Adding new release pipeline with signing capability

.gitignore

@@ -8,6 +8,9 @@ node/docs/temp
 node/docs/*.js
 .DS_Store
 
+# IDE
+.vscode/settings.json
+
 # Logs
 logs
 *.log

azure-pipelines-steps-node.yml

@@ -34,24 +34,4 @@ steps:
   # PublishPipelineArtifact step is configured in the base template.
   # See the templateContext section in the azure-pipelines.yml file
 
-# Only on Windows. Build VstsTaskSdk for powershell 
-- ${{ if eq(parameters.os, 'Windows_NT') }}:
-  # Build step for .NET source code. This is needed to enable CodeQL for C# code
-  - task: DotNetCoreCLI@2
-    displayName: 'Build .NET project(s)'
-    inputs:
-      command: build
-      projects: 'powershell/CompiledHelpers/VstsTaskSdk.csproj'
-      arguments: '--configuration Release'
-
-  - task: NpmAuthenticate@0
-    inputs:
-      workingFile: .npmrc
-
-  - script: npm ci
-    displayName: (VstsTaskSdk) npm ci
-    workingDirectory: powershell
-
-  - script: npm test
-    displayName: (VstsTaskSdk) npm test
-    workingDirectory: powershell
+

azure-pipelines.yml

@@ -10,6 +10,8 @@ variables:
 - group: npm-tokens
 - name: nodeVersion
   value: '16.13.0'
+- name: nodeVersionForPowershell
+  value: '20.x'
 
 resources:
   repositories:
@@ -43,9 +45,9 @@ extends:
           image: abtt-windows-2022
           os: windows
         steps:
-        - template: /azure-pipelines-steps-node.yml@self
+        - template: /ci/node/build-steps.yml@self
           parameters:
-            os: Windows_NT  
+            os: Windows_NT
 
       #################################################
       - job: linux
@@ -61,7 +63,7 @@ extends:
             artifactType: 'pipeline'
             artifactName: 'npm-package'
         steps:
-        - template: /azure-pipelines-steps-node.yml@self
+        - template: /ci/node/build-steps.yml@self
           parameters:
             os: Linux
 
@@ -73,6 +75,24 @@ extends:
           image: macOS-latest
           os: macOS
         steps:
-        - template: /azure-pipelines-steps-node.yml@self
+        - template: /ci/node/build-steps.yml@self
           parameters:
-            os: Darwin
+            os: Darwin
+
+      #################################################
+      - job: powershell
+      #################################################
+        pool:
+          name: 1ES-ABTT-Shared-Pool
+          image: abtt-windows-2022
+          os: windows
+        templateContext:
+          outputs:
+          - output: pipelineArtifact
+            targetPath: 'powershell/_build'
+            artifactType: 'pipeline'
+            artifactName: 'powershell-module'
+        steps:
+        - template: /ci/powershell/build-steps.yml@self
+          parameters:
+            runTests: true

ci/node/build-steps.yml

@@ -0,0 +1,23 @@
+parameters:
+- name: os
+  type: string
+
+steps:
+- task: NodeTool@0
+  displayName: use node $(nodeVersion)
+  inputs:
+    versionSpec: $(nodeVersion)
+
+- task: NpmAuthenticate@0
+  inputs:
+    workingFile: .npmrc
+
+- script: npm ci
+  displayName: (task-lib) npm ci
+  workingDirectory: node
+
+- script: npm test
+  workingDirectory: node
+  displayName: (task-lib) npm test
+
+

ci/node/publish-job.yml

@@ -0,0 +1,36 @@
+parameters:
+- name: npmToken
+  type: string
+  default: '$(npm-automation.token)'
+
+jobs:
+- job: PublishToNpm
+  displayName: 'Publish Node.js Package to npm'
+  pool:
+    vmImage: ubuntu-latest
+  variables:
+    nodeVersion: '16.13.0'
+  steps:
+  - checkout: self
+    displayName: 'Checkout source code'
+
+  # Build and test the package
+  - template: /ci/node/build-steps.yml@self
+    parameters:
+      os: ''
+
+  - bash: |
+      echo //registry.npmjs.org/:_authToken=\${NPM_TOKEN} > .npmrc
+      npm publish
+    displayName: (task-lib) npm publish
+    workingDirectory: node/_build
+    env:
+      NPM_TOKEN: ${{ parameters.npmToken }}
+
+  - task: PublishPipelineArtifact@1
+    displayName: 'Publish npm package artifact'
+    inputs:
+      targetPath: 'node/_build'
+      artifact: 'npm-package'
+      publishLocation: 'pipeline'
+    condition: succeededOrFailed()

ci/powershell/build-steps.yml

@@ -0,0 +1,48 @@
+parameters:
+- name: runTests
+  type: boolean
+  default: true
+
+steps:
+# Build .NET project (requires Windows)
+- task: DotNetCoreCLI@2
+  displayName: 'Build .NET project(s)'
+  inputs:
+    command: build
+    projects: 'powershell/CompiledHelpers/VstsTaskSdk.csproj'
+    arguments: '--configuration Release'
+
+# Copy the built DLL to a location where make.js can use it instead of downloading
+- pwsh: |
+    $sourceDll = "CompiledHelpers/bin/Release/netstandard2.1/VstsTaskSdk.dll"
+    $targetDir = "_lib"
+    New-Item -ItemType Directory -Force -Path $targetDir | Out-Null
+    Copy-Item -Path $sourceDll -Destination "$targetDir/VstsTaskSdk.dll" -Force
+    Write-Host "Copied locally built VstsTaskSdk.dll to $targetDir"
+  displayName: 'Copy locally built VstsTaskSdk.dll'
+  workingDirectory: powershell
+
+# Use Node.js 20.x for PowerShell SDK (required for newer dependencies)
+- task: NodeTool@0
+  displayName: use node $(nodeVersionForPowershell) for PowerShell SDK
+  inputs:
+    versionSpec: $(nodeVersionForPowershell)
+
+- task: NpmAuthenticate@0
+  inputs:
+    workingFile: .npmrc
+
+- script: npm ci
+  displayName: (VstsTaskSdk) npm ci
+  workingDirectory: powershell
+
+# Build the PowerShell module
+- script: node make.js build
+  displayName: (VstsTaskSdk) build module
+  workingDirectory: powershell
+
+# Run tests if requested
+- ${{ if eq(parameters.runTests, true) }}:
+  - script: npm test
+    displayName: (VstsTaskSdk) npm test
+    workingDirectory: powershell

ci/powershell/publish-job.yml

@@ -1,23 +1,94 @@
+parameters:
+- name: apiKeyVariable
+  type: string
+  default: '$(PSGalleryApiKey)'
+- name: enableSigning
+  type: boolean
+  default: true
+
 jobs:
-  - job: Publish
-    displayName: Publish SDK to PowerShell gallery
-    pool:
-      vmImage: windows-2022
-    steps:
-      - powershell: |
-          Install-Module -Name Microsoft.PowerShell.PSResourceGet -Verbose
-        displayName: Install new publish cmdlets
-
-      - powershell: |
-          $publishOptions = @{
-              Path       = './VstsTaskSdk'
-              ApiKey     = $env:API_KEY
-              Repository = 'PSGallery'
-              Verbose    = $true
-          }
-          Publish-PSResource @publishOptions
-
-        displayName: Publish to gallery
-        workingDirectory: powershell/_build
-        env:
-          API_KEY: $(PSGalleryApiKey)
+- job: PublishToGallery
+  displayName: 'Publish PowerShell Module to Gallery'
+  pool:
+    name: 1ES-ABTT-Shared-Pool
+    image: abtt-windows-2022
+    os: windows
+  variables:
+    nodeVersionForPowershell: '20.x'
+  steps:
+  - checkout: self
+    displayName: 'Checkout source code'
+
+  # Build .NET project
+  - task: DotNetCoreCLI@2
+    displayName: 'Build .NET project(s)'
+    inputs:
+      command: build
+      projects: 'powershell/CompiledHelpers/VstsTaskSdk.csproj'
+      arguments: '--configuration Release'
+
+  # Sign the DLL if enabled
+  - ${{ if eq(parameters.enableSigning, true) }}:
+    - template: /ci/powershell/signing-steps.yml@self
+      parameters:
+        dllPath: 'powershell/CompiledHelpers/bin/Release/netstandard2.1'
+
+  # Copy signed DLL to _lib folder
+  - pwsh: |
+      $sourceDll = "CompiledHelpers/bin/Release/netstandard2.1/VstsTaskSdk.dll"
+      $targetDir = "_lib"
+      New-Item -ItemType Directory -Force -Path $targetDir | Out-Null
+      Copy-Item -Path $sourceDll -Destination "$targetDir/VstsTaskSdk.dll" -Force
+      Write-Host "Copied signed VstsTaskSdk.dll to $targetDir"
+    displayName: 'Copy signed VstsTaskSdk.dll'
+    workingDirectory: powershell
+
+  # Setup Node.js and build PowerShell module
+  - task: NodeTool@0
+    displayName: use node $(nodeVersionForPowershell) for PowerShell SDK
+    inputs:
+      versionSpec: $(nodeVersionForPowershell)
+
+  - task: NpmAuthenticate@0
+    inputs:
+      workingFile: .npmrc
+
+  - script: npm ci
+    displayName: (VstsTaskSdk) npm ci
+    workingDirectory: powershell
+
+  - script: node make.js build
+    displayName: (VstsTaskSdk) build module
+    workingDirectory: powershell
+
+  - script: npm test
+    displayName: (VstsTaskSdk) npm test
+    workingDirectory: powershell
+
+  # Then publish to PowerShell Gallery
+  - powershell: |
+      Install-Module -Name Microsoft.PowerShell.PSResourceGet -Force -Verbose
+    displayName: 'Install PowerShell Gallery publish tools'
+    condition: succeeded()
+
+  - powershell: |
+      $publishOptions = @{
+          Path       = '.\_build\VstsTaskSdk'
+          ApiKey     = $env:API_KEY
+          Repository = 'PSGallery'
+          Verbose    = $true
+      }
+      Publish-PSResource @publishOptions
+    displayName: 'Publish to PowerShell Gallery'
+    workingDirectory: powershell
+    condition: succeeded()
+    env:
+      API_KEY: ${{ parameters.apiKeyVariable }}
+
+  - task: PublishPipelineArtifact@1
+    displayName: 'Publish built module as artifact'
+    inputs:
+      targetPath: 'powershell/_build'
+      artifact: 'VstsTaskSdk-Published'
+      publishLocation: 'pipeline'
+    condition: succeededOrFailed()