azure-pipelines.yml

trigger: none
#  branches:
#    include:
#    - master

parameters:
  - name: forceCodeSign
    type: boolean
    default: false
  - name: simulateCodeSigningError # Simulate a code signing error to ensure PublishArtifacts is skipped when CodeSigning fails
    type: boolean
    default: false

variables:
- name: CodeQL.Enabled
  value: true
- group: EPS.ESRPSigningProdAME # Mseng -> Library -> EsrpSigningProd
- name: IsMainBranchBuild
  value: eq(variables['Build.SourceBranchName'], 'master')

resources:
  repositories:
  - repository: 1ESPipelineTemplates
    type: git
    name: 1ESPipelineTemplates/1ESPipelineTemplates
    ref: refs/tags/release

extends:
  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
  parameters:
    settings:
      networkIsolationPolicy: Monitored.Unrestricted,CFSClean,CFSClean2,CFSClean3,GitHub
    sdl:
      sourceAnalysisPool:
        name: 1ESPtTfsAgentBuildPoolSDL
    pool:
      name: 1ESPtTfsAgentBuildPool1
    customBuildTags:
    - ES365AIMigrationTooling
    - 1ES-AzureExtensions
    - SecureExtensionOnboarding

    stages:
    - template: templates/build-and-test.yml

    - stage: CodeSigning
      condition: or(eq(variables['IsMainBranchBuild'], 'true'), ${{ eq(parameters.forceCodeSign, 'true') }}, ${{ eq(parameters.simulateCodeSigningError, 'true') }})
      dependsOn: BuildAndTest
      jobs:
      - job: CodeSigningJob
        displayName: ESRP CodeSigning
        templateContext:
          outputs:
          - output: pipelineArtifact
            displayName: 'Publish Artifact: vsix'
            targetPath: '$(System.ArtifactsDirectory)'
            artifactName: vsix
        steps:
        - download: current
          artifact: vsix-unsigned
          displayName: Download Artifact
        - script: |
            echo "Simulated error in CodeSigning step."
            exit 1
          displayName: Simulate CodeSigning Error
          condition: ${{ eq(parameters.simulateCodeSigningError, 'true') }}
        - task: CopyFiles@2
          displayName: 'Copy Files to: $(System.DefaultWorkingDirectory)'
          inputs:
            SourceFolder: '$(Pipeline.Workspace)\vsix-unsigned'
            Contents: '*.vsix'
            TargetFolder: $(System.DefaultWorkingDirectory)             
        - task: EsrpCodeSigning@5
          displayName: ESRP CodeSigning
          inputs:
            ConnectedServiceName: '$(Control.EsrpServiceConnectionName.GH)'
            AppRegistrationClientId: '$(Control.AppRegistrationClientId)'
            AppRegistrationTenantId: '$(Control.AppRegistrationTenantId)'
            AuthAKVName: '$(Control.AuthAKVName)'
            AuthCertName: '$(Control.AuthCertName)'
            AuthSignCertName: '$(Control.AuthSignCertName)'
            FolderPath: $(System.DefaultWorkingDirectory)
            Pattern: '*.vsix'
            signConfigType: inlineSignParams
            inlineOperation: |-
              [ 
                {
                  "KeyCode": "CP-500813",
                  "OperationCode": "AdoExtensionSign",
                  "ToolName": "sign",
                  "ToolVersion": "1.0",
                  "Parameters": {}
                },
                {
                  "KeyCode": "CP-500813",
                  "OperationCode": "AdoExtensionVerify",
                  "ToolName": "sign",
                  "ToolVersion": "1.0",
                  "Parameters": {}
                }
              ]
            SessionTimeout: 30
        - task: CopyFiles@2
          name: CopyFiles_5
          displayName: 'Copy Files to: $(System.ArtifactsDirectory)'
          inputs:
            Contents: '*.vsix'
            TargetFolder: $(System.ArtifactsDirectory)

    - stage: ValidateTfxInstallerCFS
      displayName: Validate TfxInstaller CFS routing
      trigger: manual
      jobs:
      - job: ValidateTfxInstallerCFSJob
        displayName: Install tfx-cli without publishing
        steps:
          - checkout: self

          - task: UseNode@1
            displayName: 'Install Node.js'
            inputs:
              version: '20.19.4'

          - task: NpmAuthenticate@0
            displayName: Authenticate npm feed
            inputs:
              workingFile: .npmrc

          - task: TfxInstaller@5
            displayName: Install tfx-cli through CFS
            inputs:
              version: 'v0.21.1'
            env:
              NPM_CONFIG_REGISTRY: https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/
              NPM_CONFIG_USERCONFIG: $(Build.SourcesDirectory)/.npmrc

          - script: tfx --version
            displayName: Verify tfx-cli installation

    - stage: TestPublishToMarketplace
      trigger: manual      
      jobs:
      - job: PublishMarketplateJob
        displayName: Test - Publish to private Marketplace
        steps:
          - checkout: self

          - download: current
            artifact: vsix
            displayName: Download Signed Artifact

          - task: UseNode@1
            displayName: 'Install Node.js'
            inputs:
              version: '20.19.4'

          - task: NpmAuthenticate@0
            displayName: Authenticate npm feed
            inputs:
              workingFile: .npmrc

          - task: TfxInstaller@5
            inputs:
              version: 'v0.21.1'
            env:
              NPM_CONFIG_REGISTRY: https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/
              NPM_CONFIG_USERCONFIG: $(Build.SourcesDirectory)/.npmrc

          - task: 1ES.PublishAzureDevOpsExtension@1
            displayName: 'Publish the dev private extension to ms-vsclient'
            inputs:
              connectTo: 'AzureRM'
              connectedServiceNameAzureRM: '1es-extensions-publication-secure-service-connection'
              fileType: 'vsix'
              vsixFile: '$(Pipeline.Workspace)/vsix/ms-vsclient.google-play-dev-*.vsix'
              targetPath: '$(Pipeline.Workspace)/vsix'
              validateExtension: false
              useV5: true

    - stage: ProdPublishToMarketplace
      trigger: manual
      jobs:
      - job: PublishMarketplateJob
        displayName: Prod - Publish to Marketplace
        steps:
          - checkout: self

          - download: current
            artifact: vsix
            displayName: Download Signed Artifact

          - task: UseNode@1
            displayName: 'Install Node.js'
            inputs:
              version: '20.19.4'

          - task: NpmAuthenticate@0
            displayName: Authenticate npm feed
            inputs:
              workingFile: .npmrc

          - task: TfxInstaller@5
            inputs:
              version: 'v0.21.1'
            env:
              NPM_CONFIG_REGISTRY: https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/
              NPM_CONFIG_USERCONFIG: $(Build.SourcesDirectory)/.npmrc

          - task: 1ES.PublishAzureDevOpsExtension@1
            displayName: 'Publish the production extension to ms-vsclient'
            inputs:
              connectTo: 'AzureRM'
              connectedServiceNameAzureRM: '1es-extensions-publication-secure-service-connection'
              fileType: 'vsix'
              vsixFile: '$(Pipeline.Workspace)/vsix/ms-vsclient.google-play-[0-9]*.vsix'
              targetPath: '$(Pipeline.Workspace)/vsix'
              validateExtension: false
              useV5: true