Skip to content

Commit f170f80

Browse files
committed
try to add actual publish
1 parent aa3c220 commit f170f80

File tree

3 files changed

+169
-6
lines changed

3 files changed

+169
-6
lines changed

build/azure-devdiv-pipeline.pre-release.yml

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -130,11 +130,37 @@ extends:
130130
displayName: Prepare manifest for signing
131131

132132
# Conditionally invoke signing template (encapsulates inspection + msbuild + verification)
133-
- ${{ if eq(parameters.publishExtension, true) }}:
134-
- template: build/templates/sign.yml@self
133+
- template: build/templates/sign.yml@self
134+
parameters:
135+
vsixName: $(VSIX_NAME)
136+
workingDirectory: $(Build.StagingDirectory)\drop
137+
signType: real
138+
verifySignature: true
139+
140+
- ${{ if eq(parameters.publishExtension, true) }}:
141+
- stage: Publish
142+
displayName: Publish Extension
143+
dependsOn: Build
144+
jobs:
145+
- job: Publish
146+
displayName: Marketplace Publish Job
147+
templateContext:
148+
type: releaseJob
149+
isProduction: true
150+
inputs:
151+
- input: pipelineArtifact
152+
# Single consolidated artifact produced in Build stage
153+
artifactName: drop
154+
# Download into the expected publishFolder path used by publish.yml
155+
targetPath: $(Build.ArtifactStagingDirectory)\drop
156+
steps:
157+
- template: build/templates/publish.yml@self
135158
parameters:
136-
vsixName: $(VSIX_NAME)
137-
workingDirectory: $(Build.StagingDirectory)\drop
138-
signType: real
139-
verifySignature: true
159+
azureSubscription: PylancePublishPipelineSecureConnectionWithManagedIdentity
160+
vsixName: autopep8.vsix
161+
manifestName: extension.manifest
162+
signatureName: extension.signature.p7s
163+
publishFolder: drop
164+
preRelease: false
165+
noVerify: true
140166

build/templates/publish.yml

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# Template (steps): PublishMarketplace for autopep8 extension
2+
# Expects working directory already populated (or artifact previously downloaded) with: autopep8.vsix, extension.manifest, extension.signature.p7s
3+
# Provides optional prerelease publishing via parameter.
4+
#
5+
# Usage (example inside a stage job):
6+
# steps:
7+
# - template: build/templates/publish.yml@self
8+
# parameters:
9+
# azureSubscription: Autopep8PublishServiceConnection
10+
# artifactName: drop
11+
# vsixName: autopep8.vsix
12+
# manifestName: extension.manifest
13+
# signatureName: extension.signature.p7s
14+
# publishFolder: vscode-autopep8
15+
# preRelease: true
16+
# noVerify: true
17+
#
18+
# Notes:
19+
# - Azure DevOps Marketplace resource GUID (499b84ac-1321-427f-aa17-267ca6975798) is hardcoded in publish script.
20+
# - This uses Managed Identity via AzureCLI@2 to acquire an AAD token and passes it as a PAT.
21+
# - Requires extension artifacts already signed (signature file present).
22+
23+
parameters:
24+
- name: azureSubscription
25+
type: string
26+
- name: vsixName
27+
type: string
28+
default: autopep8.vsix
29+
- name: manifestName
30+
type: string
31+
default: extension.manifest
32+
- name: signatureName
33+
type: string
34+
default: extension.signature.p7s
35+
- name: publishFolder
36+
type: string
37+
default: vscode-autopep8
38+
- name: preRelease
39+
type: boolean
40+
default: false
41+
- name: noVerify
42+
type: boolean
43+
default: true
44+
45+
steps:
46+
# Assumes files already present at $(Build.ArtifactStagingDirectory)/publishFolder
47+
48+
- task: AzureCLI@2
49+
displayName: Acquire token & publish extension
50+
inputs:
51+
azureSubscription: ${{ parameters.azureSubscription }}
52+
scriptType: pscore
53+
scriptLocation: inlineScript
54+
inlineScript: |
55+
# Hardcoded Azure DevOps Marketplace resource GUID
56+
$resource = "499b84ac-1321-427f-aa17-267ca6975798"
57+
Write-Host "Acquiring AAD token for resource: $resource"
58+
az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me --resource $resource | Out-Null
59+
$aadToken = az account get-access-token --query accessToken --resource $resource -o tsv
60+
if (-not $aadToken) { Write-Error 'Failed to acquire AAD token.'; exit 1 }
61+
62+
$root = "$(Build.ArtifactStagingDirectory)/${{ parameters.publishFolder }}"
63+
$vsixPath = Join-Path $root "${{ parameters.vsixName }}"
64+
$manifestPath = Join-Path $root "${{ parameters.manifestName }}"
65+
$signaturePath = Join-Path $root "${{ parameters.signatureName }}"
66+
67+
Write-Host "VSIX Path: $vsixPath"
68+
Write-Host "Manifest Path: $manifestPath"
69+
Write-Host "Signature Path: $signaturePath"
70+
71+
if (-not (Test-Path $vsixPath)) { Write-Error "VSIX file not found: $vsixPath"; exit 1 }
72+
if (-not (Test-Path $manifestPath)) { Write-Error "Manifest file not found: $manifestPath"; exit 1 }
73+
if (-not (Test-Path $signaturePath)) { Write-Error "Signature file not found: $signaturePath"; exit 1 }
74+
75+
Write-Host "Listing publish folder contents: $root"
76+
Get-ChildItem -Recurse $root | Select-Object FullName,Length | Format-Table -AutoSize
77+
78+
$extraFlags = ''
79+
if ('${{ parameters.noVerify }}' -eq 'True') { $extraFlags = "$extraFlags --noVerify" }
80+
81+
if ('${{ parameters.preRelease }}' -eq 'True') {
82+
Write-Host 'Publishing as pre-release'
83+
# npx @vscode/vsce@latest publish --pat $aadToken --packagePath $vsixPath --manifestPath $manifestPath --signaturePath $signaturePath $extraFlags --pre-release
84+
} else {
85+
Write-Host 'Publishing as stable release'
86+
# npx @vscode/vsce@latest publish --pat $aadToken --packagePath $vsixPath --manifestPath $manifestPath --signaturePath $signaturePath $extraFlags
87+
}
88+
89+
if ($LASTEXITCODE -ne 0) {
90+
Write-Error "vsce publish failed with exit code $LASTEXITCODE"
91+
exit $LASTEXITCODE
92+
}
93+
Write-Host 'Publish succeeded ✅'
94+
95+
- task: PowerShell@2
96+
displayName: Post-publish summary
97+
inputs:
98+
targetType: inline
99+
script: |
100+
Write-Host 'Published extension artifacts:'
101+
Get-ChildItem "$(Build.ArtifactStagingDirectory)/${{ parameters.publishFolder }}" -File | Select-Object Name,Length | Format-Table -AutoSize
102+
Write-Host "Pre-release parameter: ${{ parameters.preRelease }}"

build/templates/sign.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,21 @@ steps:
9797
solution: '$(Build.SourcesDirectory)/sign.proj'
9898
msbuildArguments: '/verbosity:minimal /p:SignType=${{ parameters.signType }}'
9999

100+
- task: PowerShell@2
101+
displayName: Copy signed signature back to working directory
102+
inputs:
103+
targetType: inline
104+
script: |
105+
$wd = "${{ parameters.workingDirectory }}"
106+
$root = "$(Build.SourcesDirectory)"
107+
$signatureName = "${{ parameters.signatureName }}"
108+
$rootSig = Join-Path $root $signatureName
109+
if (!(Test-Path $rootSig)) { Write-Error "Signed signature not found at root: $rootSig"; exit 1 }
110+
$wdSig = Join-Path $wd $signatureName
111+
Copy-Item $rootSig $wdSig -Force
112+
Write-Host "Copied signed signature to working directory: $wdSig"
113+
Get-Item $rootSig,$wdSig | Select-Object FullName,Length,LastWriteTime | Format-Table -AutoSize
114+
100115
- task: PowerShell@2
101116
displayName: Post-sign inspection
102117
inputs:
@@ -113,6 +128,26 @@ steps:
113128
Write-Warning "Signature file NOT present after signing step."; exit 0
114129
}
115130
131+
- task: PowerShell@2
132+
displayName: Validate signature differs from manifest (hash check)
133+
inputs:
134+
targetType: inline
135+
script: |
136+
$wd = "${{ parameters.workingDirectory }}"
137+
$manifest = Join-Path $wd "${{ parameters.manifestName }}"
138+
$signature = Join-Path $wd "${{ parameters.signatureName }}"
139+
if (!(Test-Path $manifest)) { Write-Error "Manifest missing for hash comparison: $manifest"; exit 1 }
140+
if (!(Test-Path $signature)) { Write-Error "Signature missing for hash comparison: $signature"; exit 1 }
141+
$manifestHash = (Get-FileHash -Algorithm SHA256 $manifest).Hash
142+
$signatureHash = (Get-FileHash -Algorithm SHA256 $signature).Hash
143+
Write-Host "Manifest SHA256 : $manifestHash"
144+
Write-Host "Signature SHA256: $signatureHash"
145+
if ($manifestHash -eq $signatureHash) {
146+
Write-Error "Signature file is identical to manifest (placeholder detected). Failing build."; exit 1
147+
} else {
148+
Write-Host "Hashes differ ✅ (signature not a direct copy of manifest)"
149+
}
150+
116151
- ${{ if eq(parameters.verifySignature, true) }}:
117152
- task: PowerShell@2
118153
displayName: Verify VSIX signature

0 commit comments

Comments
 (0)