets_job.outputs['SaPassword.Value']]
 
     jobs:
 
@@ -168,13 +173,13 @@ stages:
           netRuntimes: [net8.0, net9.0, net10.0]
           poolName: ${{ parameters.adoPoolName }}
           referenceType: ${{ parameters.referenceType }}
-          saPassword: ${{ parameters.saPassword }}
+          saPassword: $(saPassword)
           # The image includes a SQL Server instance that we must configure.
           sqlServerSetupSteps:
             - template: /eng/pipelines/common/templates/steps/configure-sql-server-linux-step.yml@self
               parameters:
                 debug: ${{ parameters.debug }}
-                saPassword: ${{ parameters.saPassword }}
+                saPassword: $(saPassword)
           vmImage: ADO-UB22-SQL22
 
       # ------------------------------------------------------------------------
@@ -214,14 +219,14 @@ stages:
           netRuntimes: [net8.0, net9.0, net10.0]
           poolName: ${{ parameters.adoPoolName }}
           referenceType: ${{ parameters.referenceType }}
-          saPassword: ${{ parameters.saPassword }}
+          saPassword: $(saPassword)
           # The image includes a SQL Server instance that we must configure.
           sqlServerSetupSteps:
             - template: /eng/pipelines/common/templates/steps/configure-sql-server-win-step.yml@self
               # Use defaults for most parameters.
               parameters:
                 debug: ${{ parameters.debug }}
-                saPassword: ${{ parameters.saPassword }}
+                saPassword: $(saPassword)
                 enableLocalDB: true
                 # These variables are from an Azure DevOps Library variable
                 # group.

eng/pipelines/stages/generate-secrets-ci-stage.yml

@@ -54,14 +54,12 @@ stages:
           #
           - bash: |
               guid=$(cat /proc/sys/kernel/random/uuid)
-              echo "##vso[task.setvariable variable=Value;isSecret=true;isOutput=true]$guid"
+              echo "##vso[task.setvariable variable=Value;isOutput=true]$guid"
             name: SaPassword
             displayName: Generate SA password
 
           # Emit the SA password, if desired.
           - ${{ if eq(parameters.debug, true) }}:
             - bash: |
-                # Avoid Azure Pipelines masking the value by introducing some indirection.
-                $pwd = "$[stageDependencies.secrets_stage.secrets_job.outputs['SaPassword.Value']]"
-                echo "SA password: $pwd"
+                echo "SA password: $(SaPassword.Value)"
               displayName: Emit SA password

eng/pipelines/stages/stress-tests-ci-stage.yml

@@ -14,11 +14,19 @@
 # All tests use a localhost SQL Server configured for SQL auth via the 'sa' user
 # and the provided password.
 #
+# This stage depends on the secrets_stage.
+#
 # This template defines a stage named 'run_stress_tests_stage' that can be
 # depended on by downstream stages.
 
 parameters:
 
+  # The names of any additional stages this stage depends on, for example the stages that publish
+  # the MDS package artifacts we will test.
+  - name: additionalDependsOn
+    type: object
+    default: []
+
   # The Azure package version to stress test.  This version must be available in
   # one of the configured NuGet sources.
   - name: azurePackageVersion
@@ -33,12 +41,6 @@ parameters:
       - Debug
       - Release
 
-  # The names of any stages this stage depends on, for example the stages
-  # that publish the MDS package artifacts we will test.
-  - name: dependsOn
-    type: object
-    default: []
-
   # The verbosity level for the dotnet CLI commands.
   - name: dotnetVerbosity
     type: string
@@ -69,14 +71,12 @@ parameters:
     type: object
     default: [net8.0, net9.0, net10.0]
 
-  # The SA password to set when configuring SQL Server.
-  - name: saPassword
-    type: string
-
 stages:
   - stage: run_stress_tests_stage
     displayName: Run Stress Tests
-    dependsOn: ${{ parameters.dependsOn }}
+    dependsOn:
+      - secrets_stage
+      - ${{ parameters.additionalDependsOn }}
 
     variables:
       # The directory where dotnet artifacts will be staged.  Not to be
@@ -106,6 +106,10 @@ stages:
           $(commonArguments)
           --configuration ${{parameters.buildConfiguration}}
 
+      # Bring the SA password from the secrets_stage into scope here.
+      - name: saPassword
+        value: $[stageDependencies.secrets_stage.secrets_job.outputs['SaPassword.Value']]
+
       # The contents of the config file to use for all tests.  We will write
       # this to a JSON file for each test job, and then point to it via the
       # STRESS_CONFIG_FILE environment variable.
@@ -118,7 +122,7 @@ stages:
               "isDefault": true,
               "dataSource": "localhost",
               "user": "sa",
-              "password": "${{ parameters.saPassword }}",
+              "password": "$(saPassword)",
               "supportsWindowsAuthentication": false,
               "isLocal": false,
               "disableMultiSubnetFailover": true,
@@ -141,7 +145,7 @@ stages:
         sqlSetupStep:
           template: /eng/pipelines/common/templates/steps/configure-sql-server-linux-step.yml@self
           parameters:
-            saPassword: ${{ parameters.saPassword }}
+            saPassword: $(saPassword)
         mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
         solution: $(solution)
         testProject: $(testProject)
@@ -164,7 +168,7 @@ stages:
         sqlSetupStep:
           template: /eng/pipelines/common/templates/steps/configure-sql-server-win-step.yml@self
           parameters:
-            saPassword: ${{ parameters.saPassword }}
+            saPassword: $(saPassword)
         mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
         solution: $(solution)
         testProject: $(testProject)
@@ -190,7 +194,7 @@ stages:
         sqlSetupStep:
           template: /eng/pipelines/common/templates/steps/configure-sql-server-macos-step.yml@self
           parameters:
-            saPassword: ${{ parameters.saPassword }}
+            saPassword: $(saPassword)
         mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
         solution: $(solution)
         testProject: $(testProject)