azure-pipelines.yml

name: $(Build.DefinitionName) $(date:yyyyMMdd)$(rev:.r)

stages:
- stage: Build
  jobs:
  - job: Build
    pool:
      vmImage: windows-latest

    variables:
      BuildPlatform: 'Any CPU'
      BuildConfiguration: 'Release'

    steps:
    - task: MSBuild@1
      displayName: 'Build solution'
      inputs:
        solution: '**\DataGridExtensions.sln'
        platform: '$(BuildPlatform)'
        configuration: '$(BuildConfiguration)'
        msbuildArguments: '-restore'
        clean: true

    - task: CopyFiles@2
      displayName: 'Copy Files to: $(build.artifactstagingdirectory)'
      inputs:
        SourceFolder: 'src\DataGridExtensions\bin\$(BuildConfiguration)'
        Contents: '*.nupkg'
        TargetFolder: '$(build.artifactstagingdirectory)'
        CleanTargetFolder: true

    - task: PublishBuildArtifacts@1
      displayName: 'Publish Artifact: BuildPackages'
      inputs:
        PathtoPublish: '$(build.artifactstagingdirectory)'
        ArtifactName: BuildPackages

    - task: PublishBuildArtifacts@1
      displayName: 'Publish Artifact: signing scripts'
      inputs:
        PathtoPublish: 'signing'
        ArtifactName: signing

- stage: CodeSign
  dependsOn: Build
  condition: and(succeeded('Build'), ne(variables['build.reason'], 'PullRequest'))
  jobs:
  - job: CodeSign
    displayName: Code Signing
    pool:
      vmImage: windows-latest # Code signing must run on a Windows agent for Authenticode signing (dll/exe)

    steps:
    # Retreive unsigned artifacts and file list
    - download: current
      artifact: signing
      displayName: Download signing file list

    - download: current
      artifact: BuildPackages
      displayName: Download build artifacts

    - task: CmdLine@2
      displayName: "AntiMalware Scan"
      inputs:
        script: |
          Dir "$(Pipeline.Workspace)\BuildPackages"
          "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$(Pipeline.Workspace)\BuildPackages"
        failOnStderr: true

    # Install the code signing tool
    - task: DotNetCoreCLI@2
      inputs:
        command: custom
        custom: tool
        arguments: install --tool-path . sign --version 0.9.1-beta.23530.1
      displayName: Install SignTool tool

    - pwsh: |
        .\sign code azure-key-vault `
        "**/*.*" `
        --base-directory "$(Pipeline.Workspace)\BuildPackages" `
        --file-list "$(Pipeline.Workspace)\signing\filelist.txt" `
        --publisher-name "tom-englert" `
        --description "DataGrid Extensions" `
        --description-url "https://github.com/dotnet/DataGridExtensions" `
        --azure-key-vault-tenant-id "$(SignTenantId)" `
        --azure-key-vault-client-id "$(SignClientId)" `
        --azure-key-vault-client-secret "$(SignClientSecret2)" `
        --azure-key-vault-certificate "$(SignKeyVaultCertificate)" `
        --azure-key-vault-url "$(SignKeyVaultUrl)"
      displayName: Sign packages

    # Publish the signed packages
    - publish: $(Pipeline.Workspace)/BuildPackages
      displayName: Publish Signed Packages
      artifact: SignedPackages