Azure PipelinesSAFE

Visual Studio Code

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: azure-pipelines
description: Use when validating Azure DevOps pipeline changes for the VS Code build. Covers queueing builds, checking build status, viewing logs, and iterating on pipeline YAML changes without waiting for full CI runs.
---

# Validating Azure Pipeline Changes

When modifying Azure DevOps pipeline files (YAML files in `build/azure-pipelines/`), you can validate changes locally using the Azure CLI before committing. This avoids the slow feedback loop of pushing changes, waiting for CI, and checking results.

## Prerequisites

1. **Check if Azure CLI is installed**:
   ```bash
   az --version
   ```

   If not installed, install it:
   ```bash
   # macOS
   brew install azure-cli

   # Windows (PowerShell as Administrator)
   winget install Microsoft.AzureCLI

   # Linux (Debian/Ubuntu)
   curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
   ```

2. **Check if the DevOps extension is installed**:
   ```bash
   az extension show --name azure-devops
   ```

   If not installed, add it:
   ```bash
   az extension add --name azure-devops
   ```

3. **Authenticate**:
   ```bash
   az login
   az devops configure --defaults organization=https://dev.azure.com/monacotools project=Monaco
   ```

## VS Code Main Build

The main VS Code build pipeline:
- **Organization**: `monacotools`
- **Project**: `Monaco`
- **Definition ID**: `111`
- **URL**: https://dev.azure.com/monacotools/Monaco/_build?definitionId=111

## VS Code Insider Scheduled Builds

Two Insider builds run automatically on a scheduled basis:
- **Morning build**: ~7:00 AM CET
- **Evening build**: ~7:00 PM CET

These scheduled builds use the same pipeline definition (`111`) but run on the `main` branch to produce Insider releases.

---

## Queueing a Build

Use the [queue command](./azure-pipeline.ts) to queue a validation build:

```bash
# Queue a build on the current branch
node .github/skills/azure-pipelines/azure-pipeline.ts queue

# Queue with a specific source branch
node .github/skills/azure-pipelines/azure-pipeline.ts queue --branch my-feature-branch

# Queue with custom parameters
node .github/skills/azure-pipelines/azure-pipeline.ts queue --parameter "VSCODE_BUILD_WEB=false" --parameter "VSCODE_PUBLISH=false"

# Parameter value with spaces
node .github/skills/azure-pipelines/azure-pipeline.ts queue --parameter "VSCODE_BUILD_TYPE=Product Build"
```

> **Important**: Before queueing a new build, cancel any previous builds on the same branch that you no longer need. This frees up build agents and reduces resource waste:
> ```bash
> # Find the build ID from status, then cancel it
> node .github/skills/azure-pipelines/azure-pipeline.ts status
> node .github/skills/azure-pipelines/azure-pipeline.ts cancel --build-id <id>
> node .github/skills/azure-pipelines/azure-pipeline.ts queue
> ```

### Script Options

| Option | Description |
|--------|-------------|
| `--branch <name>` | Source branch to build (default: current git branch) |
| `--definition <id>` | Pipeline definition ID (default: 111) |
| `--parameter <entry>` | Pipeline parameter in `KEY=value` format (repeatable); **use this when the value contains spaces** |
| `--parameters <list>` | Space-separated parameters in `KEY=value KEY2=value2` format; values **must not** contain spaces |
| `--dry-run` | Print the command without executing |

### Product Build Queue Parameters (`build/azure-pipelines/product-build.yml`)

| Name | Type | Default | Allowed Values | Description |
|------|------|---------|----------------|-------------|
| `VSCODE_QUALITY` | string | `insider` | `exploration`, `insider`, `stable` | Build quality channel |
| `VSCODE_BUILD_TYPE` | string | `Product Build` | `Product`, `CI` | Build mode for Product vs CI |
| `NPM_REGISTRY` | string | `https://pkgs.dev.azure.com/monacotools/Monaco/_packaging/vscode/npm/registry/` | any URL | Custom npm registry |
| `CARGO_REGISTRY` | string | `sparse+https://pkgs.dev.azure.com/monacotools/Monaco/_packaging/vscode/Cargo/index/` | any URL | Custom Cargo registry |
| `VSCODE_BUILD_WIN32` | boolean | `true` | `true`, `false` | Build Windows x64 |
| `VSCODE_BUILD_WIN32_ARM64` | boolean | `true` | `true`, `false` | Build Windows arm64 |
| `VSCODE_BUILD_LINUX` | boolean | `true` | `true`, `false` | Build Linux x64 |
| `VSCODE_BUILD_LINUX_SNAP` | boolean | `true` | `true`, `false` | Build Linux x64 Snap |
| `VSCODE_BUILD_LINUX_ARM64` | boolean | `true` | `true`, `false` | Build Linux arm64 |
| `VSCODE_BUILD_LINUX_ARMHF` | boolean | `true` | `true`, `false` | Build Linux armhf |
| `VSCODE_BUILD_ALPINE` | boolean | `true` | `true`, `false` | Build Alpine x64 |
| `VSCODE_BUILD_ALPINE_ARM64` | boolean | `true` | `true`, `false` | Build Alpine arm64 |
| `VSCODE_BUILD_MACOS` | boolean | `true` | `true`, `false` | Build macOS x64 |
| `VSCODE_BUILD_MACOS_ARM64` | boolean | `true` | `true`, `false` | Build macOS arm64 |
| `VSCODE_BUILD_MACOS_UNIVERSAL` | boolean | `true` | `true`, `false` | Build macOS universal (requires both macOS arches) |
| `VSCODE_BUILD_WEB` | boolean | `true` | `true`, `false` | Build Web artifacts |
| `VSCODE_PUBLISH` | boolean | `true` | `true`, `false` | Publish to builds.code.visualstudio.com |
| `VSCODE_RELEASE` | boolean | `false` | `true`, `false` | Trigger release flow if successful |
| `VSCODE_STEP_ON_IT` | boolean | `false` | `true`, `false` | Skip tests |
| `VSCODE_USE_LEGACY_OSS_NOTICE` | boolean | `false` | `true`, `false` | Keep the legacy mixin ThirdPartyNotices.txt instead of the Component Governance notice |

Example: run a quick CI-oriented validation with minimal publish/release side effects:

```bash
node .github/skills/azure-pipelines/azure-pipeline.ts queue \
   --parameter "VSCODE_BUILD_TYPE=CI Build" \
   --parameter "VSCODE_PUBLISH=false" \
   --parameter "VSCODE_RELEASE=false"
```

---

## Checking Build Status

Use the [status command](./azure-pipeline.ts) to monitor a running build:

```bash
# Get status of the most recent builds
node .github/skills/azure-pip

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

declared (1 observation(s))

Shell

declared (4 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (2)

extensions/terminal-suggest/src/test/fixtures/symlink-test/symlink-executable.sh

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Azure Pipelines](https://modelsatlas.com/skills/microsoft/azure-pipelines/badge.svg)](https://modelsatlas.com/skills/microsoft/azure-pipelines/)

Not your listing, or something out of date? Claim or update your listing.