azure-pipelines.yml

# SonarScanner for .NET
# Build, QA, Deploy

schedules:
  # Run from Monday to Friday at 2:0 UTC (https://docs.microsoft.com/en-us/azure/devops/pipelines/process/scheduled-triggers?view=azure-devops&tabs=yaml#cron-syntax)
  - cron: "0 2 * * 1-5"
    displayName: Nightly build
    branches:
      include:
        - master
        - branch-*
    always: true

trigger:
  - master
  - branch-*

pool: .net-bubble-aws-re-team-prod

variables:
  - group: sonarsource-build-variables
  - group: sonar-scanner-dotnet-variables
  - group: artifactory_access
  - group: digicert-keylocker
  # ARTIFACTORY_URL https://repox.jfrog.io/repox => https://repox.jfrog.io/artifactory
  # JFROG_URL https://repox.jfrog.io
  # https://github.com/SonarSource/parent-oss/blob/master/pom.xml#L708-L711
  - name: ARTIFACTORY_DEPLOY_USERNAME
    value: $[variables.ARTIFACTORY_QA_DEPLOYER_USERNAME]
  - name: ARTIFACTORY_QA_READER_USERNAME
    value: $[variables.ARTIFACTORY_PRIVATE_READER_USERNAME]
  # pipelines-yaml-templates/promote-stage.yml line 56
  - name: IS_RELEASE_BRANCH
    value: ${{ or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), startsWith(variables['Build.SourceBranch'], 'refs/heads/branch-')) }}
  - name: BUILD_CONFIGURATION
    value: "Release"
  - name: BUILD_PLATFORM
    value: "Any CPU"
  - name: SOLUTION
    value: "SonarScanner.MSBuild.sln"

stages:
  - stage: build
    displayName: 'Build:'
    jobs:
      - job: build
        displayName: 'Build and stage to repox'
        workspace:
          clean: all
        variables:
          MAVEN_CACHE_FOLDER: $(Pipeline.Workspace)/.m2/repository
          MAVEN_OPTS: '-Xmx3072m -Dmaven.repo.local=$(MAVEN_CACHE_FOLDER)'
          commonMavenArguments: -B -Pdeploy-sonarsource -Dmaven.test.skip=true
        steps:
          - checkout: self

          - task: Cache@2
            displayName: Cache Maven local repo
            inputs:
              key: maven | pom.xml
              path: $(MAVEN_CACHE_FOLDER)

          - task: DownloadSecureFile@1
            name: snk
            inputs:
              secureFile: 'SonarSourceSecret.snk'
            displayName: 'Download snk'
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')

          - task: DownloadSecureFile@1
            # This file is used by the "DigiCert Signing Manager KSP" Key Storage Provider to authenticate against the DigiCert private key provider server.
            name: SM_CLIENT_CERT
            displayName: Download p12 file
            inputs:
              secureFile: digicert_authentication_certificate.p12
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')

          - task: DownloadSecureFile@1
            # This file contains the signing certificate without the private key. The private key will be downloaded later, during the signing process.
            displayName: 'Download crt file'
            name: SM_CLIENT_CRT
            inputs:
              secureFile: cert_525594307.crt
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')

          # Initialize the DigiCert Private Key Provider.
          # What we think it does: The smctl tool authenticates with a client certificate (SM_CLIENT_CERT_FILE) and a client password (SM_CLIENT_CERT_PASSWORD).
          # It uses an API Key (SM_API_KEY) and the ID of the certificate (SM_CERT) to check if the authenticated client is authorized to use the
          # certificate specified and synchronize (potentially private) information about the certificate.
          - powershell: |
              Write-Output "smctl sync:"
              smctl windows certsync
            displayName: Synchronize certificates
            condition: eq(variables.IS_RELEASE_BRANCH, 'true')
            env:
              SM_CLIENT_CERT_FILE: $(SM_CLIENT_CERT.secureFilePath)
              SM_CLIENT_CERT_PASSWORD: $(SM_CLIENT_CERT_PASSWORD)
              SM_API_KEY: $(SM_API_KEY)
              SM_CERT: $(SM_CERT)

          - powershell: .\scripts\promote-project-version.ps1
            displayName: 'Promote project version'

          - task: VSBuild@1
            displayName: 'Set BranchName, Sha1 and BuildNumber properties from Azdo pipeline variables'
            inputs:
              solution: 'scripts\version\ChangeVersion.proj'
              msbuildArgs: '/p:Sha1=$(Build.SourceVersion) /p:BranchName=$(Build.SourceBranchName) /p:BuildNumber=$(Build.BuildId)  /p:BuildConfiguration=$(BUILD_CONFIGURATION)'

          - task: DotNetCoreCLI@2
            displayName: Dotnet restore $(SOLUTION)
            env:
              ARTIFACTORY_USER: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)
            inputs:
              command: 'restore'
              projects: '$(SOLUTION)'
              feedsToUse: 'config'
              restoreArguments: --locked-mode
              nugetConfigPath: 'NuGet.Config'
              verbosityRestore: 'normal'  # Default is noisy 'Detailed'

          - task: DotNetCoreCLI@2
            displayName: Dotnet generate SBOM
            # https://sonarsource.atlassian.net/browse/BUILD-1303
            inputs:
              command: custom
              custom: CycloneDX
              projects: '$(SOLUTION)'
              arguments: '-t --json -o build'

          - task: DotNetCoreCLI@2
            env:
              SignAssembly: $(IS_RELEASE_BRANCH)
            condition: and(succeeded(), eq(variables.IS_RELEASE_BRANCH, 'true'))
            displayName: 'Build and prepare signing $(SOLUTION)'
            inputs:
              command: 'build'
              projects: '$(SOLUTION)'
              arguments: '/m /p:DeployExtension=false /p:ZipPackageCompressionLevel=normal /p:configuration=$(BUILD_CONFIGURATION) /p:platform="$(BUILD_PLATFORM)" /p:AssemblyOriginatorKeyFile="$(snk.secureFilePath)"'

          - task: DotNetCoreCLI@2
            condition: and(succeeded(), eq(variables.IS_RELEASE_BRANCH, 'false')) # This should run only on PRs (master and other release branches need signing)
            displayName: 'Build $(SOLUTION)'
            inputs:
              command: 'build'
              projects: '$(SOLUTION)'
              arguments: '/m /p:DeployExtension=false /p:ZipPackageCompressionLevel=normal /p:configuration=$(BUILD_CONFIGURATION) /p:platform="$(BUILD_PLATFORM)"'

          - task: PowerShell@2
            displayName: 'Sign and package scanner files'
            env:
              SM_CLIENT_CRT_FILE: $(SM_CLIENT_CRT.secureFilePath)
              SM_CLIENT_CERT_FILE: $(SM_CLIENT_CERT.secureFilePath)
              SM_CLIENT_CERT_PASSWORD: $(SM_CLIENT_CERT_PASSWORD)
              SM_API_KEY: $(SM_API_KEY)
              SM_CERT: $(SM_CERT)
            inputs:
              targetType: 'inline'
              script: |
                . (Join-Path "scripts" "package-artifacts.ps1")
                . (Join-Path "scripts" "variables.ps1")

                Download-ScannerCli

                $signAssemblies = [System.Convert]::ToBoolean("$(IS_RELEASE_BRANCH)") # the variable is a string, we need a boolean
                Package-NetFrameworkScanner -SignAssemblies $signAssemblies
                Package-NetScanner -SignAssemblies $signAssemblies

          - script: nuget pack nuspec\netcoreglobaltool\dotnet-sonarscanner.nuspec -OutputDirectory build
            displayName: 'Package dotnet global tool'

          - task: PowerShell@2
            displayName: "Sign NuGet packages"
            condition: and(succeeded(), eq(variables.IS_RELEASE_BRANCH, 'true'))
            env:
              PACKAGES_PATH: '$(Build.SourcesDirectory)\build\dotnet-sonarscanner*.nupkg'
              SM_CLIENT_CERT_FILE: $(SM_CLIENT_CERT.secureFilePath)
              SM_CLIENT_CERT_PASSWORD: $(SM_CLIENT_CERT_PASSWORD)
              SM_API_KEY: $(SM_API_KEY)
              SM_CERT: $(SM_CERT)
            inputs:
              targetType: 'inline'
              script: nuget sign "$env:PACKAGES_PATH" -Overwrite -HashAlgorithm SHA256 -CertificateFingerprint $(SM_CERT_FP) -Timestamper http://timestamp.digicert.com -TimestampHashAlgorithm SHA256

          - powershell: |
              Add-Content build/version.txt $(SONAR_PROJECT_VERSION)
            displayName: 'Write project version in file'

          - task: DownloadSecureFile@1
            displayName: 'Download Maven settings'
            name: mavenSettings
            inputs:
              secureFile: 'maven-settings.xml'

          - powershell: |
              Install-Module -Name Pester -Force -SkipPublisherCheck # https://pester.dev/docs/introduction/installation#windows
              Invoke-Pester -Output Detailed -CI -Script .\scripts\generate-packages.tests.ps1
            displayName: 'Test package generation script'

          - powershell: |
              . .\scripts\generate-packages.ps1
              Run
            displayName: 'Generate packages'

          - task: Maven@4
            displayName: Promote new version in pom
            env:
              ARTIFACTORY_PRIVATE_READER_USERNAME: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PRIVATE_READER_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)
              ARTIFACTORY_DEPLOY_PASSWORD: $(ARTIFACTORY_QA_DEPLOYER_ACCESS_TOKEN)
            inputs:
              mavenPomFile: 'pom.xml'
              goals: 'org.codehaus.mojo:versions-maven-plugin:2.2:set'
              options: >-
                $(commonMavenArguments)
                -DnewVersion=$(SONAR_PROJECT_VERSION).$(Build.BuildId)
                --settings $(mavenSettings.secureFilePath)
                -Denable-repo=private
                -DgenerateBackupPoms=false -e
              javaHomeOption: 'JDKVersion'
              mavenVersionOption: 'Default'
              jdkVersionOption: '1.21'
              mavenOptions: $(MAVEN_OPTS)

          - task: DownloadSecureFile@1
            displayName: 'Download the sign key'
            name: signKey
            inputs:
              secureFile: 'sign-key.asc'

          - task: Maven@4
            displayName: 'Stage to repox'
            env:
              ARTIFACTORY_PRIVATE_READER_USERNAME: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PRIVATE_READER_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)
              PROJECT_VERSION: $(SONAR_PROJECT_VERSION)
              BUILD_ID: $(Build.BuildId)
              ARTIFACTORY_DEPLOY_PASSWORD: $(ARTIFACTORY_QA_DEPLOYER_ACCESS_TOKEN)
              PGP_SIGN_KEY_PATH: $(signKey.secureFilePath)
              PGP_PASSPHRASE: $(PGP_PASSPHRASE)
            inputs:
              goals: 'deploy'
              options: >-
                $(commonMavenArguments)
                --settings $(mavenSettings.secureFilePath)
                -Denable-repo=private
                -Pdeploy-sonarsource,sign -e -V
              publishJUnitResults: false
              javaHomeOption: 'JDKVersion'
              jdkVersionOption: '1.21'
              mavenOptions: $(MAVEN_OPTS)

          - powershell: |
              $artifactsFolder = "$env:BUILD_SOURCESDIRECTORY\\build"
              Rename-Item -Path "$artifactsFolder\\sonarscanner-net-framework.zip" -NewName sonar-scanner-$(SONAR_PROJECT_VERSION).$(Build.BuildId)-net-framework.zip
              Rename-Item -Path "$artifactsFolder\\sonarscanner-net.zip" -NewName sonar-scanner-$(SONAR_PROJECT_VERSION).$(Build.BuildId)-net.zip
            displayName: "Rename artifacts for GitHub Release"

          - task: PublishPipelineArtifact@1
            displayName: 'Publish packages as artifacts'
            inputs:
              targetPath: 'build'
              artifact: 'build'

          - task: CmdLine@2
            displayName: Revert changes made to pom.xml to not break cache feature
            inputs:
              script: 'git checkout .'

  - stage: qa_windows
    displayName: 'QA - Windows:'
    dependsOn: build
    jobs:
      - job: uts_analysis
        displayName: 'Run UTs, SC analysis'
        workspace:
          clean: all
        steps:
          - task: DownloadPipelineArtifact@2
            inputs:
              buildType: 'current'
              targetPath: '$(Build.SourcesDirectory)/build'
              artifactName: build

          - powershell: |
              $projectVersion = Get-Content "$(Build.SourcesDirectory)/build/version.txt"
              Write-Host "##vso[task.setvariable variable=SONAR_PROJECT_VERSION]$projectVersion"
            displayName: 'Set SONAR_PROJECT_VERSION variable for this job'

          - task: PowerShell@2
            displayName: "NuGet Restore"
            env:
              ARTIFACTORY_USER: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)
            inputs:
              targetType: 'inline'
              script: nuget restore -LockedMode -ConfigFile "NuGet.Config" $(SOLUTION)

          - task: SonarCloudPrepare@3
            displayName: 'Code Analysis - Begin'
            inputs:
              SonarCloud: 'SonarCloud'
              organization: 'sonarsource'
              projectKey: 'sonarscanner-msbuild'
              projectName: 'SonarScanner for .NET'
              projectVersion: '$(SONAR_PROJECT_VERSION)'
              scannerMode: 'dotnet'
              extraProperties: |
                sonar.cs.opencover.reportsPaths="$(Build.SourcesDirectory)/Coverage/**.xml"
                sonar.cs.vstest.reportsPaths="$(Build.SourcesDirectory)/TestResults/*.trx"

          - task: VSBuild@1
            displayName: "Build and analyze project"
            inputs:
              solution: '$(SOLUTION)'
              platform: '$(BUILD_PLATFORM)'
              configuration: '$(BUILD_CONFIGURATION)'
              msbuildArgs: '/p:RunAnalyzers=true /p:RunAnalyzersDuringBuild=true'

          - powershell: .\scripts\run-unit-tests.ps1 -SourcesDirectory "$(Build.SourcesDirectory)" -BuildConfiguration "$(BUILD_CONFIGURATION)"
            displayName: 'Run UTs and compute coverage'
            env:
              ARTIFACTORY_USER: $(ARTIFACTORY_PRIVATE_READER_USERNAME)
              ARTIFACTORY_PASSWORD: $(ARTIFACTORY_PRIVATE_READER_ACCESS_TOKEN)

          - task: PublishTestResults@2
            condition: succeededOrFailed()
            inputs:
              testRunner: VSTest
              testResultsFiles: $(Build.SourcesDirectory)/TestResults/*.trx # Not **/*.trx because there are invalid trx files from test resources in subdirectories
              testRunTitle: UTs Windows

          - task: PublishBuildArtifacts@1
            inputs:
              pathToPublish: $(Build.SourcesDirectory)\coverage\
              artifactName: CoverageReport

          - task: PowerShell@2
            displayName: 'Delete files created by unit tests'
            inputs:
              targetType: 'inline'
              script: |
                Get-ChildItem $(Agent.TempDirectory) -Filter 'dummy.*' -Recurse -Attributes !Directory | Remove-Item

          - task: SonarCloudAnalyze@3
            displayName: 'Code Analysis - End'

          - task: SonarCloudPublish@3
            displayName: 'Code Analysis - Publish QG'
            inputs:
              pollingTimeoutSec: '300'

      - template: templates/its-jobs.yml
        parameters:
          matrix:
            LTA-89:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[8.9]"
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              CFAMILY_VERSION: "6.20.5.49286"   # Bundled version with SQ 8.9
              CSS_VERSION: "1.4.2.2002"         # Bundled version with SQ 8.9
              DOTNET_VERSION: "8.22.0.31243"    # Bundled version with SQ 8.9
              GO_VERSION: "1.8.3.2219"          # Bundled version with SQ 8.9
              GO_GROUP_ID: "org.sonarsource.slang"
              IAC_VERSION: "NONE"               # No release brefore SQ 9.9, the plug-in should not be loaded
              IAC_ENTERPRISE_VERSION: "NONE"    # Not present until LTA-2025
              JAVA_VERSION: "NONE"              # Not required in our ITs for SQ 8.9
              JAVASCRIPT_VERSION: "7.4.4.15624" # Bundled version with SQ 8.9
              PHP_VERSION: "3.17.0.7439"        # Bundled version with SQ 8.9
              PLSQL_VERSION: "3.6.1.3873"       # Bundled version with SQ 8.9
              PYTHON_VERSION: "3.4.1.8066"      # Bundled version with SQ 8.9
              TEXT_VERSION: "NONE"              # Not release brefore SQ 9.9, the plug-in should not be loaded
              XML_VERSION: "2.2.0.2973"         # Bundled version with SQ 8.9
            LTA-99:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[9.9]"
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              CFAMILY_VERSION: "6.41.0.60884"    # Bundled version with SQ 9.9
              CSS_VERSION: "NONE"                # No official release in SQ 9.9, the plug-in should not be loaded. Rules are in the JS plugin
              DOTNET_VERSION: "8.51.0.59060"     # Bundled version with SQ 9.9
              GO_VERSION: "1.11.0.3905"          # Bundled version with SQ 9.9
              GO_GROUP_ID: "org.sonarsource.slang"
              IAC_VERSION: "1.11.0.2847"         # Bundled version with SQ 9.9
              IAC_ENTERPRISE_VERSION: "NONE"     # Not present until LTA-2025
              JAVA_VERSION: "NONE"               # Not required in our ITs for SQ 9.9
              JAVASCRIPT_VERSION: "9.13.0.20537" # Bundled version with SQ 9.9
              PHP_VERSION: "3.27.1.9352"         # Bundled version with SQ 9.9
              PLSQL_VERSION: "3.8.0.4948"        # Bundled version with SQ 9.9
              PYTHON_VERSION: "3.24.0.10784"     # Bundled version with SQ 9.9
              TEXT_VERSION: "NONE"               # Not required in our ITs for SQ 9.9
              XML_VERSION: "2.7.0.3820"          # Bundled version with SQ 9.9
            LTA-2025-1:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[2025.1]"
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              CFAMILY_VERSION: "6.62.0.78645"         # Bundled version with SQ 2025.1
              CSS_VERSION: "NONE"                     # No official release in SQ 2025.1, the plug-in should not be loaded. Rules are in the JS plugin
              DOTNET_VERSION: "10.4.0.108396"         # Bundled version with SQ 2025.1
              GO_VERSION: "1.18.0.240"                # Bundled version with SQ 2025.1
              GO_GROUP_ID: "org.sonarsource.slang"
              IAC_VERSION: "1.41.0.14206"             # Bundled version with SQ 2025.1
              IAC_ENTERPRISE_VERSION: "1.41.0.14206"  # Bundled version with SQ 2025.1
              JAVA_VERSION: "8.9.0.37768"             # Bundled version with SQ 2025.1, required by sonar-text to analyse .properties files
              JAVASCRIPT_VERSION: "10.20.0.29356"     # Bundled version with SQ 2025.1
              PHP_VERSION: "3.42.0.12795"             # Bundled version with SQ 2025.1
              PLSQL_VERSION: "3.15.0.7123"            # Bundled version with SQ 2025.1
              PYTHON_VERSION: "4.26.0.19456"          # Bundled version with SQ 2025.1
              TEXT_VERSION: "2.20.0.5038"             # Bundled version with SQ 2025.1
              XML_VERSION: "2.12.0.5749"              # Bundled version with SQ 2025.1
            LTA-2025-4:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[2025.4]"
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              JDKVERSION: "1.21"
              CFAMILY_VERSION: "6.70.1.93088"         # Bundled version with SQ 2025.4
              CSS_VERSION: "NONE"                     # No official release in SQ 2025.4, the plug-in should not be loaded. Rules are in the JS plugin
              DOTNET_VERSION: "10.21.0.135332"        # Minimum version supporting new telemetry convention (bundled was 10.15.0)
              GO_VERSION: "1.26.0.3421"               # Bundled version with SQ 2025.4
              GO_GROUP_ID: "org.sonarsource.go"
              IAC_VERSION: "1.48.1.18410"             # Bundled version with SQ 2025.4
              IAC_ENTERPRISE_VERSION: "1.48.1.18410"  # Bundled version with SQ 2025.4
              JAVA_VERSION: "8.18.0.40025"            # Bundled version with SQ 2025.4, required by sonar-text to analyse .properties files
              JAVASCRIPT_VERSION: "10.26.0.35551"     # Bundled version with SQ 2025.4
              PHP_VERSION: "3.46.1.15272"             # Bundled version with SQ 2025.4
              PLSQL_VERSION: "3.17.1.7623"            # Bundled version with SQ 2025.4
              PYTHON_VERSION: "5.7.1.26730"           # Bundled version with SQ 2025.4
              TEXT_VERSION: "2.26.1.9976"             # Bundled version with SQ 2025.4
              XML_VERSION: "2.13.1.6351"              # Bundled version with SQ 2025.4
            LTA-2026-1:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE[2026.1]"
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              JDKVERSION: "1.21"
              CFAMILY_VERSION: "6.77.0.95488"         # Bundled version with SQ 2026.1
              CSS_VERSION: "NONE"                     # No official release in SQ 2026.1, the plug-in should not be loaded. Rules are in the JS plugin
              DOTNET_VERSION: "10.21.0.135332"        # Minimum version supporting new telemetry convention (bundled was 10.18.0)
              GO_VERSION: "1.31.0.4938"               # Bundled version with SQ 2026.1
              GO_GROUP_ID: "org.sonarsource.go"
              IAC_VERSION: "NONE"                     # Enterprise plugin is a superset; installing both causes conflicts for githubactions
              IAC_ENTERPRISE_VERSION: "2.6.1.19203"   # Minimum version supporting githubactions rules (bundled was 2.5.0)
              JAVA_VERSION: "8.22.0.41895"            # Bundled version with SQ 2026.1, required by sonar-text to analyse .properties files
              JAVASCRIPT_VERSION: "12.1.0.39434"      # Forward version: 12.1.0 no longer raises typescript:S7785 on Angular's main.ts (bundled was 11.8.0.37897)
              PHP_VERSION: "3.54.0.15452"             # Bundled version with SQ 2026.1
              PLSQL_VERSION: "3.18.1.230"             # Bundled version with SQ 2026.1
              PYTHON_VERSION: "5.14.2.29072"          # Bundled version with SQ 2026.1
              TEXT_VERSION: "2.38.0.10279"            # Bundled version with SQ 2026.1
              XML_VERSION: "2.15.0.7513"              # Bundled version with SQ 2026.1
            LATEST_RELEASE:
              PRODUCT: "SonarQube"
              SQ_VERSION: "LATEST_RELEASE"
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              JDKVERSION: "1.21"
            DEV_MsBuild15:
              PRODUCT: "SonarQube"
              SQ_VERSION: "DEV"
              MSBUILD_PATH: $(MSBUILD_15_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              JDKVERSION: "1.21"
            DEV_MsBuild16:
              PRODUCT: "SonarQube"
              SQ_VERSION: "DEV"
              MSBUILD_PATH: $(MSBUILD_16_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              JDKVERSION: "1.21"
            DEV_MsBuild17:
              PRODUCT: "SonarQube"
              SQ_VERSION: "DEV"
              MSBUILD_PATH: $(MSBUILD_17_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              JDKVERSION: "1.21"
            DEV_MsBuild18:
              PRODUCT: "SonarQube"
              SQ_VERSION: "DEV"
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              JDKVERSION: "1.21"
            DEV_Community:
              PRODUCT: "SonarQube"
              SQ_VERSION: "DEV"
              SQ_EDITION: "COMMUNITY"
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarqube/*"
              CFAMILY_VERSION: "NONE"         # Commercial plugin
              GO_VERSION: "NONE"              # Commercial plugin
              IAC_ENTERPRISE_VERSION: "NONE"  # Commercial plugin
              PLSQL_VERSION: "NONE"           # Commercial plugin
              JDKVERSION: "1.21"
            Cloud:
              PRODUCT: "SonarCloud"
              SQ_VERSION: ""
              MSBUILD_PATH: $(MSBUILD_18_PATH)
              TEST_INCLUDE: "**/sonarcloud/*"
            Others:
              PRODUCT: "others"
              SQ_VERSION: ""
              MSBUILD_PATH: ""
              TEST_INCLUDE: "**/others/*"

  # TODO: SCAN4NET-1004 re-enable when MacOS and Linux agents have .net 10 installed

  # - template: templates/unix-qa-stage.yml
  #   parameters:
  #     vmImage: "ubuntu-22.04"
  #     name: "Linux"

  # - template: templates/unix-qa-stage.yml
  #   parameters:
  #     vmImage: "macOS-14"
  #     name: "MacOS"

  - stage: artifacts
    displayName: 'Promote Artifacts:'
    dependsOn:
    - build
    - qa_windows
  #  - qa_linux
  #  - qa_macos
    condition: and(succeeded(), or(eq(variables['Build.Reason'], 'PullRequest'), in(variables['Build.SourceBranchName'], 'main', 'master'), startsWith(replace(variables['Build.SourceBranch'], 'refs/heads/', ''), 'branch')))
    jobs:
    - job: promoteRepox
      displayName: Call repox
      workspace:
        clean: all
      steps:
      - checkout: none
      - task: JFrogBuildPromotion@1
        name: promoteRepoxCLI
        displayName: Promote build in Repox
        inputs:
          artifactoryConnection: repox_promoter_token
          buildName: sonar-scanner-msbuild
          buildNumber: $(Build.BuildId)
          ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
            targetRepo: 'sonarsource-public-dev'
            status: 'it-passed-pr'
          ${{ else }}:
            targetRepo: 'sonarsource-public-builds'
            status: 'it-passed'