azure-pipelines.yml

trigger:
- main
- rel/*

pr:
- main
- rel/*

stages:
- stage: Build
  jobs:
  - job: Build
    pool:
      vmImage: windows-latest

    variables: 
      BuildConfiguration: Release
      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true

    steps:
    - task: UseDotNet@2
      inputs:
        packageType: sdk
        useGlobalJson: true
      displayName: 'Use .NET SDK'

    - script: dotnet tool restore
      displayName: Install dotnet tools

    - script: dotnet nbgv cloud
      displayName: Set Version

    - script: dotnet test dirs.proj
      displayName: Test

    - script: dotnet pack dirs.proj
      displayName: Create package(s)

    - publish: $(Build.ArtifactStagingDirectory)/Packages
      displayName: Publish build packages
      artifact: BuildPackages

# Keep signing variables in a separate stage
- stage: CodeSign
  condition: and(succeeded('Build'), not(eq(variables['build.reason'], 'PullRequest')))
  jobs:
  - job: CodeSign
    displayName: Code Signing
    pool:
      vmImage: windows-latest
    variables:
    - group: SignTool-DNF

    steps:
    - download: current
      artifact: BuildPackages

    - task: UseDotNet@2
      inputs:
        packageType: sdk
        useGlobalJson: true
      displayName: 'Use .NET SDK'

    - script: dotnet tool restore
      displayName: Install dotnet tools

    - pwsh: |
        dotnet sign code azure-key-vault `
        "**/*.nupkg" `
        --base-directory "$(Pipeline.Workspace)/BuildPackages" `
        --file-list "$(Build.SourcesDirectory)/config/filelist.txt" `
        --publisher-name "DotNet.ReproducibleBuilds" `
        --description "DotNet.ReproducibleBuilds" `
        --description-url "https://github.com/dotnet/reproducible-builds" `
        --azure-key-vault-tenant-id "$(SignTenantId)" `
        --azure-key-vault-client-id "$(SignClientId)" `
        --azure-key-vault-client-secret '$(SignClientSecret)' `
        --azure-key-vault-certificate "$(SignKeyVaultCertificate)" `
        --azure-key-vault-url "$(SignKeyVaultUrl)"
      displayName: Sign packages

    - publish: $(Pipeline.Workspace)/BuildPackages
      displayName: Publish Signed Packages
      artifact: SignedPackages