Azure OneBranch Pipelines
Relevant source files
The following files were used as context for generating this wiki page:
Azure OneBranch Pipelines represent the standardized CI/CD infrastructure used within the PowerShell project to ensure secure, compliant, and cross-platform builds. These pipelines integrate Microsoft's OneBranch security and compliance requirements with the build and packaging processes for PowerShell across Windows and Linux platforms.
The system utilizes specialized YAML syntax for conditional execution, standardized restore patterns for build artifacts, and rigorous signing configurations to ensure that only authenticated MSIs and packages are distributed to users.
Sources: README.md, .github/instructions/onebranch-signing-configuration.instructions.md
Pipeline Conditional Logic
OneBranch pipelines utilize a specific syntax for conditions that differs from standard GitHub Actions or Azure DevOps expressions. This ensures that build steps only execute when specific criteria are met, such as branch targeting or build triggers.
Condition Syntax
The syntax follows a functional style where operators precede their arguments. Standard build variables like Build.SourceBranch and Build.Reason are used to determine execution flow.
The diagram above illustrates the logical flow of OneBranch condition evaluation based on defined operators.
Sources: .github/instructions/onebranch-condition-syntax.instructions.md:1-15
| Operator | Usage Example | Description |
|---|---|---|
and | and(cond1, cond2) | Logical AND of multiple conditions. |
or | or(cond1, cond2) | Logical OR of multiple conditions. |
eq | eq(variables['Build.Reason'], 'Manual') | Checks for equality. |
startsWith | startsWith(variables['Build.SourceBranch'], 'refs/heads/release/') | Checks if a string begins with a specific prefix. |
| Sources: .github/instructions/onebranch-condition-syntax.instructions.md:5-20 |
Signing and Security Configuration
Security is a primary pillar of the OneBranch architecture. The pipelines enforce strict signing configurations for all build outputs, particularly for Microsoft Installer (MSI) files.
Signing Requirements
Official PowerShell builds must be digitally signed by Microsoft Corporation. Local builds or unsigned MSIs are rejected by validation tools to ensure the integrity of the release.
This sequence demonstrates the mandatory signing and verification loop for PowerShell artifacts.
Sources: .github/instructions/onebranch-signing-configuration.instructions.md:1-12, tools/AttackSurfaceAnalyzer/README.md:25-35
Configuration Elements
The signing process is defined through YAML parameters that specify the certificate type and the files to be included.
Sources: .github/instructions/onebranch-signing-configuration.instructions.md:5-10
Restore Phase Patterns
To maintain build reproducibility and speed, OneBranch pipelines utilize a standardized "Restore Phase" pattern. This pattern ensures that all dependencies and previous build artifacts are correctly mapped into the current build environment.
Artifact Mapping
The restore process typically involves retrieving artifacts from a "Build" phase and mapping them to a "Pack" or "Test" phase.
This diagram shows how build artifacts flow through the restore pattern into the final packaging phase.
Sources: .github/instructions/onebranch-restore-phase-pattern.instructions.md:1-10
Package Validation
Azure OneBranch pipelines integrate automated testing to validate the naming and structure of generated packages across different Linux distributions.
Linux Artifact Validation
The pipeline executes tests to ensure that RPM, DEB, and Tar.Gz packages follow strict versioning and architecture naming conventions. These tests verify artifacts located in directories defined by environment variables such as SYSTEM_ARTIFACTSDIRECTORY.
Sources: test/packaging/linux/package-validation.tests.ps1:5-15
| Package Type | Regex Validation Logic | Expected Architecture |
|---|---|---|
| RPM | powershell-(preview|lts-)?\d+\.\d+\.\d+... | x86_64, aarch64 |
| DEB | ^powershell(-preview|-lts)?_\d+\.\d+\.\d+... | amd64, arm64 |
| Tar.Gz | powershell-(lts-)?\d+\.\d+\.\d+... | x64, arm32, arm64 |
| Sources: test/packaging/linux/package-validation.tests.ps1:28-85 |
Conclusion
Azure OneBranch Pipelines provide the backbone for PowerShell's release engineering. By enforcing standardized condition syntax, mandatory Microsoft signing, and rigorous artifact restore patterns, the project maintains a secure and reliable delivery pipeline for cross-platform automation tools.