.azure-pipelines/release.yml: add GitHub and NuGet.org publishing

Add a new stage (after build) to publish the assets to GitHub and
NuGet.org.

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

Author: mjcheetham

.azure-pipelines/release.yml

@@ -12,8 +12,16 @@ resources:
 parameters:
   - name: 'esrp'
     type: boolean
-    default: false
+    default: true
     displayName: 'Enable ESRP code signing'
+  - name: 'github'
+    type: boolean
+    default: false
+    displayName: 'Enable GitHub release publishing'
+  - name: 'nuget'
+    type: boolean
+    default: false
+    displayName: 'Enable NuGet package publishing'
 
 #
 # 1ES Pipeline Templates do not allow using a matrix strategy so we create
@@ -57,6 +65,10 @@ parameters:
         os: linux
 
 variables:
+  - name: 'githubConnectionName'
+    value: 'GitHub-GitCredentialManager'
+  - name: 'nugetConnectionName'
+    value: '1ESGitClient-NuGet'
   - name: 'esrpConnectionName'
     value: '1ESGitClient-ESRP'
   - name: 'esrpEndpointUrl'
@@ -553,3 +565,100 @@ extends:
                 #           "Parameters": {}
                 #         }
                 #       ]
+
+      - stage: release
+        displayName: 'Release'
+        dependsOn: [validate, build]
+        condition: and(succeeded(), or(eq('${{ parameters.github }}', true), eq('${{ parameters.nuget }}', true)))
+        jobs:
+          - job: publish
+            displayName: 'Publish release'
+            pool:
+              name: GitClient-1ESHostedPool-intel-pc
+              image: ubuntu-x86_64-ado1es
+              os: linux
+            variables:
+              version: $[stageDependencies.validate.vars.outputs['version.value']]
+            templateContext:
+              type: releaseJob
+              isProduction: true
+              inputs:
+                # Installers and packages
+                - input: pipelineArtifact
+                  artifactName: 'win-x86_installers'
+                  targetPath: $(Pipeline.Workspace)/assets/win-x86
+                - input: pipelineArtifact
+                  artifactName: 'osx-x64_installers'
+                  targetPath: $(Pipeline.Workspace)/assets/osx-x64
+                - input: pipelineArtifact
+                  artifactName: 'osx-arm64_installers'
+                  targetPath: $(Pipeline.Workspace)/assets/osx-arm64
+                - input: pipelineArtifact
+                  artifactName: 'linux-x64_installers'
+                  targetPath: $(Pipeline.Workspace)/assets/linux-x64
+                - input: pipelineArtifact
+                  artifactName: 'nuget_packages'
+                  targetPath: $(Pipeline.Workspace)/assets/nuget
+                # Symbols
+                # Note: Linux symbols are found with the main .tar.gz assets
+                - input: pipelineArtifact
+                  artifactName: 'win-x86_symbols'
+                  targetPath: $(Pipeline.Workspace)/symbols/win-x86
+                - input: pipelineArtifact
+                  artifactName: 'osx-x64_symbols'
+                  targetPath: $(Pipeline.Workspace)/symbols/osx-x64
+                - input: pipelineArtifact
+                  artifactName: 'osx-arm64_symbols'
+                  targetPath: $(Pipeline.Workspace)/symbols/osx-arm64
+              outputs:
+                - output: nuget
+                  condition: and(succeeded(), eq('${{ parameters.nuget }}', true))
+                  displayName: 'Publish .NET Tool NuGet package'
+                  packagesToPush: $(Pipeline.Workspace)/assets/nuget/*.nupkg
+                  packageParentPath: $(Pipeline.Workspace)/assets/nuget
+                  nuGetFeedType: external
+                  publishPackageMetadata: true
+                  publishFeedCredentials: $(nugetConnectionName)
+            steps:
+              - task: ArchiveFiles@2
+                displayName: 'Archive Windows symbols'
+                inputs:
+                  rootFolderOrFile: '$(Pipeline.Workspace)/symbols/win-x86'
+                  includeRootFolder: false
+                  archiveType: zip
+                  archiveFile: '$(Pipeline.Workspace)/assets/gcm-win-x86-$(version)-symbols.zip'
+              - task: ArchiveFiles@2
+                displayName: 'Archive macOS (x64) symbols'
+                inputs:
+                  rootFolderOrFile: '$(Pipeline.Workspace)/symbols/osx-x64'
+                  includeRootFolder: false
+                  archiveType: tar
+                  archiveFile: '$(Pipeline.Workspace)/assets/gcm-osx-x64-$(version)-symbols.tar.gz'
+              - task: ArchiveFiles@2
+                displayName: 'Archive macOS (ARM64) symbols'
+                inputs:
+                  rootFolderOrFile: '$(Pipeline.Workspace)/symbols/osx-arm64'
+                  includeRootFolder: false
+                  archiveType: tar
+                  archiveFile: '$(Pipeline.Workspace)/assets/gcm-osx-arm64-$(version)-symbols.tar.gz'
+              - task: GitHubRelease@1
+                displayName: 'Create Draft GitHub Release' 
+                condition: and(succeeded(), eq('${{ parameters.github }}', true))
+                inputs:
+                  gitHubConnection: $(githubConnectionName)
+                  repositoryName: git-ecosystem/git-credential-manager
+                  tag: 'v$(version)'
+                  target: release
+                  title: 'GCM $(version)'
+                  isDraft: true
+                  assets: |
+                    $(Pipeline.Workspace)/assets/win-x86/*.exe
+                    $(Pipeline.Workspace)/assets/osx-x64/*.pkg
+                    $(Pipeline.Workspace)/assets/osx-arm64/*.pkg
+                    $(Pipeline.Workspace)/assets/linux-x64/deb/*.deb
+                    $(Pipeline.Workspace)/assets/linux-x64/tar/*.tar.gz
+                    $(Pipeline.Workspace)/assets/nuget/*.nupkg
+                    $(Pipeline.Workspace)/symbols/win-x86/*.zip
+                    $(Pipeline.Workspace)/symbols/osx-x64/*.tar.gz
+                    $(Pipeline.Workspace)/symbols/osx-arm64/*.tar.gz
+                  # Note: Linux symbols are found with the main .tar.gz assets