publish.yml

name: IntuneAppFactory

trigger: none

schedules:
- cron: "0 */6 * * *"
  displayName: Every 6 hours
  branches:
    include:
    - main
  always: true

pool:
  name: '<<POOLNAME>>'

parameters:
  - name: operationalMode
    displayName: Select operational mode
    type: string
    default: 'Publish'
    values:
    - 'Verify'
    - 'Package'
    - 'Publish'
  - name: archiveMode
    displayName: Archive published apps
    type: string
    default: 'No'
    values:
    - 'Yes'
    - 'No'

variables:
- group: IntuneAppFactory
- group: KeyVault

# Stage: 1
# - Description: Test environment for required files
# - Input file required: None 
# - Output file created: None
stages:
- stage: test_environment
  jobs:
  - job: test_environment
    timeoutInMinutes: 5
    steps:
    - task: PowerShell@2
      name: write_variables
      displayName: Write-Variable
      inputs:
        filePath: 'Scripts/Write-Variable.ps1'
    - task: PowerShell@2
      name: check_template_files
      displayName: Test-TemplatesFolder
      inputs:
        filePath: 'Scripts/Test-TemplatesFolder.ps1'
# Stage: 2
# - Description: Install all required modules and remove files from previous pipeline executions
# - Input file required: None 
# - Output file created: None
- stage: prepare_environment
  dependsOn:
  - test_environment
  condition: and(succeeded(), eq(dependencies.test_environment.outputs['test_environment.check_template_files.shouldrun'], 'true'))
  jobs: 
  - job: prepare_environment
    timeoutInMinutes: 15
    steps: 
    - task: PowerShell@2
      name: install_modules
      displayName: Install-Modules
      inputs:
        filePath: 'Scripts/Install-Modules.ps1'
    - task: PowerShell@2
      name: cleanup_folders
      displayName: Remove-Files
      inputs:
        filePath: 'Scripts/Remove-Files.ps1'
# Stage: 3
# - Description: Check that all onboarded apps are properly configured, have the required files necessary for the pipeline to successfully publish the app in Intune
# - Input file required: None
# - Output file created: AppsProcessList.json
- stage: check_app_files
  dependsOn:
  - test_environment
  - prepare_environment
  condition: and(succeeded(), or(eq('${{ parameters.operationalMode }}', 'Verify'), eq('${{ parameters.operationalMode }}', 'Package'), eq('${{ parameters.operationalMode }}', 'Publish')))
  jobs:
  - job: check_app_files
    timeoutInMinutes: 15
    steps:
    - task: PowerShell@2
      name: test_app_files
      displayName: Test-AppFiles
      inputs:
        filePath: 'Scripts/Test-AppFiles.ps1'
        arguments: -ConnectionString $(SA-IntuneAppFactory-AccessKey)
    - task: PublishBuildArtifacts@1
      name: publish_artifacts
      inputs:
        pathToPublish: $(Build.BinariesDirectory)
        artifactName: AppsProcessList
    - task: DeleteFiles@1
      name: cleanup_artifacts
      inputs:
        SourceFolder: '$(Build.BinariesDirectory)'
        Contents: '**'
# Stage: 4
# - Description: Check for new apps eligible to be processed by pipeline
# - Input file required: AppsProcessList.json 
# - Output file created: AppsDownloadList.json
- stage: check_new_app_version
  dependsOn:
  - test_environment
  - prepare_environment
  - check_app_files
  condition: and(succeeded(), eq(dependencies.check_app_files.outputs['check_app_files.test_app_files.shouldrun'], 'true'), or(eq('${{ parameters.operationalMode }}', 'Package'), eq('${{ parameters.operationalMode }}', 'Publish')))
  jobs:
  - job: check_new_app_version
    timeoutInMinutes: 30
    steps:
    - task: DownloadBuildArtifacts@0
      name: download_artifacts
      inputs:
        buildType: 'current'
        downloadType: 'single'
        artifactName: AppsProcessList
        downloadPath: '$(Build.ArtifactStagingDirectory)'
    - task: PowerShell@2
      name: test_app_list
      displayName: Test-AppList
      inputs:
        filePath: 'Scripts/Test-AppList.ps1'
        arguments: -TenantID $(TenantID) -ClientID $(ClientID) -ClientSecret $(SP-IntuneAppFactory-ClientSecret) -StorageAccountAccessKey $(SA-IntuneAppFactory-AccessKey)
    - task: PublishBuildArtifacts@1
      name: publish_artifacts
      inputs:
        pathToPublish: $(Build.BinariesDirectory)
        artifactName: AppsDownloadList
    - task: DeleteFiles@1
      name: cleanup_artifacts
      inputs:
        SourceFolder: '$(Build.BinariesDirectory)'
        Contents: '**'
# Stage: 5
# - Description: Download new apps eligible to be processed by pipeline
# - Input file required: AppsDownloadList.json 
# - Output file created: AppsPrepareList.json
- stage: download_new_apps
  dependsOn:
  - test_environment
  - prepare_environment
  - check_app_files
  - check_new_app_version
  condition: and(succeeded(), eq(dependencies.check_new_app_version.outputs['check_new_app_version.test_app_list.shouldrun'], 'true'), or(eq('${{ parameters.operationalMode }}', 'Package'), eq('${{ parameters.operationalMode }}', 'Publish')))
  jobs:
  - job: download_new_apps
    timeoutInMinutes: 120
    steps:
    - task: DownloadBuildArtifacts@0
      name: download_artifacts
      inputs:
        buildType: 'current'
        downloadType: 'single'
        artifactName: AppsDownloadList
        downloadPath: '$(Build.ArtifactStagingDirectory)'    
    - task: PowerShell@2
      name: save_installer
      displayName: Save-Installer
      inputs:
        filePath: 'Scripts/Save-Installer.ps1'
        arguments: -StorageAccountAccessKey $(SA-IntuneAppFactory-AccessKey)
    - task: PublishBuildArtifacts@1
      name: publish_artifacts
      inputs:
        pathToPublish: $(Build.BinariesDirectory)
        artifactName: AppsPrepareList
    - task: DeleteFiles@1
      name: cleanup_artifacts
      inputs:
        SourceFolder: '$(Build.BinariesDirectory)'
        Contents: '**'
# Stage: 6
# - Description: Prepare apps by creating packaging folder, copy framework and setup files
# - Input file required: AppsPrepareList.json 
# - Output file created: AppsPublishList.json
- stage: prepare_app_files
  dependsOn:
  - test_environment
  - prepare_environment
  - check_app_files
  - check_new_app_version
  - download_new_apps
  condition: and(succeeded(), eq(dependencies.download_new_apps.outputs['download_new_apps.save_installer.shouldrun'], 'true'), or(eq('${{ parameters.operationalMode }}', 'Package'), eq('${{ parameters.operationalMode }}', 'Publish')))
  jobs:
  - job: prepare_app_package_folder
    timeoutInMinutes: 60
    steps:
    - task: DownloadBuildArtifacts@0
      name: download_artifacts
      inputs:
        buildType: 'current'
        downloadType: 'single'
        artifactName: AppsPrepareList
        downloadPath: '$(Build.ArtifactStagingDirectory)'
    - task: PowerShell@2
      name: create_package_folder
      displayName: Prepare-AppPackageFolder
      inputs:
        filePath: 'Scripts/Prepare-AppPackageFolder.ps1'
    - task: PublishBuildArtifacts@1
      name: publish_artifacts
      inputs:
        pathToPublish: $(Build.BinariesDirectory)
        artifactName: AppsPublishList
    - task: DeleteFiles@1
      name: cleanup_artifacts
      inputs:
        SourceFolder: '$(Build.BinariesDirectory)'
        Contents: '**'
# Stage: 7
# Description: Upload all apps that will be published to Intune to storage account for archival process
# - Input file required: AppsPublishList.json 
# - Output file created: None
- stage: archive_apps
  dependsOn:
  - test_environment
  - prepare_environment
  - check_app_files
  - check_new_app_version
  - download_new_apps
  - prepare_app_files
  condition: and(succeeded(), eq(dependencies.prepare_app_files.outputs['prepare_app_package_folder.create_package_folder.shouldrun'], 'true'), eq('${{ parameters.archiveMode }}', 'Yes'), or(eq('${{ parameters.operationalMode }}', 'Package'), eq('${{ parameters.operationalMode }}', 'Publish')))
  jobs:
  - job: archive_apps
    timeoutInMinutes: 60
    steps:
    - task: DownloadBuildArtifacts@0
      name: download_artifacts
      inputs:
        buildType: 'current'
        downloadType: 'single'
        artifactName: AppsPublishList
        downloadPath: '$(Build.ArtifactStagingDirectory)'
    - task: PowerShell@2
      name: upload_app_archive
      displayName: New-AppArchive
      inputs:
        filePath: 'Scripts/New-AppArchive.ps1'
        arguments: -StorageAccountName $(ArchiveStorageAccountName) -ContainerName $(ArchiveContainerName) -StorageAccountKey $(SA-IntuneAppFactory-AccessKey)
    - task: DeleteFiles@1
      name: cleanup_artifacts
      inputs:
        SourceFolder: '$(Build.BinariesDirectory)'
        Contents: '**'
# Stage: 8
# - Description: Invoke IntuneWin32AppPackager framework script to package and publish new apps to Intune
# - Input file required: AppsPublishList.json 
# - Output file created: AppsAssignList.json
- stage: publish_apps
  dependsOn:
  - test_environment
  - prepare_environment
  - check_app_files
  - check_new_app_version
  - download_new_apps
  - prepare_app_files
  condition: and(succeeded(), eq(dependencies.prepare_app_files.outputs['prepare_app_package_folder.create_package_folder.shouldrun'], 'true'), eq('${{ parameters.operationalMode }}', 'Publish'))
  jobs:
  - job: publish_apps
    timeoutInMinutes: 120
    steps:
    - task: DownloadBuildArtifacts@0
      name: download_artifacts
      inputs:
        buildType: 'current'
        downloadType: 'single'
        artifactName: AppsPublishList
        downloadPath: '$(Build.ArtifactStagingDirectory)'
    - task: PowerShell@2
      name: new_app
      displayName: New-Win32App
      inputs:
        filePath: 'Scripts/New-Win32App.ps1'
        arguments: -TenantID $(TenantID) -ClientID $(ClientID) -ClientSecret $(SP-IntuneAppFactory-ClientSecret) -WorkspaceID $(ReportWorkspaceID) -SharedKey $(LA-IntuneAppFactory-PrimaryKey)
    - task: PublishBuildArtifacts@1
      name: publish_artifacts
      inputs:
        pathToPublish: $(Build.BinariesDirectory)
        artifactName: AppsPublishedList
    - task: DeleteFiles@1
      name: cleanup_artifacts
      inputs:
        SourceFolder: '$(Build.BinariesDirectory)'
        Contents: '**'
# Stage: 9
# - Description: Configure assignments for all applications that were published to Intune
# - Input file required: AppsAssignList.json (included in AppsPublishedList artifact)
# - Output file created: None
- stage: assign_apps
  dependsOn:
  - test_environment
  - prepare_environment
  - check_app_files
  - check_new_app_version
  - download_new_apps
  - prepare_app_files
  - publish_apps
  condition: and(succeeded(), eq(dependencies.publish_apps.outputs['publish_apps.new_app.shouldrun'], 'true'), eq('${{ parameters.operationalMode }}', 'Publish'))
  jobs:
  - job: assign_apps
    timeoutInMinutes: 120
    steps:
    - task: DownloadBuildArtifacts@0
      name: download_assign_artifacts
      inputs:
        buildType: 'current'
        downloadType: 'single'
        artifactName: AppsPublishedList
        downloadPath: '$(Build.ArtifactStagingDirectory)'     
    - task: PowerShell@2
      name: assign_app
      displayName: New-AppAssignment
      inputs:
        filePath: 'Scripts/New-AppAssignment.ps1'
        arguments: -TenantID $(TenantID) -ClientID $(ClientID) -ClientSecret $(SP-IntuneAppFactory-ClientSecret)
    - task: DeleteFiles@1
      name: cleanup_artifacts
      inputs:
        SourceFolder: '$(Build.BinariesDirectory)'
        Contents: '**'