azure-pipelines-release.yml

trigger: none
pr: none

# Use an internally approved MS host for building, signing, and SBOM generation
pool:
  name: '1ES-Hosted-DurableTaskFramework'
  demands:
    - ImageOverride -equals MMS2022TLS

parameters:
- name: binlog
  displayName: MSBuild binary log
  type: boolean
  default: false

variables:
  project: 'src/dirs.proj'
  bin_dir: 'out/bin'
  log_dir: 'out/log'
  pkg_dir: 'out/pkg'
  build_args: -c release -p:FileVersionRevision=$(Build.BuildId) -p:ContinuousIntegrationBuild=true
  ${{ if parameters.binlog }}:
    build_binlog: -bl:$(log_dir)/build.binlog
    pack_binlog: -bl:$(log_dir)/pack.binlog
  ${{ else }}:
    build_binlog: ''
    pack_binlog: ''

steps:
- checkout: self
  submodules: true

- task: UseDotNet@2
  displayName: 'Install .NET 6 SDK (ESRP)' # This is needed for ESRP.
  inputs:
    packageType: 'sdk'
    version: '6.x'

- task: UseDotNet@2
  displayName: 'Install .NET SDK (Build)' # This is needed for the build.
  inputs:
    packageType: 'sdk'
    useGlobalJson: true

# Start by restoring all the dependencies. This needs to be its own task.
- task: DotNetCoreCLI@2
  displayName: Restore
  inputs:
    command: restore
    verbosityRestore: Minimal
    projects: $(project)
    feedsToUse: config
    nugetConfigPath: nuget.config

# Build source directory
- task: DotNetCoreCLI@2
  displayName: Build
  inputs:
    command: build
    arguments: --no-restore $(build_args) $(build_binlog)
    projects: $(project)

# Authenticode sign all the DLLs with the Microsoft certificate.
# This appears to be an in-place signing job, which is convenient.
- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@2
  displayName: 'ESRP CodeSigning: Authenticode'
  inputs:
    ConnectedServiceName: 'ESRP Service'
    FolderPath: $(bin_dir)
    Pattern: 'Microsoft.DurableTask.*.dll'
    signConfigType: inlineSignParams
    inlineOperation: |
      [
        {
            "KeyCode": "CP-230012",
            "OperationCode": "SigntoolSign",
            "Parameters": {
                "OpusName": "Microsoft",
                "OpusInfo": "http://www.microsoft.com",
                "FileDigest": "/fd \"SHA256\"",
                "PageHash": "/NPH",
                "TimeStamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
            },
            "ToolName": "sign",
            "ToolVersion": "1.0"
          },
          {
              "KeyCode": "CP-230012",
              "OperationCode": "SigntoolVerify",
              "Parameters": {},
              "ToolName": "sign",
              "ToolVersion": "1.0"
          }
      ]

# SBOM generator task for additional supply chain protection
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
  displayName: 'SBOM Manifest Generator'
  inputs:
    BuildDropPath: '$(System.DefaultWorkingDirectory)'

# Packaging needs to be a separate step from build.
# This will automatically pick up the signed DLLs.
- task: DotNetCoreCLI@2
  displayName: Pack
  inputs:
    command: custom
    custom: pack
    arguments: --no-build $(build_args) $(pack_binlog)
    projects: $(project)

# Digitally sign all the nuget packages with the Microsoft certificate.
# This appears to be an in-place signing job, which is convenient.
- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@2
  displayName: 'ESRP CodeSigning: Nupkg'
  inputs:
    ConnectedServiceName: 'ESRP Service'
    FolderPath: $(pkg_dir)
    Pattern: '*.nupkg'
    signConfigType: inlineSignParams
    inlineOperation: |
      [
        {
          "KeyCode": "CP-401405",
          "OperationCode": "NuGetSign",
          "Parameters": {},
          "ToolName": "sign",
          "ToolVersion": "1.0"
        },
        {
          "KeyCode": "CP-401405",
          "OperationCode": "NuGetVerify",
          "Parameters": {},
          "ToolName": "sign",
          "ToolVersion": "1.0"
        }
      ]

# Make the nuget packages available for download in the ADO portal UI
- publish: $(pkg_dir)
  displayName: 'Publish packages to Artifacts'
  artifact: pkg

- publish: $(log_dir)
  condition: eq('${{ parameters.binlog }}', true)
  displayName: 'Publish logs to Artifacts'
  artifact: log