release_build.yaml

pool:
  name: Hosted Windows 2019 with VS2019
  #demands: npm

variables:
  BuildConfiguration: 'release'
  Codeql.Enabled: true
  Codeql.Language: csharp

steps:

# required for the signing task, but should not be used for the entire build
- task: UseDotNet@2
  displayName: 'Use .NET Core SDK 2.1.x'
  inputs:
    version: 2.1.x

# Use latest SDK for build
- task: UseDotNet@2
  displayName: 'Use .NET SDK 6.x'
  inputs:
    version: 6.x

- task: securedevelopmentteam.vss-secure-development-tools.build-task-policheck.PoliCheck@2
  displayName: 'Run PoliCheck'
  inputs:
    targetType: F

- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@3
  displayName: 'Run CredScan'
  inputs:
    suppressionsFile: 'build/credscan-exclusion.json'
    outputFormat: pre
    debugMode: false

- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
  displayName: 'Post Analysis'
  inputs:
    GdnBreakGdnToolCredScan: true
    GdnBreakGdnToolPoliCheck: true

- task: DotNetCoreCLI@2
  displayName: 'Build solution'
  inputs:
    arguments: '-c $(BuildConfiguration) /p:ClientSemVer=$(ClientSemVer) /p:SourceLinkCreate=true /p:ContinousIntegrationBuild=true'

- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
  displayName: 'Sign Binaries'
  inputs:
    ConnectedServiceName: 'IDDP Code Signing'
    FolderPath: '$(Build.SourcesDirectory)\src'
    Pattern: '**\bin\**\*.dll'
    UseMinimatch: true
    signConfigType: inlineSignParams
    inlineOperation: |
     [
       {
         "keyCode": "CP-230012",
         "operationSetCode": "SigntoolSign",
         "parameters": [
         {
           "parameterName": "OpusName",
           "parameterValue": "Microsoft.Identity.Client.Extensions.Msal"
         },
         {
           "parameterName": "OpusInfo",
           "parameterValue": "https://www.nuget.org/packages/Microsoft.Identity.Client.Extensions.Msal/"
         },
         {
           "parameterName": "PageHash",
           "parameterValue": "/NPH"
         },
         {
           "parameterName": "FileDigest",
           "parameterValue": "/fd sha256"
         },
         {
           "parameterName": "TimeStamp",
           "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
         }
         ],
         "toolName": "signtool.exe",
         "toolVersion": "6.2.9304.0"
       },
       {
         "keyCode": "CP-230012",
         "operationSetCode": "SigntoolVerify",
         "parameters": [ ],
         "toolName": "signtool.exe",
         "toolVersion": "6.2.9304.0"
       }
     ]
    SessionTimeout: 20

- task: securedevelopmentteam.vss-secure-development-tools.build-task-binskim.BinSkim@4
  displayName: 'Run BinSkim '
  inputs:
    InputType: Basic
    AnalyzeTargetGlob: '$(Build.SourcesDirectory)\src\**\bin\**\*.dll'
    AnalyzeVerbose: true
    AnalyzeHashes: true

- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
  displayName: 'Check BinSkim Results'
  inputs:
    GdnBreakGdnToolBinSkim: true

- task: DotNetCoreCLI@2
  displayName: Pack projects
  inputs:
    command: pack
    packagesToPack: 'src/**/*.csproj'
    nobuild: true
    versioningScheme: byEnvVar
    versionEnvVar: ClientSemVer

- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
  displayName: 'Sign Packages'
  inputs:
    ConnectedServiceName: 'IDDP Code Signing'
    FolderPath: '$(Build.ArtifactStagingDirectory)'
    Pattern: '*nupkg'
    signConfigType: inlineSignParams
    inlineOperation: |
     [
         {
             "keyCode": "CP-401405",
             "operationSetCode": "NuGetSign",
             "parameters": [ ],
             "toolName": "sign",
             "toolVersion": "1.0"
         },
         {
             "keyCode": "CP-401405",
             "operationSetCode": "NuGetVerify",
             "parameters": [ ],
             "toolName": "sign",
             "toolVersion": "1.0"
         }
     ]
    SessionTimeout: 20

- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
  displayName: 'Get Software Bill Of Materials (SBOM)'
  inputs:
       BuildDropPath: '$(Build.ArtifactStagingDirectory)'

- task: PublishBuildArtifacts@1
  displayName: 'Publish Artifacts'
  inputs:
    ArtifactName: packages

- task: securedevelopmentteam.vss-secure-development-tools.build-task-uploadtotsa.TSAUpload@2
  displayName: 'TSA Upload'
  inputs:
    GdnPublishTsaOnboard: false
    GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)/build/tsaConfig.json'
  continueOnError: true