Merge pull request #486 from github/fixes/485-sign-the-vsix

Sign the VSIX

Author: jcansdale

azure-pipelines.yml

@@ -73,11 +73,6 @@ jobs:
         /p:GitHubVS_ClientId=$(GitHubVS_ClientId)
         /p:GitHubVS_ClientSecret=$(GitHubVS_ClientSecret)
 
-  - task: PublishBuildArtifacts@1
-    inputs:
-      pathToPublish: $(Build.ArtifactStagingDirectory)
-      artifactName: 'vsix'
-
   - task: MSBuild@1
     displayName: GitHub Essentials
     inputs:
@@ -89,6 +84,22 @@ jobs:
         /p:TargetVsixContainer=$(ArtifactDirectory)\GitHub.VisualStudio.16.vsix
         /p:IsProductComponent=$(IsProductComponent)
         /p:DeployExtension=False
+        
+  - task: DownloadSecureFile@1
+    name: vsixsigntool_exe
+    inputs:
+      secureFile: vsixsigntool.exe
+
+  - task: DownloadSecureFile@1
+    name: certificate_pfx
+    inputs:
+      secureFile: certificate.pfx
+
+  - script: $(vsixsigntool_exe.secureFilePath) sign /f $(certificate_pfx.secureFilePath) /p "$(certificate_password)" /sha1 c4fdf13659f49e57ac14774fdf45053f499f185f /fd sha256 /tr http://timestamp.digicert.com /td sha256 $(ArtifactDirectory)\GitHub.VisualStudio.vsix
+    displayName: Sign the GitHub for Visual Studio VSIX
+
+  - script: $(vsixsigntool_exe.secureFilePath) sign /f $(certificate_pfx.secureFilePath) /p "$(certificate_password)" /sha1 c4fdf13659f49e57ac14774fdf45053f499f185f /fd sha256 /tr http://timestamp.digicert.com /td sha256 $(ArtifactDirectory)\GitHub.VisualStudio.16.vsix
+    displayName: Sign the GitHub Essentials VSIX
 
   - task: PublishBuildArtifacts@1
     inputs: