merged main

Author: Michael Koster

.github/workflows/admin-cleanup.yml

@@ -47,6 +47,9 @@ jobs:
   del_runs:
     name: Delete Runs
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
     steps:
       - name: Delete CI workflow runs
         uses: Mattraks/delete-workflow-runs@v2

.github/workflows/codeql.yml

@@ -0,0 +1,111 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '27 8 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ (matrix.language == 'csharp' && 'windows-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: csharp
+          build-mode: manual
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes. This is typically only required for manual builds.
+    - name: Setup MSBuild
+      if: matrix.build-mode == 'manual'
+      uses: microsoft/setup-msbuild@v2
+      with:
+        vs-version: '[17.2,17.15)'
+        msbuild-architecture: x64
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+
+    - name: Run manual build steps
+      if: matrix.build-mode == 'manual'
+      shell: pwsh
+      run: |
+        $ExtensionAssemblyInfoFile = "$env:GITHUB_WORKSPACE\src\Extension\GlobalAssemblyInfo.cs"
+        $ExtensionManifestFile = "$env:GITHUB_WORKSPACE\src\Extension\RemoteDebuggerLauncher\source.extension.vsixmanifest"
+        $ExtensionOutputPath = "$env:GITHUB_WORKSPACE\src\Extension\RemoteDebuggerLauncher\bin\Release"
+        $ExtensionToolsPath =  "$env:GITHUB_WORKSPACE\src\Extension\RemoteDebuggerLauncher\ToolsRemote"
+        $CheckSumProjectPath = "$env:GITHUB_WORKSPACE\src\RemoteTools\CheckSum\exe\CheckSumExe.csproj"
+        $RemoteToolsOutputPath = "$env:GITHUB_WORKSPACE\src\RemoteTools\bin"
+        $ScriptPath = "$env:GITHUB_WORKSPACE\eng\scripts"
+
+        # Fixed version for CodeQL builds
+        $versionPrefix = "0.0.0"
+        $versionBuild = "0"
+        $versionRevision = "0"
+
+        Write-Host 'Apply assembly version 0.0.0'
+        & "$ScriptPath\AssemblyInfoFileSetVersion.ps1" -SourceFilePath $ExtensionAssemblyInfoFile `
+          -VersionPrefix $versionPrefix -VersionBuild $versionBuild -VersionRevision $versionRevision
+
+        Write-Host 'Apply VSIX version 0.0.0'
+        & "$ScriptPath\VsixManifestFileSetVersion.ps1" -SourceFilePath $ExtensionManifestFile -VersionPrefix $versionPrefix
+
+        Write-Host 'Publish Remote Tools (dotnet publish)'
+        dotnet publish $CheckSumProjectPath -c Release --framework net8.0 --runtime linux-x64 -o "$RemoteToolsOutputPath\linux-x64"
+        dotnet publish $CheckSumProjectPath -c Release --framework net8.0 --runtime linux-arm64 -o "$RemoteToolsOutputPath\linux-arm64"
+        dotnet publish $CheckSumProjectPath -c Release --framework net8.0 --runtime linux-arm -o "$RemoteToolsOutputPath\linux-arm"
+        & "$ScriptPath\WriteRemoteToolsVersionJson.ps1" -SourceDirectory $ExtensionToolsPath -Version $versionPrefix
+
+        Write-Host 'NuGet restore for extension solution'
+        msbuild "RemoteDebuggerLauncherExtension.sln" /t:Restore /p:Configuration=Release
+
+        Write-Host 'Rebuild extension solution'
+        msbuild "RemoteDebuggerLauncherExtension.sln" /t:Rebuild /p:Configuration=Release
+
+        Write-Host 'Build all sample solutions with dotnet build'
+        $sampleSolutions = Get-ChildItem -Path "$env:GITHUB_WORKSPACE\samples" -Recurse -Filter "*.sln" | Where-Object { $_.Name -notlike "*.sln.GhostDoc*" }
+        foreach ($sln in $sampleSolutions) {
+          Write-Host "Restoring and building sample solution: $($sln.FullName)"
+          dotnet restore "$($sln.FullName)"
+          dotnet build "$($sln.FullName)" -c Release --no-restore
+        }
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/project-ci.yml

@@ -5,13 +5,20 @@ on:
       - 'feature/**'
       - 'bugfix/**'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   build:
     name: CI Build
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/shared-build.yml
     with:
-      store-artifacts: false
+      store-artifacts: false
+      environment: CI

.github/workflows/project-release.yml

@@ -14,14 +14,20 @@ concurrency:
 jobs:
   build:
     name: Release Build
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/shared-build.yml
     with:
       store-artifacts: true
       sign-vsix: true
+      environment: Release
+      azure-timestamp-url: ${{ vars.AZURE_TIMESTAMP_URL }}
     secrets:
-      SIGNING_CERT_PFX: ${{ secrets.SIGNING_CERT_PFX }}
-      SIGNING_CERT_PASSWORD: ${{ secrets.SIGNING_CERT_PASSWORD }}
-      SIGNING_CERT_THUMBPRINT: ${{ secrets.SIGNING_CERT_THUMBPRINT }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_KEYVAULT_URL: ${{ secrets.AZURE_KEYVAULT_URL }}
+      AZURE_KEYVAULT_CERT_NAME: ${{ secrets.AZURE_KEYVAULT_CERT_NAME }}
 
   github-release:
     name: GitHub Release
@@ -59,11 +65,12 @@ jobs:
     name: VS Marketplace Release
     runs-on: windows-2022
     needs: build
+    permissions: {}
     if: ${{ github.ref_type == 'tag' }}
 
     env:
       MarketplaceOverviewFile: ${{ github.workspace }}/src/ReleaseNotes.md
 
     steps:
     - name: TODO
-      run: echo TODO
+      run: echo TODO

.github/workflows/shared-build.yml

@@ -1,5 +1,9 @@
 name: Shared Build
 
+permissions:
+  contents: read
+  id-token: write
+
 on:
   workflow_call:
     inputs:
@@ -23,15 +27,27 @@ on:
         type: string
         required: false
         default: 'RemoteDebuggerLauncherExtension.sln'
+      environment:
+        description: 'The GitHub Environment to use'
+        type: string
+        required: true
+      azure-timestamp-url:
+        description: 'The Timestamp URL for code signing'
+        type: string
+        required: false
+        default: ''
     secrets:
-      SIGNING_CERT_PFX: 
-        description: The Base64 encoded PFX file
+      AZURE_CLIENT_ID:
+        description: 'The Azure Client ID for authentication'
+        required: false
+      AZURE_TENANT_ID:
+        description: 'The Azure Tenant ID for authentication'
         required: false
-      SIGNING_CERT_PASSWORD: 
-        description: The password for the PFX file
+      AZURE_KEYVAULT_URL:
+        description: 'The Azure Key Vault URL for code signing'
         required: false
-      SIGNING_CERT_THUMBPRINT:
-        description: The cert footprint
+      AZURE_KEYVAULT_CERT_NAME:
+        description: 'The Azure Key Vault Certificate Name for code signing'
         required: false
 
 jobs:
@@ -54,20 +70,26 @@ jobs:
       with:
         fetch-depth: 0
 
-    # setup MSBUILD and VS
+    # setup MSBUILD and Visual Studio
     - name: Add MSBUILD to PATH
       id: msbuild
       uses: microsoft/setup-msbuild@v2
       with:
-        vs-version: '[17.2,17.15)'
+        vs-version: '[17.2,18)'
         msbuild-architecture: x64
 
+    # Install .NET Sign Tool from NuGet
+    - name: 'Setup: Install .NET Sign Tool'
+      if:  ${{ inputs.store-artifacts && inputs.sign-vsix }}
+      run: dotnet tool install --global --prerelease sign
+      shell: pwsh
+
     # Build Solution: determine and apply the version for the assemblies and VSIX package
     - name: 'Build Solution: Determine Version'
       id: git-version
       uses: ./eng/actions/git-version
 
-      # apply dev versions on pushes to any other branches
+    # apply dev versions on pushes to any other branches
     - name: 'Build Solution: Apply assembly version DEV'
       if: ${{ github.ref_type == 'branch' && github.ref != 'refs/heads/main' }}
       run:  ${{ env.ScriptPath }}\AssemblyInfoFileSetVersion.ps1 -SourceFilePath  ${{ env.ExtensionAssemblyInfoFile }}
@@ -77,7 +99,7 @@ jobs:
         -VersionBuild ${{ steps.git-version.outputs.versionBuild }}
       shell: pwsh
 
-      # apply prod versions on pushes to the main branch or a tag gets created
+    # apply prod versions on pushes to the main branch or a tag gets created
     - name: 'Build Solution: Apply assembly version PROD'
       if: ${{ (github.ref_type == 'branch' && github.ref == 'refs/heads/main') || github.ref_type == 'tag' }}
       run:  ${{ env.ScriptPath }}\AssemblyInfoFileSetVersion.ps1 -SourceFilePath  ${{ env.ExtensionAssemblyInfoFile }}
@@ -98,37 +120,38 @@ jobs:
        ${{ env.ScriptPath }}\WriteRemoteToolsVersionJson.ps1 -SourceDirectory ${{ env.ExtensionToolsPath }} -Version ${{ steps.git-version.outputs.versionPrefix }}
       shell: pwsh
 
-
     # Build Solution: restore NuGet Packages
     - name: 'Build Solution: NuGet restore'
       id: nuget-restore
       run: msbuild ${{ inputs.solution-path }} /t:Restore /p:Configuration=${{ inputs.configuration }}
       shell: pwsh
 
-    # Build Solution: creates PFX file from BASE64 secret if signing is enabled
-    - name: 'Build Solution: prepare VSIX signing'
-      if:  ${{ inputs.store-artifacts && inputs.sign-vsix }}
-      run: |
-        $encodedBytes = "${{ secrets.SIGNING_CERT_PFX }}"
-        [convert]::FromBase64String($encodedBytes) | Set-Content -Path ${{ runner.temp }}\cert.pfx -Encoding Byte
-      shell: powershell
-
-    # Build Solution: Rebuild, and signs VSIX if cert file is present
-    - name: 'Build Solution: Rebuild and sign'
+    # Build Solution: Rebuild
+    - name: 'Build Solution: Rebuild'
       id: build
       run: msbuild ${{ inputs.solution-path }} /t:Rebuild /p:Configuration=${{ inputs.configuration }}
       shell: pwsh
-      env:
-        SIGNING_CERT_FILE: ${{ runner.temp }}\cert.pfx
-        SIGNING_CERT_PASSWORD: ${{ secrets.SIGNING_CERT_PASSWORD }}
-        SIGNING_CERT_THUMBPRINT: ${{ secrets.SIGNING_CERT_THUMBPRINT }}
-        SIGNING_TIMESTAMP_SERVER: 'http://timestamp.sectigo.com'
 
-    - name: 'Build Solution: VSIX signing cleanup'
-      if:  ${{ inputs.store-artifacts && inputs.sign-vsix }}
-      run: |
-        Remove-Item -Path ${{ runner.temp }}\cert.pfx -ErrorAction Continue
+    # Login to Azure using a ServicePrincipal configured to authenticate against a GitHub Action
+    - name: 'Build: Azure CLI login'
+      if: ${{ inputs.store-artifacts && inputs.sign-vsix }}
+      uses: azure/login@v2
+      with:
+        allow-no-subscriptions: true
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+    
+    - name: 'Build: Sign VSIX'
+      if: ${{ inputs.store-artifacts && inputs.sign-vsix }}
       shell: pwsh
+      run: >
+        sign code azure-key-vault
+        *.vsix
+        --base-directory ${{ env.ExtensionOutputPath }}
+        --azure-credential-type "azure-cli"
+        --azure-key-vault-url "${{ secrets.AZURE_KEYVAULT_URL }}"
+        --azure-key-vault-certificate "${{ secrets.AZURE_KEYVAULT_CERT_NAME }}"
+        --timestamp-url "${{ inputs.azure-timestamp-url }}"
 
     - name: 'Store Artifacts: VSIX'
       uses: actions/upload-artifact@v4