ci.yml

#
# See https://docs.microsoft.com/en-us/vsts/pipelines/yaml-schema for details on this file.
#

# Configure which branches trigger builds
trigger:
  batch: true
  branches:
    include:
    - blazor-wasm
    - master
    - release/*

# Run PR validation on all branches
pr:
  autoCancel: true
  branches:
    include:
    - '*'

variables:
- name: DOTNET_SKIP_FIRST_TIME_EXPERIENCE
  value: true
- name: _TeamName
  value:  AspNetCore
- name: _DotNetPublishToBlobFeed
  value: true
- name: _PublishUsingPipelines
  value: true
- name: _DotNetArtifactsCategory
  value: .NETCORE
- name: _DotNetValidationArtifactsCategory
  value: .NETCORE
- ${{ if ne(variables['System.TeamProject'], 'internal') }}:
  - name: _UseHelixOpenQueues
    value: 'true'
  - name: _BuildArgs
    value: '/p:SkipTestBuild=true'
  - name: _PublishArgs
    value: ''
  - name: _SignType
    value: ''
  - name: _InternalRuntimeDownloadArgs
    value: ''
  - name: _InternalRuntimeDownloadCodeSignArgs
    value: ''
- ${{ if eq(variables['System.TeamProject'], 'internal') }}:
  - group: DotNet-MSRC-Storage
  - name: _InternalRuntimeDownloadArgs
    value: -DotNetRuntimeSourceFeed https://dotnetclimsrc.blob.core.windows.net/dotnet -DotNetRuntimeSourceFeedKey
           $(dotnetclimsrc-read-sas-token-base64) /p:DotNetAssetRootAccessTokenSuffix='$(dotnetclimsrc-read-sas-token-base64)'
  # The code signing doesn't use the aspnet build scripts, so the msbuild parameters have
  # to be passed directly. This is awkward, since we pass the same info above, but we have
  # to have it in two different forms
  - name: _InternalRuntimeDownloadCodeSignArgs
    value: /p:DotNetRuntimeSourceFeed=https://dotnetclimsrc.blob.core.windows.net/dotnet /p:DotNetRuntimeSourceFeedKey=$(dotnetclimsrc-read-sas-token-base64)
  - group: DotNet-HelixApi-Access
  - name: _UseHelixOpenQueues
    value: 'false'
  - ${{ if notin(variables['Build.Reason'], 'PullRequest') }}:
    # DotNet-Blob-Feed provides: dotnetfeed-storage-access-key-1
    # Publish-Build-Assets provides: MaestroAccessToken, BotAccount-dotnet-maestro-bot-PAT
    - group: DotNet-Blob-Feed
    - group: Publish-Build-Assets

    - name: _BuildArgs
      value: /p:TeamName=$(_TeamName)
             /p:OfficialBuildId=$(Build.BuildNumber)
             /p:SkipTestBuild=true
    - name: _SignType
      value: real

    # The following extra properties are not set when testing. Use with final build.[cmd,sh] of asset-producing jobs.
    - name: _PublishArgs
      value: /p:Publish=true
             /p:GenerateChecksums=true
             /p:DotNetPublishBlobFeedKey=$(dotnetfeed-storage-access-key-1)
             /p:DotNetPublishBlobFeedUrl=https://dotnetfeed.blob.core.windows.net/dotnet-core/index.json
             /p:DotNetPublishToBlobFeed=$(_DotNetPublishToBlobFeed)
             /p:DotNetPublishUsingPipelines=$(_PublishUsingPipelines)
             /p:DotNetArtifactsCategory=$(_DotNetArtifactsCategory)

  - ${{ if in(variables['Build.Reason'], 'PullRequest') }}:
    - name: _BuildArgs
      value: '/p:SkipTestBuild=true'
    - name: _SignType
      value: test
    - name: _PublishArgs
      value: ''

stages:
- stage: build
  displayName: Build
  jobs:
  # Code check
  - ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
    - template: jobs/default-build.yml
      parameters:
        jobName: Code_check
        jobDisplayName: Code check
        agentOs: Windows
        steps:
        - powershell: ./eng/scripts/CodeCheck.ps1 -ci $(_InternalRuntimeDownloadArgs)
          displayName: Run eng/scripts/CodeCheck.ps1
        artifacts:
        - name: Code_Check_Logs
          path: artifacts/log/
          publishOnError: true
          includeForks: true

  # Build Windows (x64/x86)
  - template: jobs/default-build.yml
    parameters:
      codeSign: true
      jobName: Windows_build
      jobDisplayName: "Build: Windows x64/x86"
      agentOs: Windows
      steps:
      - script: "echo ##vso[build.addbuildtag]daily-build"
        condition: and(notin(variables['Build.Reason'], 'PullRequest'), notin(variables['DotNetFinalVersionKind'], 'release', 'prerelease'))
        displayName: 'Set CI tags'
      - script: "echo ##vso[build.addbuildtag]release-candidate"
        condition: and(notin(variables['Build.Reason'], 'PullRequest'), in(variables['DotNetFinalVersionKind'], 'release', 'prerelease'))
        displayName: 'Set CI tags'

      # !!! NOTE !!! Some of these steps have disabled code signing.
      # This is intentional to workaround https://github.com/dotnet/arcade/issues/1957 which always re-submits for code-signing, even
      # if they have already been signed. This results in slower builds due to re-submitting the same .nupkg many times for signing.
      # The sign settings have been configured to
      - script: ./build.cmd
                -ci
                -nobl
                -arch x64
                -pack
                -all
                $(_BuildArgs)
                $(_InternalRuntimeDownloadArgs)
        displayName: Build x64

      # Build the x86 shared framework
      # This is going to actually build x86 native assets.
      - script: ./build.cmd
                -ci
                -nobl
                -noBuildRepoTasks
                -arch x86
                -pack
                -all
                -noBuildJava
                -noBuildNative
                /p:OnlyPackPlatformSpecificPackages=true
                $(_BuildArgs)
                $(_InternalRuntimeDownloadArgs)
        displayName: Build x86

      - script: .\src\SiteExtensions\build.cmd
                -ci
                -nobl
                -noBuildRepoTasks
                -pack
                -noBuildDeps
                -noBuildNative
                $(_BuildArgs)
                $(_InternalRuntimeDownloadArgs)
        condition: ne(variables['Build.Reason'], 'PullRequest')
        displayName: Build SiteExtension

      # This runs code-signing on all packages, zips, and jar files as defined in build/CodeSign.targets. If
      # https://github.com/dotnet/arcade/issues/1957 is resolved, consider running code-signing inline with the other
      # previous steps. Sign check is disabled because it is run in a separate step below, after installers are built.
      - script: ./build.cmd
                -ci
                -nobl
                -noBuildRepoTasks
                -noBuild
                -noRestore
                -sign
                /p:DotNetSignType=$(_SignType)
                $(_BuildArgs)
        displayName: Code sign packages

      # Windows installers bundle both x86 and x64 assets
      - script: ./build.cmd
                -ci
                -nobl
                -noBuildRepoTasks
                -sign
                -buildInstallers
                /p:DotNetSignType=$(_SignType)
                /p:AssetManifestFileName=aspnetcore-win-x64-x86.xml
                $(_BuildArgs)
                $(_PublishArgs)
                $(_InternalRuntimeDownloadArgs)
                /p:PublishInstallerBaseVersion=true
        displayName: Build Installers

      # A few files must also go to the VS package feed.
      - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
        - task: NuGetCommand@2
          displayName: Push Visual Studio packages
          inputs:
            command: push
            packagesToPush: 'artifacts/packages/**/VS.Redist.Common.AspNetCore.*.nupkg'
            nuGetFeedType: external
            publishFeedCredentials: 'DevDiv - VS package feed'

      artifacts:
      - name: Windows_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Windows_Packages
        path: artifacts/packages/

  # Build Windows ARM
  - template: jobs/default-build.yml
    parameters:
      codeSign: true
      jobName: Windows_arm_build
      jobDisplayName: "Build: Windows ARM"
      agentOs: Windows
      buildArgs:
        -arch arm
        -sign
        -pack
        -noBuildNodeJS
        -noBuildJava
        /p:DotNetSignType=$(_SignType)
        /p:OnlyPackPlatformSpecificPackages=true
        /p:AssetManifestFileName=aspnetcore-win-arm.xml
        $(_BuildArgs)
        $(_PublishArgs)
        $(_InternalRuntimeDownloadArgs)
      installNodeJs: false
      installJdk: false
      artifacts:
      - name: Windows_arm_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Windows_arm_Packages
        path: artifacts/packages/

  # Build Windows ARM64
  - template: jobs/default-build.yml
    parameters:
      codeSign: true
      jobName: Windows_64_build
      jobDisplayName: "Build: Windows ARM64"
      agentOs: Windows
      buildArgs:
        -arch arm64
        -sign
        -pack
        -noBuildNodeJS
        -noBuildJava
        /p:DotNetSignType=$(_SignType)
        /p:OnlyPackPlatformSpecificPackages=true
        /p:AssetManifestFileName=aspnetcore-win-arm64.xml
        $(_BuildArgs)
        $(_PublishArgs)
        $(_InternalRuntimeDownloadArgs)
      installNodeJs: false
      installJdk: false
      artifacts:
      - name: Windows_arm64_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Windows_arm64_Packages
        path: artifacts/packages/
      - name: Windows_arm64_Installers
        path: artifacts/installers/

  # Build MacOS
  - template: jobs/default-build.yml
    parameters:
      jobName: MacOs_x64_build
      jobDisplayName: "Build: macOS"
      agentOs: macOs
      buildArgs:
        --pack
        --all
        --no-build-nodejs
        --no-build-java
        -p:OnlyPackPlatformSpecificPackages=true
        -p:AssetManifestFileName=aspnetcore-MacOS_x64.xml
        $(_BuildArgs)
        $(_PublishArgs)
        $(_InternalRuntimeDownloadArgs)
      installNodeJs: false
      installJdk: false
      artifacts:
      - name: MacOS_x64_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: MacOS_x64_Packages
        path: artifacts/packages/
  - template: jobs/codesign-xplat.yml
    parameters:
      inputName: MacOS_x64

  # Build Linux x64
  - template: jobs/default-build.yml
    parameters:
      jobName: Linux_x64_build
      jobDisplayName: "Build: Linux x64"
      agentOs: Linux
      useHostedUbuntu: false
      steps:
      - script: ./build.sh
            --ci
            --nobl
            --arch x64
            --pack
            --all
            --no-build-nodejs
            --no-build-java
            -p:OnlyPackPlatformSpecificPackages=true
            $(_BuildArgs)
            $(_InternalRuntimeDownloadArgs)
        displayName: Run build.sh
      - script: |
          git clean -xfd src/**/obj/
          ./dockerbuild.sh bionic \
            --ci \
            --nobl \
            --arch x64 \
            --build-installers \
            --no-build-deps \
            --no-build-nodejs \
            -p:OnlyPackPlatformSpecificPackages=true \
            -p:BuildRuntimeArchive=false \
            -p:LinuxInstallerType=deb \
            $(_BuildArgs) \
            $(_InternalRuntimeDownloadArgs)
        displayName: Build Debian installers
      - script: |
          git clean -xfd src/**/obj/
          ./dockerbuild.sh rhel \
            --ci \
            --nobl \
            --arch x64 \
            --build-installers \
            --no-build-deps \
            --no-build-nodejs \
            -p:OnlyPackPlatformSpecificPackages=true \
            -p:BuildRuntimeArchive=false \
            -p:LinuxInstallerType=rpm \
            -p:AssetManifestFileName=aspnetcore-Linux_x64.xml \
            $(_BuildArgs) \
            $(_PublishArgs) \
            $(_InternalRuntimeDownloadArgs)
        displayName: Build RPM installers
      installNodeJs: false
      installJdk: false
      artifacts:
      - name: Linux_x64_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Linux_x64_Packages
        path: artifacts/packages/
  - template: jobs/codesign-xplat.yml
    parameters:
      inputName: Linux_x64

  # Build Linux ARM
  - template: jobs/default-build.yml
    parameters:
      jobName: Linux_arm_build
      jobDisplayName: "Build: Linux ARM"
      agentOs: Linux
      buildArgs:
        --arch arm
        --pack
        --all
        --no-build-nodejs
        --no-build-java
        -p:OnlyPackPlatformSpecificPackages=true
        -p:AssetManifestFileName=aspnetcore-Linux_arm.xml
        $(_BuildArgs)
        $(_PublishArgs)
        $(_InternalRuntimeDownloadArgs)
      installNodeJs: false
      installJdk: false
      artifacts:
      - name: Linux_arm_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Linux_arm_Packages
        path: artifacts/packages/
  - template: jobs/codesign-xplat.yml
    parameters:
      inputName: Linux_arm

  # Build Linux ARM64
  - template: jobs/default-build.yml
    parameters:
      jobName: Linux_arm64_build
      jobDisplayName: "Build: Linux ARM64"
      agentOs: Linux
      buildArgs:
        --arch arm64
        --all
        --pack
        --no-build-nodejs
        --no-build-java
        -p:OnlyPackPlatformSpecificPackages=true
        -p:AssetManifestFileName=aspnetcore-Linux_arm64.xml
        $(_BuildArgs)
        $(_PublishArgs)
        $(_InternalRuntimeDownloadArgs)
      installNodeJs: false
      installJdk: false
      artifacts:
      - name: Linux_arm64_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Linux_arm64_Packages
        path: artifacts/packages/
  - template: jobs/codesign-xplat.yml
    parameters:
      inputName: Linux_arm64

  # Build Linux Musl x64
  - template: jobs/default-build.yml
    parameters:
      jobName: Linux_musl_x64_build
      jobDisplayName: "Build: Linux Musl x64"
      agentOs: Linux
      buildScript: ./dockerbuild.sh alpine
      buildArgs:
        --arch x64
        --os-name linux-musl
        --pack
        --all
        --no-build-nodejs
        --no-build-java
        -p:OnlyPackPlatformSpecificPackages=true
        -p:AssetManifestFileName=aspnetcore-Linux_musl_x64.xml
        $(_BuildArgs)
        $(_PublishArgs)
        $(_InternalRuntimeDownloadArgs)
      installNodeJs: false
      installJdk: false
      artifacts:
      - name: Linux_musl_x64_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Linux_musl_x64_Packages
        path: artifacts/packages/
  - template: jobs/codesign-xplat.yml
    parameters:
      inputName: Linux_musl_x64

  # Build Linux Musl ARM64
  - template: jobs/default-build.yml
    parameters:
      jobName: Linux_musl_arm64_build
      jobDisplayName: "Build: Linux Musl ARM64"
      agentOs: Linux
      useHostedUbuntu: false
      buildScript: ./dockerbuild.sh ubuntu-alpine37
      buildArgs:
        --arch arm64
        --os-name linux-musl
        --pack
        --all
        --no-build-nodejs
        --no-build-java
        -p:OnlyPackPlatformSpecificPackages=true
        -p:AssetManifestFileName=aspnetcore-Linux_musl_arm64.xml
        $(_BuildArgs)
        $(_PublishArgs)
        $(_InternalRuntimeDownloadArgs)
      installNodeJs: false
      installJdk: false
      artifacts:
      - name: Linux_musl_arm64_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Linux_musl_arm64_Packages
        path: artifacts/packages/
  - template: jobs/codesign-xplat.yml
    parameters:
      inputName: Linux_musl_arm64

  # Test jobs
  - template: jobs/default-build.yml
    parameters:
      condition: ne(variables['SkipTests'], 'true')
      jobName: Windows_Test
      jobDisplayName: "Test: Windows Server 2016 x64"
      agentOs: Windows
      isTestingJob: true
      buildArgs: -all -pack -test /p:SkipHelixReadyTests=true /p:SkipIISNewHandlerTests=true /p:SkipIISTests=true
                 /p:SkipIISExpressTests=true /p:SkipIISNewShimTests=true /p:RunTemplateTests=false
                 $(_InternalRuntimeDownloadArgs)
      beforeBuild:
      - powershell: "& ./src/Servers/IIS/tools/UpdateIISExpressCertificate.ps1; & ./src/Servers/IIS/tools/update_schema.ps1"
        displayName: Setup IISExpress test certificates and schema
      artifacts:
      - name: Windows_Test_Dumps
        path: artifacts/dumps/
        publishOnError: true
        includeForks: true
      - name: Windows_Test_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Windows_Test_Results
        path: artifacts/TestResults/
        publishOnError: true
        includeForks: true

  - template: jobs/default-build.yml
    parameters:
      condition: ne(variables['SkipTests'], 'true')
      jobName: Windows_Templates_Test
      jobDisplayName: "Test: Templates - Windows Server 2016 x64"
      agentOs: Windows
      isTestingJob: true
      steps:
      - script: ./build.cmd -ci -nobl -all -pack $(_InternalRuntimeDownloadArgs)
        displayName: Build Repo
      - script: ./src/ProjectTemplates/build.cmd -ci -nobl -noBuildRepoTasks -pack -NoRestore -NoBuilddeps "/p:RunTemplateTests=true"
        displayName: Pack Templates
      - script: ./src/ProjectTemplates/build.cmd -ci -nobl -noBuildRepoTasks -test -NoRestore -NoBuild -NoBuilddeps "/p:RunTemplateTests=true"
        displayName: Test Templates
      artifacts:
      - name: Windows_Test_Templates_Dumps
        path: artifacts/dumps/
        publishOnError: true
        includeForks: true
      - name: Windows_Test_Templates_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Windows_Test_Templates_Results
        path: artifacts/TestResults/
        publishOnError: true
        includeForks: true

  - template: jobs/default-build.yml
    parameters:
      condition: ne(variables['SkipTests'], 'true')
      jobName: MacOS_Test
      jobDisplayName: "Test: macOS 10.14"
      agentOs: macOS
      isTestingJob: true
      buildArgs: --all --test "/p:RunTemplateTests=false /p:SkipHelixReadyTests=true" $(_InternalRuntimeDownloadArgs)
      beforeBuild:
      - bash: "./eng/scripts/install-nginx-mac.sh"
        displayName: Installing Nginx
      artifacts:
      - name: MacOS_Test_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: MacOS_Test_Results
        path: artifacts/TestResults/
        publishOnError: true
        includeForks: true

  - template: jobs/default-build.yml
    parameters:
      condition: ne(variables['SkipTests'], 'true')
      jobName: Linux_Test
      jobDisplayName: "Test: Ubuntu 16.04 x64"
      agentOs: Linux
      isTestingJob: true
      useHostedUbuntu: false
      buildArgs: --all --test "/p:RunTemplateTests=false /p:SkipHelixReadyTests=true" $(_InternalRuntimeDownloadArgs)
      beforeBuild:
      - bash: "./eng/scripts/install-nginx-linux.sh"
        displayName: Installing Nginx
      - bash: "echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p"
        displayName: Increase inotify limit
      artifacts:
      - name: Linux_Test_Logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true
      - name: Linux_Test_Results
        path: artifacts/TestResults/
        publishOnError: true
        includeForks: true

  # Helix x64
  - template: jobs/default-build.yml
    parameters:
      jobName: Helix_x64
      jobDisplayName: 'Tests: Helix x64'
      agentOs: Windows
      timeoutInMinutes: 180
      steps:
      # Build the shared framework
      - script: ./build.cmd -ci -nobl -all -pack -arch x64 /p:ASPNETCORE_TEST_LOG_DIR=artifacts/log
        displayName: Build shared fx
      - script: ./build.cmd -ci -nobl -noBuildRepoTasks -restore -noBuild -projects src/Grpc/**/*.csproj
        displayName: Restore interop projects
      - script: ./build.cmd -ci -nobl -noBuildRepoTasks -noRestore -test -all -noBuildNative -projects eng\helix\helix.proj
                /p:IsRequiredCheck=true /p:IsHelixJob=true /p:BuildInteropProjects=true /p:RunTemplateTests=true
                /p:ASPNETCORE_TEST_LOG_DIR=artifacts/log
        displayName: Run build.cmd helix target
        env:
          HelixApiAccessToken: $(HelixApiAccessToken) # Needed for internal queues
          SYSTEM_ACCESSTOKEN: $(System.AccessToken) # We need to set this env var to publish helix results to Azure Dev Ops
      artifacts:
      - name: Helix_logs
        path: artifacts/log/
        publishOnError: true
        includeForks: true

  # Source build
  - job: Source_Build
    displayName: 'Test: Linux Source Build'
    container: centos:7
    pool:
      vmImage: 'ubuntu-16.04'
    variables:
      DotNetCoreSdkDir: $(Agent.ToolsDirectory)/dotnet
      # This isn't needed in the path because build does not need to _use_ global tools.
      DOTNET_CLI_HOME: $(System.DefaultWorkingDirectory)
      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: true
    steps:
    - script: |
        source eng/common/native/common-library.sh
        mkdir -p $(System.DefaultWorkingDirectory)/.tools
        GetFile https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 $(System.DefaultWorkingDirectory)/.tools/jq
        chmod +x $(System.DefaultWorkingDirectory)/.tools/jq
        echo "##vso[task.prependpath]$(System.DefaultWorkingDirectory)/.tools"
      displayName: Install jq
    - ${{ if ne(variables['System.TeamProject'], 'public') }}:
        - task: Bash@3
          displayName: Setup Private Feeds Credentials
          inputs:
            filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.sh
            arguments: $(Build.SourcesDirectory)/NuGet.config $Token
          env:
            Token: $(dn-bot-dnceng-artifact-feeds-rw)
    - script: ./eng/scripts/ci-source-build.sh --ci --nobl --configuration Release /p:BuildManaged=true /p:BuildNodeJs=false
      displayName: Run ci-source-build.sh
    - task: PublishBuildArtifacts@1
      displayName: Upload logs
      condition: always()
      continueOnError: true
      inputs:
        pathtoPublish: artifacts/log/
        artifactName: Source_Build_Logs
        artifactType: Container
        parallel: true
    - task: PublishBuildArtifacts@1
      displayName: Upload package artifacts
      # Only capture source build artifacts in PRs for the sake of inspecting
      # changes that impact source-build. The artifacts from this build pipeline are never actually used.
      condition: and(succeeded(), in(variables['Build.Reason'], 'PullRequest'))
      inputs:
        pathtoPublish: artifacts/packages/
        artifactName: Source_Build_Packages
        artifactType: Container
        parallel: true

  # Publish to the BAR
  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
    - template: /eng/common/templates/job/publish-build-assets.yml
      parameters:
        dependsOn:
          - Windows_build
          - Windows_arm_build
          - CodeSign_Xplat_MacOS_x64
          - CodeSign_Xplat_Linux_x64
          - CodeSign_Xplat_Linux_arm
          - CodeSign_Xplat_Linux_arm64
          - CodeSign_Xplat_Linux_musl_x64
          - CodeSign_Xplat_Linux_musl_arm64
          # In addition to the dependencies above, ensure the build was successful overall.
          - Linux_Test
          - MacOS_Test
          - Source_Build
          - Windows_Templates_Test
          - Windows_Test
        pool:
          vmImage: vs2017-win2016
        publishUsingPipelines: ${{ variables._PublishUsingPipelines }}
        enablePublishBuildArtifacts: true # publish artifacts/log files

- ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
  - template: /eng/common/templates/post-build/post-build.yml
    parameters:
      enableSymbolValidation: false
      enableSigningValidation: false
      enableNugetValidation: false
      publishInstallersAndChecksums: true