Skip to content

Commit 27fb194

Browse files
mjcheethammjcheetham
committed
.azure-pipelines/release.yml: add Windows release pipeline
Add a release pipeline for Windows using Azure Pipelines. ESRP code signing is currently incomplete, and not enabled by default. This pipeline uses internal Microsoft 1ES templates. Signed-off-by: Matthew John Cheetham <[email protected]>
1 parent dfa3b49 commit 27fb194

File tree

1 file changed

+157
-0
lines changed

1 file changed

+157
-0
lines changed

‎.azure-pipelines/release.yml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
name: Release-$(Date:yyyyMMdd)$(Rev:.r)
2+
trigger: none
3+
pr: none
4+
5+
resources:
6+
repositories:
7+
- repository: 1ESPipelines
8+
type: git
9+
name: 1ESPipelineTemplates/1ESPipelineTemplates
10+
ref: refs/tags/release
11+
12+
parameters:
13+
- name: 'esrp'
14+
type: boolean
15+
default: false
16+
displayName: 'Enable ESRP code signing'
17+
18+
variables:
19+
- name: 'esrpConnectionName'
20+
value: 'ESRP-1ESGitClient'
21+
- name: 'esrpEndpointUrl'
22+
value: 'https://api.esrp.microsoft.com/api/v2'
23+
- name: 'esrpClientId'
24+
value: 'TODO'
25+
- name: 'esrpTenantId'
26+
value: 'TODO'
27+
- name: 'esrpAuthAkvName'
28+
value: 'TODO'
29+
- name: 'esrpAuthCertName'
30+
value: 'TODO'
31+
- name: 'esrpAuthSignCertName'
32+
value: 'TODO'
33+
34+
extends:
35+
template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelines
36+
parameters:
37+
stages:
38+
- stage: windows
39+
displayName: 'Windows'
40+
jobs:
41+
- job: win_x86_build
42+
displayName: 'Windows Build and Sign (x86)'
43+
pool:
44+
name: GitClient-1ESHostedPool-intel-pc
45+
image: win-x86_64-ado1es
46+
os: windows
47+
templateContext:
48+
outputs:
49+
- output: pipelineArtifact
50+
targetPath: '$(Build.ArtifactStagingDirectory)/payload'
51+
artifactName: 'win-x86_payload'
52+
- output: pipelineArtifact
53+
targetPath: '$(Build.ArtifactStagingDirectory)/installers'
54+
artifactName: 'win-x86_installers'
55+
steps:
56+
- checkout: self
57+
- task: UseDotNet@2
58+
displayName: 'Use .NET 8 SDK'
59+
inputs:
60+
packageType: sdk
61+
version: '8.x'
62+
- task: PowerShell@2
63+
displayName: 'Build payload'
64+
inputs:
65+
pwsh: true
66+
targetType: filePath
67+
filePath: '.\src\windows\Installer.Windows\layout.ps1'
68+
arguments: |
69+
-Configuration Release `
70+
-Output $(Build.ArtifactStagingDirectory)\payload `
71+
-SymbolOutput $(Build.ArtifactStagingDirectory)\symbols
72+
- task: EsrpCodeSigning@5
73+
condition: and(succeeded(), eq('${{ parameters.esrp }}', true))
74+
displayName: 'Sign payload'
75+
inputs:
76+
connectedServiceName: '$(esrpConnectionName)'
77+
appRegistrationClientId: '$(esrpClientId)'
78+
appRegistrationTenantId: '$(esrpTenantId)'
79+
authAkvName: '$(esrpAuthAkvName)'
80+
authCertName: '$(esrpAuthCertName)'
81+
authSignCertName: '$(esrpAuthSignCertName)'
82+
serviceEndpointUrl: '$(esrpEndpointUrl)'
83+
folderPath: '$(Build.ArtifactStagingDirectory)\payload'
84+
pattern: '**\*.exe;**\*.dll'
85+
signConfigType: inlineSignParams
86+
inlineOperation: |
87+
[
88+
{
89+
"keyCode": "TODO",
90+
"operationCode": "SigntoolSign"
91+
"parameters": {
92+
"OpusName": "Microsoft",
93+
"OpusInfo": "http://microsoft.com",
94+
"FileDigest": "/fd \"SHA256\"",
95+
"PageHash": "/NPH",
96+
"Timestamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
97+
},
98+
"toolName": "sign",
99+
"toolVersion": "1.0"
100+
},
101+
{
102+
"keyCode": "TODO",
103+
"operationCode": "SigntoolVerify",
104+
"parameters": {},
105+
"toolName": "sign",
106+
"toolVersion": "1.0"
107+
}
108+
]
109+
- task: PowerShell@2
110+
displayName: 'Build installers'
111+
inputs:
112+
pwsh: true
113+
targetType: inline
114+
script: |
115+
dotnet build '.\src\windows\Installer.Windows\Installer.Windows.csproj' `
116+
--configuration Release `
117+
--no-dependencies `
118+
-p:NoLayout=true `
119+
-p:PayloadPath="$(Build.ArtifactStagingDirectory)\payload"
120+
-p:OutputPath="$(Build.ArtifactStagingDirectory)\installers"
121+
- task: EsrpCodeSigning@5
122+
condition: and(succeeded(), eq('${{ parameters.esrp }}', true))
123+
displayName: 'Sign installers'
124+
inputs:
125+
connectedServiceName: '$(esrpConnectionName)'
126+
appRegistrationClientId: '$(esrpClientId)'
127+
appRegistrationTenantId: '$(esrpTenantId)'
128+
authAkvName: '$(esrpAuthAkvName)'
129+
authCertName: '$(esrpAuthCertName)'
130+
authSignCertName: '$(esrpAuthSignCertName)'
131+
serviceEndpointUrl: '$(esrpEndpointUrl)'
132+
folderPath: '$(Build.ArtifactStagingDirectory)\installers'
133+
pattern: '**\*.exe'
134+
signConfigType: inlineSignParams
135+
inlineOperation: |
136+
[
137+
{
138+
"keyCode": "TODO",
139+
"operationCode": "SigntoolSign"
140+
"parameters": {
141+
"OpusName": "Microsoft",
142+
"OpusInfo": "http://microsoft.com",
143+
"FileDigest": "/fd \"SHA256\"",
144+
"PageHash": "/NPH",
145+
"Timestamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
146+
},
147+
"toolName": "sign",
148+
"toolVersion": "1.0"
149+
},
150+
{
151+
"keyCode": "TODO",
152+
"operationCode": "SigntoolVerify",
153+
"parameters": {},
154+
"toolName": "sign",
155+
"toolVersion": "1.0"
156+
}
157+
]

0 commit comments

Comments
 (0)