class-lib-publish.yml

# Copyright (c) .NET Foundation and Contributors
# See LICENSE file in the project root for full license information.

parameters:
  - name: baseBranch
    type: string
    default: 'refs/heads/main'

steps:

- task: DotNetCoreCLI@2
  displayName: Install Sign Client CLI
  condition: >-
    and(
      succeeded(),
      eq(variables['StartReleaseCandidate'], false),
      not(startsWith(variables['Build.SourceBranch'], 'refs/tags/v'))
    )
  inputs:
    command: custom
    custom: tool
    arguments: install --tool-path . sign --version 0.9.1-beta.23530.1

- pwsh: |
    .\sign code azure-key-vault `
    "**/*.nupkg" `
    --base-directory "$(Build.ArtifactStagingDirectory)" `
    --description "$(nugetPackageName)" `
    --description-url "https://github.com/$env:Build_Repository_Name" `
    --azure-key-vault-tenant-id "$(SignTenantId)" `
    --azure-key-vault-client-id "$(SignClientId)" `
    --azure-key-vault-client-secret "$(SignClientSecret)" `
    --azure-key-vault-certificate "$(SignKeyVaultCertificate)" `
    --azure-key-vault-url "$(SignKeyVaultUrl)" `
    --timestamp-url http://timestamp.digicert.com
  displayName: Sign packages
  continueOnError: true
  condition: >-
    and(
      succeeded(),
      eq(variables['StartReleaseCandidate'], false),
      not(startsWith(variables['Build.SourceBranch'], 'refs/tags/v'))
    )

# publish artifacts
- task: PublishPipelineArtifact@1
  inputs:
    targetPath: '$(Build.ArtifactStagingDirectory)'
    artifactName: deployables
    artifactType: pipeline
  condition: >-
    and(
      succeeded(),
      eq(variables['StartReleaseCandidate'], false),
      not(startsWith(variables['Build.SourceBranch'], 'refs/tags/v'))
    )
  displayName: Publish deployables artifacts

# push NuGet packages to Azure Artifacts feed (always happens except on PR builds)
- task: NuGetCommand@2
  condition: >-
    and(
      succeeded(),
      eq(variables['System.PullRequest.PullRequestId'], ''),
      not(startsWith(variables['Build.SourceBranch'], 'refs/pull/')),
      eq(variables['StartReleaseCandidate'], false),
      not(startsWith(variables['Build.SourceBranch'], 'refs/tags/v')),
      startsWith(variables['Build.SourceBranch'], '${{ parameters.baseBranch }}')
    )
  continueOnError: true
  displayName: Push NuGet packages to Azure Artifacts
  inputs:
    command: push
    nuGetFeedType: external
    packagesToPush: '$(Build.ArtifactStagingDirectory)/*.nupkg'
    publishFeedCredentials: 'AzureArtifacts-$(System.TeamProject)'
    allowPackageConflicts: true

# push NuGet class lib package to NuGet (happens when building against main branch - or other specified in the parameter))
- task: NuGetCommand@2
  condition: >-
    and(
      succeeded(),
      eq(variables['System.PullRequest.PullRequestId'], ''),
      not(startsWith(variables['Build.SourceBranch'], 'refs/pull/')),
      eq(variables['StartReleaseCandidate'], false),
      not(startsWith(variables['Build.SourceBranch'], 'refs/tags/v')),
      startsWith(variables['Build.SourceBranch'], '${{ parameters.baseBranch }}')
    )
  continueOnError: true
  displayName: Push NuGet packages to NuGet
  inputs:
    command: push
    nuGetFeedType: external
    allowPackageConflicts: true
    packagesToPush: '$(Build.ArtifactStagingDirectory)/*.nupkg'
    publishFeedCredentials: 'NuGet-$(System.TeamProject)'