Enable code signing with Azure Trusted Signing

azure-pipelines.yml

@@ -1,7 +1,8 @@
-# .NET Desktop
-# Build and run tests for .NET Desktop or Windows classic desktop solutions.
-# Add steps that publish symbols, save build artifacts, and more:
-# https://docs.microsoft.com/azure/devops/pipelines/apps/windows/dot-net
+parameters:
+- name: Sign
+  displayName: Sign
+  type: boolean
+  default: false
 
 trigger:
 - master
@@ -10,35 +11,101 @@ pool:
   vmImage: 'windows-2022'
 
 variables:
-  solution: 'src/IndentGuide.sln'
-  buildPlatform: 'Any CPU'
-  buildConfiguration: 'Release'
+- ${{ if eq(parameters.Sign, 'true') }}:
+  - group: IndentGuideSigning
+- name: buildPlatform
+  value: 'Any CPU'
+- name: buildConfiguration
+  value: 'Release'
+- name: IntermediateOutputPath
+  value: '$(Build.BinariesDirectory)\obj'
+- name: OutputPath
+  value: '$(Build.BinariesDirectory)\bin'
+- name: Drop
+  value: '$(Build.ArtifactStagingDirectory)\drop'
 
 steps:
 - task: NuGetToolInstaller@0
+  displayName: 'Update Nuget'
 
 - task: NuGetCommand@2
+  displayName: 'Restore Nuget dependencies'
   inputs:
-    restoreSolution: '$(solution)'
+    restoreSolution: 'src/IndentGuide.sln'
 
 - task: VSBuild@1
+  displayName: 'Build'
   inputs:
-    solution: '$(solution)'
+    solution: 'src/IndentGuide.sln'
     platform: '$(buildPlatform)'
     configuration: '$(buildConfiguration)'
+    msbuildArgs: '/p:CreateVsixContainer=false'
 
 - task: VisualStudioTestPlatformInstaller@1
+  displayName: 'Install test platform'
   inputs:
     packageFeedSelector: 'nugetOrg'
     versionSelector: 'latestPreRelease'
 
 - task: VSTest@2
+  displayName: 'Run tests'
   inputs:
     platform: '$(buildPlatform)'
     configuration: '$(buildConfiguration)'
     vsTestVersion: 'toolsInstaller'
 
-- task: PublishPipelineArtifact@0
+- ${{ if eq(parameters.Sign, 'true') }}:
+  - task: TrustedSigning@0
+    displayName: 'Sign binaries'
+    inputs:
+      AzureTenantID: '$(Sign.AzureTenantID)'
+      AzureClientID: '$(Sign.AzureClientID)'
+      AzureClientSecret: '$(Sign.AzureClientSecret)'
+      Endpoint: '$(Sign.EndPoint)'
+      CodeSigningAccountName: '$(Sign.CodeSigningAccountName)'
+      CertificateProfileName: '$(Sign.CertificateProfileName)'
+      FilesFolder: '$(IntermediateOutputPath)'
+      FilesFolderFilter: 'dll'
+      FilesFolderRecurse: true
+      FilesFolderDepth: 2
+      FileDigest: 'SHA256'
+      TimestampRfc3161: 'http://timestamp.acs.microsoft.com'
+      TimestampDigest: 'SHA256'
+
+- task: VSBuild@1
+  displayName: 'Build vsix package'
   inputs:
-    artifactName: 'bin'
-    targetPath: 'src/bin'
+    solution: 'src/IndentGuide.csproj'
+    platform: '$(buildPlatform)'
+    configuration: '$(buildConfiguration)'
+    msbuildArgs: '/t:CreateVsixContainer /p:OutDir="$(OutputPath)"'
+
+- ${{ if eq(parameters.Sign, 'true') }}:
+  - task: TrustedSigning@0
+    displayName: 'Sign vsix'
+    inputs:
+      AzureTenantID: '$(Sign.AzureTenantID)'
+      AzureClientID: '$(Sign.AzureClientID)'
+      AzureClientSecret: '$(Sign.AzureClientSecret)'
+      Endpoint: '$(Sign.EndPoint)'
+      CodeSigningAccountName: '$(Sign.CodeSigningAccountName)'
+      CertificateProfileName: '$(Sign.CertificateProfileName)'
+      FilesFolder: '$(OutputPath)'
+      FilesFolderFilter: 'vsix'
+      FilesFolderRecurse: true
+      FilesFolderDepth: 2
+      FileDigest: 'SHA256'
+      TimestampRfc3161: 'http://timestamp.acs.microsoft.com'
+      TimestampDigest: 'SHA256'
+
+- powershell: |
+    copy "$(OutputPath)\*.vsix" (mkdir "$(Drop)" -Force)
+  displayName: 'Copy VSIX to drop'
+
+- publish: $(Drop)
+  artifact: drop
+  displayName: 'Publish drop'
+
+- publish: $(OutputPath)
+  artifact: bin
+  displayName: 'Publish bin'

src/IndentGuide.csproj

@@ -289,7 +289,6 @@
   </PropertyGroup>
   <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
   <Import Project="$(VSToolsPath)\VSSDK\Microsoft.VsSDK.targets" Condition="'$(VSToolsPath)' != ''" />
-  <Import Project="$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VSTarget)\VSSDK\Microsoft.VsSDK.targets" Condition="false" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">