bitwarden-desktop/.az-pipelines/sign-windows-artifacts.yml

trigger: none

pool:
  vmImage: 'windows-latest'

variables:
- group: code-signing-test

steps:
  #- task: DotNetCoreCLI@2
  #  inputs:
  #    command: 'custom'
  #    custom: 'tool'
  #    arguments: 'install --global azuresigntool'
  #  displayName: 'install AzureSignTool'

- script: |
    set DOTNET_SKIP_FIRST_TIME_EXPERIENCE=true
    dotnet tool install --global AzureSignTool --version 2.0.17
  displayName: 'install AzureSignTool'

- script: AzureSignTool.exe sign --help
  displayName: 'Debugging AST'

- task: DownloadGitHubRelease@0
  inputs:
    connection: joseph-flinn
    userRepository: joseph-flinn/desktop
  displayName: 'git release artifacts'

- bash: |
    GIT_RELEASE_VERSION=$(curl --silent "https://api.github.com/repos/joseph-flinn/desktop/releases/latest" | awk -F '"' '/tag_name/{print $4}' | awk '{print substr($1, 2); }') 
    echo "##vso[task.setvariable variable=git_release_version]$GIT_RELEASE_VERSION"
  displayName: 'set git_release_version'

- script: |
    ls -alh $(System.ArtifactsDirectory)
    echo GIT_RELEASE_VERSION=$(git_release_version)
  displayName: 'show artifacts'

- script: AzureSignTool.exe sign --azure-key-vault-url "$(SigningVaultURL)" --azure-key-vault-client-id "$(SigningClientId)" --azure-key-vault-client-secret "$(SigningClientSecret)" --azure-key-vault-tenant-id "$(SigningTenantId)" --azure-key-vault-certificate "$(SigningCertName)" --timestamp-rfc3161 http://timestamp.digicert.com -v "$(System.ArtifactsDirectory)\Bitwarden-$(git_release_version)-ia32.appx"
  displayName: 'Sign artifacts 32-bit'

- script: |
    azuresigntool sign ^
    -kvu "$(SigningVaultURL)" ^
    -kvi "$(SigningClientId)" ^
    -kvs "$(SigningClientSecret)" ^
    -kvt "$(SigningTenantId)" ^
    -kvc "$(SigningCertName)" ^
    -v ^
    "$(System.ArtifactsDirectory)\Bitwarden-$(git_release_version)-x64.appx"
  displayName: 'Sign artifacts 64-bit'

- task: CmdLine@2
  displayName: 'Sign artifact test'
  inputs:
    script: AzureSignTool sign -du "$(SigningURL)" -kvu "$(SigningVaultURL)" -kvi "$(SigningClientId)" -kvs "$(SigningClientSecret)" -kvc "$(SigningCertName)" -v "$(System.ArtifactsDirectory)\Bitwarden-$(git_release_version)-ia32.appx"

- task: PublishPipelineArtifact@1
  inputs:
    pathToPublish: '$(System.DefaultWorkingDirectory)/dist/Bitwarden-$(git_release_version)-ia32.appx'
    artifactName: 'Bitwarden-$(git_release_version)-ia32.appx'

- task: PublishPipelineArtifact@1
  inputs:
    pathToPublish: '$(System.DefaultWorkingDirectory)/dist/Bitwarden-$(git_release_version)-x64.appx'
    artifactName: 'Bitwarden-$(git_release_version)-x64.appx'