automate macOS signing

Author: joaomoreno

build/tfs/darwin/product-build-darwin.yml

@@ -11,32 +11,58 @@ steps:
     set -e
     echo "machine monacotools.visualstudio.com password $(VSO_PAT)" > ~/.netrc
     yarn
-    npm run gulp -- hygiene
-    npm run monaco-compile-check
-    VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)" npm run gulp -- mixin
+    yarn gulp -- hygiene
+    yarn monaco-compile-check
+    VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)" yarn gulp -- mixin
     node build/tfs/common/installDistro.js
     node build/lib/builtInExtensions.js
+  displayName: Prepare build
 
 - script: |
     set -e
     VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)" \
     AZURE_STORAGE_ACCESS_KEY="$(AZURE_STORAGE_ACCESS_KEY)" \
-    npm run gulp -- vscode-darwin-min upload-vscode-sourcemaps
-  name: build
+    yarn gulp -- vscode-darwin-min upload-vscode-sourcemaps
+  displayName: Build
 
 - script: |
     set -e
     ./scripts/test.sh --build --tfs "Unit Tests"
-    APP_NAME="`ls $(agent.builddirectory)/VSCode-darwin | head -n 1`"
+    # APP_NAME="`ls $(agent.builddirectory)/VSCode-darwin | head -n 1`"
     # yarn smoketest -- --build "$(agent.builddirectory)/VSCode-darwin/$APP_NAME"
-  name: test
+  displayName: Run unit tests
 
 - script: |
     set -e
-    # archive the unsigned build
-    pushd ../VSCode-darwin && zip -r -X -y ../VSCode-darwin-unsigned.zip * && popd
+    pushd ../VSCode-darwin && zip -r -X -y ../VSCode-darwin.zip * && popd
+  displayName: Archive build
 
-    # publish the unsigned build
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)'
+    Pattern: 'VSCode-darwin.zip'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-401337-Apple",
+          "operationSetCode": "MacAppDeveloperSign",
+          "parameters": [ ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+  displayName: Codesign
+
+- script: |
+    set -e
+
+    # remove pkg from archive
+    zip -d ../VSCode-darwin.zip "*.pkg"
+
+    # publish the build
     PACKAGEJSON=`ls ../VSCode-darwin/*.app/Contents/Resources/app/package.json`
     VERSION=`node -p "require(\"$PACKAGEJSON\").version"`
     AZURE_DOCUMENTDB_MASTERKEY="$(AZURE_DOCUMENTDB_MASTERKEY)" \
@@ -45,19 +71,16 @@ steps:
     node build/tfs/common/publish.js \
       "$(VSCODE_QUALITY)" \
       darwin \
-      archive-unsigned \
-      "VSCode-darwin-$(VSCODE_QUALITY)-unsigned.zip" \
+      archive \
+      "VSCode-darwin-$(VSCODE_QUALITY).zip" \
       $VERSION \
-      false \
-      ../VSCode-darwin-unsigned.zip
+      true \
+      ../VSCode-darwin.zip
 
     # publish hockeyapp symbols
     node build/tfs/common/symbols.js "$(VSCODE_MIXIN_PASSWORD)" "$(VSCODE_HOCKEYAPP_TOKEN)" "$(VSCODE_ARCH)" "$(VSCODE_HOCKEYAPP_ID_MACOS)"
 
-    # enqueue the unsigned build
-    AZURE_DOCUMENTDB_MASTERKEY="$(AZURE_DOCUMENTDB_MASTERKEY)" \
-    AZURE_STORAGE_ACCESS_KEY_2="$(AZURE_STORAGE_ACCESS_KEY_2)" \
-    node build/tfs/darwin/enqueue.js "$(VSCODE_QUALITY)"
-
+    # upload configuration
     AZURE_STORAGE_ACCESS_KEY="$(AZURE_STORAGE_ACCESS_KEY)" \
-    npm run gulp -- upload-vscode-configuration
+    yarn gulp -- upload-vscode-configuration
+  displayName: Publish