Validate VMR Shipping Packages (#45836)

Author: ellahathaway

eng/pipelines/templates/stages/vmr-build.yml

@@ -895,3 +895,18 @@ stages:
           dotNetBuildPass: final
           primaryDependentJob: Windows_x64
           outputFolder: $(Build.ArtifactStagingDirectory)/artifacts
+  
+### VALIDATION ###
+- ${{ if and(parameters.isBuiltFromVmr, not(parameters.isSourceOnlyBuild), eq(variables['System.TeamProject'], 'internal')) }}:
+  - stage: VMR_Validation
+    displayName: VMR Validation
+    dependsOn: VMR_Final_Join
+    jobs:
+    - job: ValidateSigning
+      displayName: Validate Signing
+      pool: ${{ parameters.pool_Windows }}
+      timeoutInMinutes: 240
+      steps:
+      - template: ../steps/vmr-validate-signing.yml
+        parameters:
+          continueOnError: true

eng/pipelines/templates/steps/vmr-validate-signing.yml

@@ -0,0 +1,26 @@
+parameters:
+- name: continueOnError
+  type: boolean
+  default: false
+
+steps:
+- task: DownloadBuildArtifacts@1
+  inputs:
+    artifactName: 'PackageArtifacts'
+    downloadPath: $(Build.ArtifactStagingDirectory)
+    checkDownloadedFiles: true
+  displayName: Download Package Artifacts
+
+# This is necessary whenever we want to publish/restore to an AzDO private feed
+# Since sdk-task.ps1 tries to restore packages we need to do this authentication here
+# otherwise it'll complain about accessing a private feed.
+- task: NuGetAuthenticate@1
+  displayName: 'Authenticate to AzDO Feeds'
+
+- task: PowerShell@2
+  inputs:
+    filePath: eng\common\sdk-task.ps1
+    arguments: -task SigningValidation -restore -msbuildEngine vs
+      /p:PackageBasePath='$(Build.ArtifactStagingDirectory)/PackageArtifacts'
+  displayName: Validate Signing of Packages
+  continueOnError: ${{ parameters.continueOnError }}