Skip to content

Commit 9173712

Browse files
jamesadevineCopilot
jamesadevine
and
Copilot
authored
Add release automations (#14)
* feat: distribute ado-aw via GitHub Releases instead of ADO pipeline artifacts Replace DownloadPipelineArtifact@2 tasks (pipeline 2437, project 4x4) in both standalone and 1ES templates with curl downloads from GitHub Releases, verified via SHA256 checksums. The compiler embeds its own CARGO_PKG_VERSION at compile time so generated pipelines always fetch the matching release. Changes: - Add .github/workflows/release.yml (triggered on v* tags) - Update templates/base.yml and templates/1es-base.yml (6 download sites) - Add {{ compiler_version }} marker replacement in both compilers - Add integration test assertions for new download mechanism - Document {{ compiler_version }} marker in AGENTS.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: automate releases with release-please Replace manual tag-triggered release with release-please automation: - On push to main, release-please maintains a Release PR with changelog and Cargo.toml version bump (based on conventional commits) - Merging the Release PR creates the git tag and GitHub Release - Build job then compiles the binary and uploads assets to the release Bump logic: fix: → Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: checksum verification filename mismatch and pin action versions Fix critical bug where sha256sum --check would always fail because the binary was downloaded as 'ado-aw' but the checksum file references 'ado-aw-linux-x64'. Now downloads as 'ado-aw-linux-x64', verifies the checksum, then renames to 'ado-aw'. Fixed in all 6 download blocks across both templates. Also: - Pin GitHub Actions to commit SHAs for supply-chain security - Add set -euo pipefail to release asset preparation step Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: add --clobber to release upload and test compiled output markers - Add --clobber to gh release upload for idempotent retries - Add integration test that compiles a fixture through the binary and verifies no unreplaced {{ markers }} remain in the output, confirming {{ compiler_version }} is correctly substituted Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 9c10cf2 commit 9173712

7 files changed

Lines changed: 250 additions & 64 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
env:
9+
CARGO_TERM_COLOR: always
10+
11+
permissions:
12+
contents: write
13+
pull-requests: write
14+
15+
jobs:
16+
release-please:
17+
name: Release Please
18+
runs-on: ubuntu-latest
19+
outputs:
20+
release_created: ${{ steps.release.outputs.release_created }}
21+
tag_name: ${{ steps.release.outputs.tag_name }}
22+
steps:
23+
- uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56571f # v4.1.3
24+
id: release
25+
with:
26+
release-type: rust
27+
28+
build:
29+
name: Build (Linux)
30+
needs: release-please
31+
if: ${{ needs.release-please.outputs.release_created }}
32+
runs-on: ubuntu-latest
33+
steps:
34+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
36+
- uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc97ebc # stable
37+
38+
- uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
39+
40+
- name: Build
41+
run: cargo build --release --verbose
42+
43+
- name: Run tests
44+
run: cargo test --verbose
45+
46+
- name: Prepare release assets
47+
run: |
48+
set -euo pipefail
49+
cd target/release
50+
cp ado-aw ado-aw-linux-x64
51+
sha256sum ado-aw-linux-x64 > ado-aw-linux-x64.sha256
52+
53+
- name: Upload release assets
54+
env:
55+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
56+
run: |
57+
gh release upload ${{ needs.release-please.outputs.tag_name }} \
58+
target/release/ado-aw-linux-x64 \
59+
target/release/ado-aw-linux-x64.sha256 \
60+
--clobber

‎AGENTS.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -573,6 +573,17 @@ Generates environment variable entries for the copilot AWF step when `read-only-
573573

574574
If no `read-only-service-connection` is configured, this marker is replaced with an empty string, and ADO access tokens are omitted from the copilot invocation.
575575

576+
## {{ compiler_version }}
577+
578+
Should be replaced with the version of the `ado-aw` compiler that generated the pipeline (derived from `CARGO_PKG_VERSION` at compile time). This version is used to construct the GitHub Releases download URL for the `ado-aw` binary.
579+
580+
The generated pipelines download the compiler binary from:
581+
```
582+
https://github.com/githubnext/ado-aw/releases/download/v{VERSION}/ado-aw-linux-x64
583+
```
584+
585+
A SHA256 checksum file (`ado-aw-linux-x64.sha256`) is also downloaded and verified to ensure binary integrity. This replaces the previous approach of downloading from an internal ADO pipeline artifact.
586+
576587
### 1ES-Specific Template Markers
577588

578589
The following markers are specific to the 1ES target (`target: 1es`) and are not used in standalone pipelines:
@@ -944,7 +955,7 @@ mcp-servers:
944955

945956
Network isolation is provided by AWF (Agentic Workflow Firewall), which provides L7 (HTTP/HTTPS) egress control using Squid proxy and Docker containers. AWF restricts network access to a whitelist of approved domains.
946957

947-
The AWF binary is downloaded from an internal ADO pipeline (pipeline 2450, branch `ms/main`, artifact `gh-aw-firewall-linux-x64`). Docker is sourced via the `DockerInstaller@0` ADO task.
958+
The `ado-aw` compiler binary is distributed via [GitHub Releases](https://github.com/githubnext/ado-aw/releases) with SHA256 checksum verification. The AWF binary is downloaded from an internal ADO pipeline (pipeline 2450, branch `ms/main`, artifact `gh-aw-firewall-linux-x64`). Docker is sourced via the `DockerInstaller@0` ADO task.
948959

949960
### Default Allowed Domains
950961

‎src/compile/onees.rs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,9 @@ displayName: "Finalize""#,
114114
);
115115

116116
// Replace all template markers
117+
let compiler_version = env!("CARGO_PKG_VERSION");
117118
let replacements: Vec<(&str, &str)> = vec![
119+
("{{ compiler_version }}", compiler_version),
118120
("{{ pool }}", &pool),
119121
("{{ schedule }}", &schedule),
120122
("{{ pr_trigger }}", &pr_trigger),

‎src/compile/standalone.rs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,9 @@ impl Compiler for StandaloneCompiler {
120120
);
121121

122122
// Replace template markers
123+
let compiler_version = env!("CARGO_PKG_VERSION");
123124
let replacements: Vec<(&str, &str)> = vec![
125+
("{{ compiler_version }}", compiler_version),
124126
("{{ pool }}", &pool),
125127
("{{ setup_job }}", &setup_job),
126128
("{{ teardown_job }}", &teardown_job),

‎templates/1es-base.yml‎

Lines changed: 51 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,23 @@ extends:
5454

5555
{{ prepare_steps }}
5656

57-
- task: DownloadPipelineArtifact@2
58-
displayName: "Download agentic pipeline compiler"
59-
inputs:
60-
source: "specific"
61-
project: "4x4"
62-
pipeline: 2437
63-
runVersion: "latestFromBranch"
64-
branchName: "refs/heads/main"
65-
artifact: "agentic-pipeline-compiler-linux-x64"
66-
targetPath: "$(Pipeline.Workspace)/agentic-pipeline-compiler"
57+
- bash: |
58+
COMPILER_VERSION="{{ compiler_version }}"
59+
DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
60+
DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
61+
CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
62+
63+
mkdir -p "$DOWNLOAD_DIR"
64+
echo "Downloading ado-aw v${COMPILER_VERSION} from GitHub Releases..."
65+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64" "$DOWNLOAD_URL"
66+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64.sha256" "$CHECKSUM_URL"
67+
68+
echo "Verifying checksum..."
69+
cd "$DOWNLOAD_DIR"
70+
sha256sum --check ado-aw-linux-x64.sha256
71+
mv ado-aw-linux-x64 ado-aw
72+
chmod +x ado-aw
73+
displayName: "Download agentic pipeline compiler (v{{ compiler_version }})"
6774
6875
- bash: |
6976
AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -160,16 +167,23 @@ extends:
160167
echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/agency.linux-x64"
161168
displayName: Add agency to PATH
162169
163-
- task: DownloadPipelineArtifact@2
164-
displayName: "Download agentic pipeline compiler"
165-
inputs:
166-
source: "specific"
167-
project: "4x4"
168-
pipeline: 2437
169-
runVersion: "latestFromBranch"
170-
branchName: "refs/heads/main"
171-
artifact: "agentic-pipeline-compiler-linux-x64"
172-
targetPath: "$(Pipeline.Workspace)/agentic-pipeline-compiler"
170+
- bash: |
171+
COMPILER_VERSION="{{ compiler_version }}"
172+
DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
173+
DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
174+
CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
175+
176+
mkdir -p "$DOWNLOAD_DIR"
177+
echo "Downloading ado-aw v${COMPILER_VERSION} from GitHub Releases..."
178+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64" "$DOWNLOAD_URL"
179+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64.sha256" "$CHECKSUM_URL"
180+
181+
echo "Verifying checksum..."
182+
cd "$DOWNLOAD_DIR"
183+
sha256sum --check ado-aw-linux-x64.sha256
184+
mv ado-aw-linux-x64 ado-aw
185+
chmod +x ado-aw
186+
displayName: "Download agentic pipeline compiler (v{{ compiler_version }})"
173187
174188
- bash: |
175189
mkdir -p {{ working_directory }}/safe_outputs
@@ -297,16 +311,23 @@ extends:
297311
- download: current
298312
artifact: analyzed_outputs
299313

300-
- task: DownloadPipelineArtifact@2
301-
displayName: "Download agentic pipeline compiler"
302-
inputs:
303-
source: "specific"
304-
project: "4x4"
305-
pipeline: 2437
306-
runVersion: "latestFromBranch"
307-
branchName: "refs/heads/main"
308-
artifact: "agentic-pipeline-compiler-linux-x64"
309-
targetPath: "$(Pipeline.Workspace)/agentic-pipeline-compiler"
314+
- bash: |
315+
COMPILER_VERSION="{{ compiler_version }}"
316+
DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
317+
DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
318+
CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
319+
320+
mkdir -p "$DOWNLOAD_DIR"
321+
echo "Downloading ado-aw v${COMPILER_VERSION} from GitHub Releases..."
322+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64" "$DOWNLOAD_URL"
323+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64.sha256" "$CHECKSUM_URL"
324+
325+
echo "Verifying checksum..."
326+
cd "$DOWNLOAD_DIR"
327+
sha256sum --check ado-aw-linux-x64.sha256
328+
mv ado-aw-linux-x64 ado-aw
329+
chmod +x ado-aw
330+
displayName: "Download agentic pipeline compiler (v{{ compiler_version }})"
310331
311332
- bash: |
312333
chmod +x $(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw

‎templates/base.yml‎

Lines changed: 51 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -52,17 +52,23 @@ jobs:
5252
copilot -h
5353
displayName: "Output copilot version"
5454
55-
- task: DownloadPipelineArtifact@2
56-
displayName: "Download agentic pipeline compiler"
57-
name: agenticpipelinecompilerdrop
58-
inputs:
59-
source: "specific"
60-
project: "4x4"
61-
pipeline: 2437
62-
runVersion: "latestFromBranch"
63-
branchName: "refs/heads/main"
64-
artifact: "agentic-pipeline-compiler-linux-x64"
65-
targetPath: "$(Pipeline.Workspace)/agentic-pipeline-compiler"
55+
- bash: |
56+
COMPILER_VERSION="{{ compiler_version }}"
57+
DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
58+
DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
59+
CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
60+
61+
mkdir -p "$DOWNLOAD_DIR"
62+
echo "Downloading ado-aw v${COMPILER_VERSION} from GitHub Releases..."
63+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64" "$DOWNLOAD_URL"
64+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64.sha256" "$CHECKSUM_URL"
65+
66+
echo "Verifying checksum..."
67+
cd "$DOWNLOAD_DIR"
68+
sha256sum --check ado-aw-linux-x64.sha256
69+
mv ado-aw-linux-x64 ado-aw
70+
chmod +x ado-aw
71+
displayName: "Download agentic pipeline compiler (v{{ compiler_version }})"
6672
6773
- bash: |
6874
AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -302,17 +308,23 @@ jobs:
302308
copilot -h
303309
displayName: "Output copilot version"
304310
305-
- task: DownloadPipelineArtifact@2
306-
displayName: "Download agentic pipeline compiler"
307-
name: agenticpipelinecompilerdrop
308-
inputs:
309-
source: "specific"
310-
project: "4x4"
311-
pipeline: 2437
312-
runVersion: "latestFromBranch"
313-
branchName: "refs/heads/main"
314-
artifact: "agentic-pipeline-compiler-linux-x64"
315-
targetPath: "$(Pipeline.Workspace)/agentic-pipeline-compiler"
311+
- bash: |
312+
COMPILER_VERSION="{{ compiler_version }}"
313+
DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
314+
DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
315+
CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
316+
317+
mkdir -p "$DOWNLOAD_DIR"
318+
echo "Downloading ado-aw v${COMPILER_VERSION} from GitHub Releases..."
319+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64" "$DOWNLOAD_URL"
320+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64.sha256" "$CHECKSUM_URL"
321+
322+
echo "Verifying checksum..."
323+
cd "$DOWNLOAD_DIR"
324+
sha256sum --check ado-aw-linux-x64.sha256
325+
mv ado-aw-linux-x64 ado-aw
326+
chmod +x ado-aw
327+
displayName: "Download agentic pipeline compiler (v{{ compiler_version }})"
316328
317329
- task: DockerInstaller@0
318330
displayName: "Install Docker"
@@ -488,17 +500,23 @@ jobs:
488500
- download: current
489501
artifact: analyzed_outputs_$(Build.BuildId)
490502

491-
- task: DownloadPipelineArtifact@2
492-
displayName: "Download agentic pipeline compiler"
493-
name: agenticpipelinecompilerdrop
494-
inputs:
495-
source: "specific"
496-
project: "4x4"
497-
pipeline: 2437
498-
runVersion: "latestFromBranch"
499-
branchName: "refs/heads/main"
500-
artifact: "agentic-pipeline-compiler-linux-x64"
501-
targetPath: "$(Pipeline.Workspace)/agentic-pipeline-compiler"
503+
- bash: |
504+
COMPILER_VERSION="{{ compiler_version }}"
505+
DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
506+
DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
507+
CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
508+
509+
mkdir -p "$DOWNLOAD_DIR"
510+
echo "Downloading ado-aw v${COMPILER_VERSION} from GitHub Releases..."
511+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64" "$DOWNLOAD_URL"
512+
curl -fsSL -o "$DOWNLOAD_DIR/ado-aw-linux-x64.sha256" "$CHECKSUM_URL"
513+
514+
echo "Verifying checksum..."
515+
cd "$DOWNLOAD_DIR"
516+
sha256sum --check ado-aw-linux-x64.sha256
517+
mv ado-aw-linux-x64 ado-aw
518+
chmod +x ado-aw
519+
displayName: "Download agentic pipeline compiler (v{{ compiler_version }})"
502520
503521
- bash: |
504522
ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"

0 commit comments

Comments
 (0)