trigger: none

pr:
  branches:
    include:
      - main
  paths:
    include:
      - eng/pipelines/aggregate-reports.yml

pool:
  name: azsdk-pool
  demands: ImageOverride -equals windows-2022

variables:
  - template: ./templates/variables/globals.yml

stages:
  - stage: ValidateDependencies
    displayName: Validate Dependencies

    jobs:
      - job: ValidateDependencies
        timeoutInMinutes: 120
        steps:
          - task: UsePythonVersion@0
            displayName: 'Use Python $(PythonVersion)'
            condition: succeededOrFailed()
            inputs:
              versionSpec: '$(PythonVersion)'

          - template: /eng/pipelines/templates/steps/use-venv.yml

          - template: /eng/pipelines/templates/steps/analyze_dependency.yml
            parameters:
              ScanPath: $(Build.SourcesDirectory)/sdk

          - task: AzureFileCopy@6
            displayName: 'Upload Dependency Report'
            condition: and(succeededOrFailed(), eq(variables['System.TeamProject'], 'internal'))
            inputs:
              sourcePath: '$(Build.ArtifactStagingDirectory)/reports/*'
              azureSubscription: 'Azure SDK Artifacts'
              destination: AzureBlob
              storage: azuresdkartifacts
              containerName: 'azure-sdk-for-python'
              blobPrefix: dependencies
              AdditionalArgumentsForBlobCopy: '--exclude-pattern=*data.js*'

          - task: AzureFileCopy@6
            displayName: 'Upload Dependency Graph'
            condition: and(succeededOrFailed(), eq(variables['System.TeamProject'], 'internal'))
            inputs:
              sourcePath: '$(Build.ArtifactStagingDirectory)/reports/*'
              azureSubscription: 'Azure SDK Artifacts'
              destination: AzureBlob
              storage: azuresdkartifacts
              containerName: 'azure-sdk-for-python'
              blobPrefix: dependencies/dependencyGraph
              AdditionalArgumentsForBlobCopy: '--include-pattern=*data.js*'

          - task: PowerShell@2
            displayName: "Verify Repository Resource Refs"
            inputs:
              pwsh: true
              workingDirectory: $(Build.SourcesDirectory)
              filePath: eng/common/scripts/Verify-Resource-Ref.ps1

          - task: UsePythonVersion@0
            displayName: 'Use Python 3.11'
            inputs:
              versionSpec: '3.11'

          - script: |
              python -m pip install -r scripts/repo_health_status_report/dev_requirements.txt
            displayName: 'Prep Environment'

          - task: PythonScript@0
            condition: succeededOrFailed()
            env:
              SYSTEM_ACCESSTOKEN: $(System.AccessToken)
              GH_TOKEN: $(azuresdk-github-pat)
            inputs:
              scriptPath: 'scripts/repo_health_status_report/output_health_report.py'
            displayName: 'Generate Health Status Report'

          - script: |
              python -m pip install -r scripts/repo_type_completeness/dev_requirements.txt
            displayName: 'Prep Environment'

          - task: PythonScript@0
            condition: succeededOrFailed()
            env:
              GH_TOKEN: $(azuresdk-github-pat)
            inputs:
              scriptPath: 'scripts/repo_type_completeness/generate_main_typescores.py'
            displayName: 'Update Type Completeness Scores'

          - template: ../common/pipelines/templates/steps/verify-links.yml
            parameters:
              Directory: ""
              CheckLinkGuidance: $true
              Condition: succeededOrFailed()

  - stage: ComplianceTools
    displayName: Compliance Tools
    dependsOn: []

    variables:
      Codeql.SkipTaskAutoInjection: false

    jobs:
      - job: ComplianceTools
        timeoutInMinutes: 120
        steps:
          - template: /eng/common/pipelines/templates/steps/policheck.yml
            parameters:
              PublishAnalysisLogs: false
              ExclusionDataBaseFileName: PythonPoliCheckExclusion

          - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
            displayName: 'Publish Security Analysis Logs'
            continueOnError: true
            condition: succeededOrFailed()
