Generate SBOM for Fsharp (#14029)

* Generate Sbom

* pass ci flag

* update

* Sbom generation

* Fix for trimming tests: Added nuget.org source + explicit source mapping for FSharp.Core

* Update Build.ps1

Tweaks to handle useGlobalNugetCache

Co-authored-by: Kevin Ransom (msft) <codecutter@hotmail.com>
Co-authored-by: Vlad Zarytovskii <vzaritovsky@hotmail.com>
Co-authored-by: Kevin Ransom (msft) <codecutter.fsharp@hotmail.com>

Build.cmd

@@ -1,2 +1,2 @@
 @echo off
-powershell -ExecutionPolicy ByPass -NoProfile -command "& """%~dp0eng\build.ps1""" -build -restore %*"
+powershell -ExecutionPolicy ByPass -NoProfile -command "& """%~dp0eng\build.ps1""" -build -restore %*"

azure-pipelines.yml

@@ -118,6 +118,7 @@ stages:
           steps:
           - checkout: self
             clean: true
+          - template: /eng/restore-internal-tools.yml
           - script: eng\CIBuild.cmd
                     -configuration $(_BuildConfig)
                     -prepareMachine
@@ -138,6 +139,7 @@ stages:
                     /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
                     /p:PublishToSymbolServer=true
                     /p:VisualStudioDropName=$(VisualStudioDropName)
+                    /p:GenerateSbom=true
           - script: .\tests\EndToEndBuildTests\EndToEndBuildTests.cmd -c $(_BuildConfig)
             displayName: End to end build tests
           - task: PublishTestResults@2

eng/Build.ps1

@@ -45,6 +45,7 @@ param (
     [switch]$deployExtensions,
     [switch]$prepareMachine,
     [switch]$useGlobalNuGetCache = $true,
+    [switch]$dontUseGlobalNuGetCache = $false,
     [switch]$warnAsError = $true,
     [switch][Alias('test')]$testDesktop,
     [switch]$testCoreClr,
@@ -113,7 +114,7 @@ function Print-Usage() {
     Write-Host "  -msbuildEngine <value>        Msbuild engine to use to run build ('dotnet', 'vs', or unspecified)."
     Write-Host "  -procdump                     Monitor test runs with procdump"
     Write-Host "  -prepareMachine               Prepare machine for CI run, clean up processes after build"
-    Write-Host "  -useGlobalNuGetCache          Use global NuGet cache."
+    Write-Host "  -dontUseGlobalNuGetCache      Do not use the global NuGet cache"
     Write-Host "  -noVisualStudio               Only build fsc and fsi as .NET Core applications. No Visual Studio required. '-configuration', '-verbosity', '-norestore', '-rebuild' are supported."
     Write-Host "  -sourceBuild                  Simulate building for source-build."
     Write-Host "  -skipbuild                    Skip building product"
@@ -131,6 +132,10 @@ function Process-Arguments() {
         exit 0
     }
 
+    if ($dontUseGlobalNugetCache -or $ci) {
+        $script:useGlobalNugetCache = $False
+    }
+
     $script:nodeReuse = $False;
 
     if ($testAll) {

eng/RestoreInternal.cmd

@@ -0,0 +1,2 @@
+@echo off
+powershell -ExecutionPolicy ByPass -NoProfile -command "& """%~dp0\common\build.ps1""" -build -restore %*"

eng/restore-internal-tools.yml

@@ -0,0 +1,13 @@
+steps:
+  - task: NuGetAuthenticate@0
+    inputs:
+      nuGetServiceConnections: 'devdiv/dotnet-core-internal-tooling'
+      forceReinstallCredentialProvider: true
+
+  - script: $(Build.SourcesDirectory)\eng\RestoreInternal.cmd
+            -ci
+            -projects $(Build.SourcesDirectory)/eng/common/internal/Tools.csproj
+            /bl:$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/RestoreInternal.binlog
+            /v:normal
+    displayName: Restore internal tools
+    condition: and(succeeded(), ne(variables['_skipRestoreInternalTools'], 'true'))

tests/projects/SelfContained_Trimming_Test/NuGet.Config

@@ -1,16 +1,25 @@
 <?xml version="1.0" encoding="utf-8"?>
 <configuration>
     <solution>
-        <add key="disableSourceControlIntegration" value="true" />
+        <add key="disableSourceControlIntegration" value="false" />
     </solution>
     <packageSources>
         <clear />
         <add key="localPackages" value="../../../artifacts/packages/Release/Release"/>
+        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
     </packageSources>
     <disabledPackageSources>
         <clear />
     </disabledPackageSources>
     <fallbackPackageFolders>
         <clear />
     </fallbackPackageFolders>
+    <packageSourceMapping>
+        <packageSource key="localPackages">
+            <package pattern="FSharp.Core" />
+        </packageSource>
+        <packageSource key="nuget.org">
+            <package pattern="*" />
+        </packageSource>
+    </packageSourceMapping>
 </configuration>

tests/projects/SelfContained_Trimming_Test/SelfContained_Trimming_Test.fsproj

@@ -10,6 +10,8 @@
 
   <PropertyGroup>
     <DisableImplicitFSharpCoreReference>true</DisableImplicitFSharpCoreReference>
+    <DisableImplicitNuGetFallbackFolder>true</DisableImplicitNuGetFallbackFolder>
+    <DisableImplicitLibraryPacksFolder>true</DisableImplicitLibraryPacksFolder>
     <PublishTrimmed>true</PublishTrimmed>
     <RuntimeIdentifier>win-x64</RuntimeIdentifier>
   </PropertyGroup>
@@ -29,7 +31,8 @@
 
   <PropertyGroup>
       <RestoreSources>
-        $(MSBuildThisFileDirectory)/../../../artifacts/packages/Release/Release
+        $(MSBuildThisFileDirectory)/../../../artifacts/packages/Release/Release;
+        https://api.nuget.org/v3/index.json;
       </RestoreSources>
   </PropertyGroup>