Use custom node-gyp for SDL pipeline (#179723)

* Use custom node-gyp
* Avoid using relative cd
* Remove ia32 for Linux
* Bump gulp-atom-electron; unblocks downloading PDBs
* Add native-is-elevated to the scan

build/azure-pipelines/sdl-scan.yml

@@ -85,13 +85,31 @@ stages:
             displayName: CodeQL Initialize
             condition: eq(variables['Codeql.enabled'], 'True')
 
+          - powershell: |
+              mkdir -Force .build/node-gyp
+            displayName: Create custom node-gyp directory
+            condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
+
+          - powershell: |
+              . ../../build/azure-pipelines/win32/exec.ps1
+              $ErrorActionPreference = "Stop"
+              # TODO: Should be replaced with upstream URL once https://github.com/nodejs/node-gyp/pull/2825
+              # gets merged.
+              exec { git clone https://github.com/rzhao271/node-gyp.git . } "Cloning rzhao271/node-gyp failed"
+              exec { git checkout 102b347da0c92c29f9c67df22e864e70249cf086 } "Checking out 102b347 failed"
+              exec { npm install } "Building rzhao271/node-gyp failed"
+            displayName: Install custom node-gyp
+            workingDirectory: .build/node-gyp
+            condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
+
           - powershell: |
               . build/azure-pipelines/win32/exec.ps1
               . build/azure-pipelines/win32/retry.ps1
               $ErrorActionPreference = "Stop"
+              $env:npm_config_node_gyp = "$(Join-Path $pwd.Path '.build/node-gyp/bin/node-gyp.js')"
+              $env:npm_config_arch = "$(NPM_ARCH)"
               retry { exec { yarn --frozen-lockfile --check-files } }
             env:
-              npm_config_arch: "$(NPM_ARCH)"
               PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
               GITHUB_TOKEN: "$(github-distro-mixin-password)"
               CHILD_CONCURRENCY: 1

build/gulpfile.scan.js

@@ -9,7 +9,7 @@ const gulp = require('gulp');
 const path = require('path');
 const task = require('./lib/task');
 const util = require('./lib/util');
-const electron = require('gulp-atom-electron');
+const electron = require('@vscode/gulp-electron');
 const { config } = require('./lib/electron');
 const filter = require('gulp-filter');
 const deps = require('./lib/dependencies');
@@ -21,7 +21,6 @@ const BUILD_TARGETS = [
 	{ platform: 'win32', arch: 'x64' },
 	{ platform: 'win32', arch: 'arm64' },
 	{ platform: 'darwin', arch: null, opts: { stats: true } },
-	{ platform: 'linux', arch: 'ia32' },
 	{ platform: 'linux', arch: 'x64' },
 	{ platform: 'linux', arch: 'armhf' },
 	{ platform: 'linux', arch: 'arm64' },
@@ -81,8 +80,7 @@ function nodeModules(destinationExe, destinationPdb, platform) {
 				// We don't build the prebuilt node files so we don't scan them
 				'!**/prebuilds/**/*.node',
 				// These are 3rd party modules that we should ignore
-				'!**/@parcel/watcher/**/*',
-				'!**/native-is-elevated/**/*']))
+				'!**/@parcel/watcher/**/*']))
 			.pipe(gulp.dest(destinationExe));
 	};
 

build/gulpfile.vscode.js

@@ -191,7 +191,7 @@ function packageTask(platform, arch, sourceFolderName, destinationFolderName, op
 	platform = platform || process.platform;
 
 	return () => {
-		const electron = require('gulp-atom-electron');
+		const electron = require('@vscode/gulp-electron');
 		const json = require('gulp-json-editor');
 
 		const out = sourceFolderName;

build/lib/electron.ts

@@ -193,7 +193,7 @@ export const config = {
 
 function getElectron(arch: string): () => NodeJS.ReadWriteStream {
 	return () => {
-		const electron = require('gulp-atom-electron');
+		const electron = require('@vscode/gulp-electron');
 		const json = require('gulp-json-editor') as typeof import('gulp-json-editor');
 
 		const electronOpts = _.extend({}, config, {