Support template fake-compile in hosted security validation

.github/workflows/test.yml

@@ -2,50 +2,50 @@ name: Run Tests
 
 on:
   push:
-    branches: [ main, develop ]
+    branches: [main]
   pull_request:
-    branches: [ main, develop ]
+    branches: [main]
 
 jobs:
   test:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v4
-    
-    - name: Set up PowerShell
-      shell: pwsh
-      run: |
-        Write-Host "PowerShell version: $($PSVersionTable.PSVersion)"
-    
-    - name: Install NuGet provider
-      shell: pwsh
-      run: |
-        if (-not (Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue)) {
-          Write-Host "Installing NuGet provider..."
-          Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null
-        }
-    
-    - name: Trust PSGallery
-      shell: pwsh
-      run: |
-        $psGallery = Get-PSRepository -Name 'PSGallery' -ErrorAction SilentlyContinue
-        if ($psGallery -and $psGallery.InstallationPolicy -ne 'Trusted') {
-          Write-Host "Trusting PSGallery..."
-          Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted
-        }
-    
-    - name: Install Pester
-      shell: pwsh
-      run: |
-        if (-not (Get-Module -ListAvailable -Name Pester)) {
-          Write-Host "Installing Pester module..."
-          Install-Module Pester -Scope CurrentUser -Force -AllowClobber -SkipPublisherCheck | Out-Null
-        }
-    
-    - name: Run tests
-      shell: pwsh
-      run: |
-        cd ${{ github.workspace }}
-        & .\scripts\Tests\Run-Tests.ps1 -Quick
-      continue-on-error: false
+      - uses: actions/checkout@v4
+
+      - name: Set up PowerShell
+        shell: pwsh
+        run: |
+          Write-Host "PowerShell version: $($PSVersionTable.PSVersion)"
+
+      - name: Install NuGet provider
+        shell: pwsh
+        run: |
+          if (-not (Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue)) {
+            Write-Host "Installing NuGet provider..."
+            Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null
+          }
+
+      - name: Trust PSGallery
+        shell: pwsh
+        run: |
+          $psGallery = Get-PSRepository -Name 'PSGallery' -ErrorAction SilentlyContinue
+          if ($psGallery -and $psGallery.InstallationPolicy -ne 'Trusted') {
+            Write-Host "Trusting PSGallery..."
+            Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted
+          }
+
+      - name: Install Pester
+        shell: pwsh
+        run: |
+          if (-not (Get-Module -ListAvailable -Name Pester)) {
+            Write-Host "Installing Pester module..."
+            Install-Module Pester -Scope CurrentUser -Force -AllowClobber -SkipPublisherCheck | Out-Null
+          }
+
+      - name: Run tests
+        shell: pwsh
+        run: |
+          cd ${{ github.workspace }}
+          & .\scripts\Tests\Run-Tests.ps1 -Quick
+        continue-on-error: false

.gitignore

@@ -49,6 +49,9 @@ bld/
 
 # Build results on 'Bin' directories
 **/[Bb]in/*
+# Local UE customization runtime output
+pmllib/
+shims/generated/
 # Uncomment if you have tasks that rely on *.refresh files to move binaries
 # (https://github.com/github/gitignore/pull/3736)
 #!**/[Bb]in/*.refresh

README.md

@@ -49,6 +49,7 @@ The UE Customization Manager agent:
 - **Explains workflows** - Helps you understand the proper sequence of operations
 - **Validates operations** - Warns about destructive operations and validates parameters
 - **Troubleshoots issues** - Provides context-aware assistance based on README documentation
+- **Explains hosted validation** - Understands the fake-compile, shim, and hosted security-validation path used in CI
 - **Launches UE** - Can start AVEVA Unified Engineering when requested
 - **Manages the lifecycle** - From initial setup through add-in creation to final cleanup
 
@@ -111,6 +112,12 @@ You can interact with the agent using natural language in the GitHub Copilot cha
 @ue-customization-manager The script says the environment doesn't exist
 
 @ue-customization-manager What files will be deleted if I run Clear?
+
+@ue-customization-manager Why did hosted security validation fail?
+
+@ue-customization-manager How does fake compile work for templates and Examples?
+
+@ue-customization-manager Why did a local pmllib folder appear after building a PML template?
 ```
 
 ### Benefits of Using the Agent

azure-pipelines.yml

@@ -0,0 +1,194 @@
+# Hybrid validation pipeline for the GitHub-hosted UE customization repo.
+#
+# This pipeline is intended to be connected to GitHub through the Azure Pipelines GitHub App
+# so its checks surface back into GitHub pull requests targeting main.
+#
+# The hosted test stage can run immediately on the Dabacon Products stateful hosted pools.
+# The security stage remains opt-in, but now uses the hosted-compatible fake-compile flow
+# on the Dabacon Products stateful hosted Ubuntu pool instead of generic vmImage selection.
+# Templates is consumed from Dabacon Products/Templates.
+# The Dabacon Products project still needs:
+# - a self-hosted Windows pool with UE installed and MSBuild available
+# - service connections named `Coverity on Polaris` and `BlackDuckScanner`
+
+resources:
+  repositories:
+    - repository: Templates
+      type: git
+      name: Dabacon Products/Templates
+      ref: refs/heads/feature/uecf-security-template-offload
+    - repository: antiMalwareTemplate
+      type: git
+      name: Architecture/Architecture
+      ref: refs/heads/antiMalwareVersions/latest
+
+variables:
+  - template: variables.yml@Templates
+  - name: CoverityProjectTeam
+    value: .RnD.Polaris.Dabacon-Products.SecurityAdvisors
+  - name: BlackDuckProjectName
+    value: AVEVA.UnifiedEngineeringCustomizationFramework
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - main
+
+pr:
+  autoCancel: true
+  branches:
+    include:
+      - main
+
+stages:
+  - stage: Initialise
+    displayName: Initialise
+    jobs:
+      - template: jobs/publish-source.yml@Templates
+        parameters:
+          SourceFetchDepth: 1
+
+      - template: jobs/publish-templates.yml@Templates
+
+
+  - stage: BuildWithShims
+    displayName: Build With Shims
+    dependsOn: Initialise
+    jobs:
+      - job: BuildWithShims
+        displayName: Build With Shims
+        timeoutInMinutes: 120
+        pool:
+          name: Dabacon-Products-Microsoft-Hosted-Ubuntu
+          demands:
+            - ImageOverride -equals ubuntu-latest
+            - WorkFolder -equals /mnt/storage/sdc/storage
+        container: mcr.microsoft.com/dotnet/sdk:9.0
+        workspace:
+          clean: all
+        steps:
+          - template: steps/retrieve-source.yml@Templates
+            parameters:
+              IsIPR: false
+              ArtifactName: Source
+              DownloadPath: $(Pipeline.Workspace)/Source
+
+          - download: current
+            artifact: Templates
+            displayName: Download Templates artifact
+            patterns: "**"
+
+          - task: UseDotNet@2
+            displayName: Ensure .NET 9 SDK for shim build
+            retryCountOnTaskFailure: 3
+            inputs:
+              packageType: sdk
+              version: 9.0.x
+
+          - template: shims/shim-projects.yml
+            parameters:
+              OutputPath: $(Pipeline.Workspace)/Source/.tmp/generated-shim-manifest.json
+
+          - template: shims/compile-with-shims.yml
+            parameters:
+              Directory: templates,Examples
+              Configuration: Release
+              ShimManifestPath: $(Pipeline.Workspace)/Source/.tmp/generated-shim-manifest.json
+              GeneratedRunnerPath: $(Pipeline.Workspace)/Source/.tmp/generated-fake-ue-compile.ps1
+              GeneratedShimProjectsPath: $(Pipeline.Workspace)/Source/.tmp/generated-shims
+              GeneratedShimSourcesPath: $(Pipeline.Workspace)/Source/.tmp/generated-shim-sources
+              GeneratedShimPropsPath: $(Pipeline.Workspace)/Source/.tmp/generated-shim-props/Directory.Build.props
+              ShimOutputPath: $(Pipeline.Workspace)/Source/shims/artifacts/Release
+
+          - publish: $(Pipeline.Workspace)/Source/shims/artifacts/Release
+            artifact: Build.Release
+            displayName: Publish build artifact for component template comparison
+
+  - stage: HostedTests
+    displayName: Hosted Tests
+    dependsOn: Initialise
+    jobs:
+      - job: Pester
+        displayName: Pester
+        pool:
+          name: Dabacon-Products-Microsoft-Hosted-Ubuntu
+          demands:
+            - ImageOverride -equals ubuntu-latest
+            - WorkFolder -equals /mnt/storage/sdc/storage
+        container: mcr.microsoft.com/dotnet/sdk:9.0
+        workspace:
+          clean: all
+        steps:
+          - template: steps/retrieve-source.yml@Templates
+            parameters:
+              IsIPR: false
+              ArtifactName: Source
+              DownloadPath: $(Pipeline.Workspace)/Source
+
+          - pwsh: |
+              Write-Host "PowerShell version: $($PSVersionTable.PSVersion)"
+            displayName: Show PowerShell version
+
+          - pwsh: |
+              if (-not (Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue)) {
+                Write-Host "Installing NuGet provider..."
+                Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null
+              }
+            displayName: Install NuGet provider
+
+          - pwsh: |
+              $psGallery = Get-PSRepository -Name 'PSGallery' -ErrorAction SilentlyContinue
+              if ($psGallery -and $psGallery.InstallationPolicy -ne 'Trusted') {
+                Write-Host "Trusting PSGallery..."
+                Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted
+              }
+            displayName: Trust PSGallery
+
+          - pwsh: |
+              if (-not (Get-Module -ListAvailable -Name Pester)) {
+                Write-Host "Installing Pester module..."
+                Install-Module Pester -Scope CurrentUser -Force -AllowClobber -SkipPublisherCheck | Out-Null
+              }
+            displayName: Install Pester
+
+          - pwsh: |
+              ./scripts/Tests/Run-Tests.ps1 -Quick
+            displayName: Run tests
+            workingDirectory: $(Pipeline.Workspace)/Source
+
+  - template: uecf/component-coverity-stage.yml@Templates
+    parameters:
+      CoverityTeamName: $(CoverityProjectTeam)
+      ProjectName: $(BlackDuckProjectName)
+
+  - stage: AntiMalware
+    displayName: AntiMalware
+    dependsOn:
+      - Initialise
+      - BuildWithShims
+    jobs:
+      - template: jobs/antimalware.yml@Templates
+        parameters:
+          JobName: AntiMalwareScan
+
+  - stage: CodeAnalysisLogs
+    displayName: CodeAnalysisLogs
+    dependsOn: AntiMalware
+    jobs:
+      - template: jobs/publish-CodeAnalysisLogs.yml@Templates
+        parameters:
+          Analysers:
+             []
+
+  - stage: BlackDuck
+    displayName: BlackDuck
+    dependsOn: BuildWithShims
+    jobs:
+      - template: component-blackduck.yml@Templates
+        parameters:
+          BuildArtifact: Build.Release
+          BlackDuckGroup: DabaconGroup
+          IsIPR: false
+          ProjectName: $(BlackDuckProjectName)
+          PackageVersion: $(Build.SourceBranchName)-$(Build.BuildId)

scripts/Build-AddIns.ps1

@@ -1,7 +1,9 @@
 param(
     [Parameter(Mandatory = $false)]
     [string]$Directory = "source",
-    [string]$Configuration = "Debug"
+    [string]$Configuration = "Debug",
+    [switch]$SkipPostBuildEvent,
+    [switch]$Rebuild
 )
 
 $ErrorActionPreference = "Stop"
@@ -33,7 +35,33 @@ if (-not $projects) {
 $failed = @()
 foreach ($proj in $projects) {
     Write-Host "--- Building $($proj.FullName) ---" -ForegroundColor Cyan
-    dotnet build $proj.FullName -c $Configuration -clp:Summary -nologo
+    $buildArgs = @(
+        'build'
+        $proj.FullName
+        '-c'
+        $Configuration
+        '-clp:Summary'
+        '-nologo'
+    )
+
+    if ($env:FrameworkPathOverride) {
+        $buildArgs += "-p:FrameworkPathOverride=$($env:FrameworkPathOverride)"
+    }
+
+    if ($env:TargetFrameworkRootPath) {
+        $buildArgs += "-p:TargetFrameworkRootPath=$($env:TargetFrameworkRootPath)"
+    }
+
+    if ($Rebuild) {
+        $buildArgs += '-t:Rebuild'
+    }
+
+    if ($SkipPostBuildEvent) {
+        $buildArgs += '-p:RunPostBuildEvent=Never'
+        $buildArgs += '-p:PostBuildEvent='
+    }
+
+    dotnet @buildArgs
     if ($LASTEXITCODE -ne 0) {
         $failed += $proj.FullName
     }