.azure-pipelines/release.yml: add GitHub and NuGet.org publishing

Add a new stage (after build) to publish the assets to GitHub and
NuGet.org.

Each target (GitHub and NuGet.org) need to run in separate jobs
due to restrictions of the 1ES pipeline templates:

- Publishing a NuGet package requires us to use template `outputs`
- `type: releaseJob` cannot specify outputs
- `type: releaseJob` is required to use the `GitHubRelease` task

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

Author: mjcheetham

.azure-pipelines/release.yml

@@ -12,8 +12,16 @@ resources:
 parameters:
   - name: 'esrp'
     type: boolean
-    default: false
+    default: true
     displayName: 'Enable ESRP code signing'
+  - name: 'github'
+    type: boolean
+    default: false
+    displayName: 'Enable GitHub release publishing'
+  - name: 'nuget'
+    type: boolean
+    default: false
+    displayName: 'Enable NuGet package publishing'
 
 #
 # 1ES Pipeline Templates do not allow using a matrix strategy so we create
@@ -57,6 +65,10 @@ parameters:
         os: linux
 
 variables:
+  - name: 'githubConnectionName'
+    value: 'GitHub-GitCredentialManager'
+  - name: 'nugetConnectionName'
+    value: '1ESGitClient-NuGet'
   - name: 'esrpConnectionName'
     value: '1ESGitClient-ESRP'
   - name: 'esrpEndpointUrl'
@@ -554,3 +566,116 @@ extends:
                 #           "Parameters": {}
                 #         }
                 #       ]
+
+      - stage: release
+        displayName: 'Release'
+        dependsOn: [prebuild, build]
+        condition: and(succeeded(), or(eq('${{ parameters.github }}', true), eq('${{ parameters.nuget }}', true)))
+        jobs:
+          - job: github
+            displayName: 'Publish GitHub release'
+            condition: and(succeeded(), eq('${{ parameters.github }}', true))
+            pool:
+              name: GitClient-1ESHostedPool-intel-pc
+              image: ubuntu-x86_64-ado1es
+              os: linux
+            variables:
+              version: $[stageDependencies.prebuild.vars.outputs['version.value']]
+            templateContext:
+              type: releaseJob
+              isProduction: true
+              inputs:
+                # Installers and packages
+                - input: pipelineArtifact
+                  artifactName: 'win-x86_installers'
+                  targetPath: $(Pipeline.Workspace)/assets/win-x86
+                - input: pipelineArtifact
+                  artifactName: 'osx-x64_installers'
+                  targetPath: $(Pipeline.Workspace)/assets/osx-x64
+                - input: pipelineArtifact
+                  artifactName: 'osx-arm64_installers'
+                  targetPath: $(Pipeline.Workspace)/assets/osx-arm64
+                - input: pipelineArtifact
+                  artifactName: 'linux-x64_installers'
+                  targetPath: $(Pipeline.Workspace)/assets/linux-x64
+                - input: pipelineArtifact
+                  artifactName: 'nuget_packages'
+                  targetPath: $(Pipeline.Workspace)/assets/nuget
+                # Symbols
+                # Note: Linux symbols are found with the main .tar.gz assets
+                - input: pipelineArtifact
+                  artifactName: 'win-x86_symbols'
+                  targetPath: $(Pipeline.Workspace)/symbols/win-x86
+                - input: pipelineArtifact
+                  artifactName: 'osx-x64_symbols'
+                  targetPath: $(Pipeline.Workspace)/symbols/osx-x64
+                - input: pipelineArtifact
+                  artifactName: 'osx-arm64_symbols'
+                  targetPath: $(Pipeline.Workspace)/symbols/osx-arm64
+            steps:
+              - task: ArchiveFiles@2
+                displayName: 'Archive Windows symbols'
+                inputs:
+                  rootFolderOrFile: '$(Pipeline.Workspace)/symbols/win-x86'
+                  includeRootFolder: false
+                  archiveType: zip
+                  archiveFile: '$(Pipeline.Workspace)/assets/gcm-win-x86-$(version)-symbols.zip'
+              - task: ArchiveFiles@2
+                displayName: 'Archive macOS (x64) symbols'
+                inputs:
+                  rootFolderOrFile: '$(Pipeline.Workspace)/symbols/osx-x64'
+                  includeRootFolder: false
+                  archiveType: tar
+                  archiveFile: '$(Pipeline.Workspace)/assets/gcm-osx-x64-$(version)-symbols.tar.gz'
+              - task: ArchiveFiles@2
+                displayName: 'Archive macOS (ARM64) symbols'
+                inputs:
+                  rootFolderOrFile: '$(Pipeline.Workspace)/symbols/osx-arm64'
+                  includeRootFolder: false
+                  archiveType: tar
+                  archiveFile: '$(Pipeline.Workspace)/assets/gcm-osx-arm64-$(version)-symbols.tar.gz'
+              - task: GitHubRelease@1
+                displayName: 'Create Draft GitHub Release' 
+                condition: and(succeeded(), eq('${{ parameters.github }}', true))
+                inputs:
+                  gitHubConnection: $(githubConnectionName)
+                  repositoryName: git-ecosystem/git-credential-manager
+                  tag: 'v$(version)'
+                  target: release
+                  title: 'GCM $(version)'
+                  isDraft: true
+                  assets: |
+                    $(Pipeline.Workspace)/assets/win-x86/*.exe
+                    $(Pipeline.Workspace)/assets/osx-x64/*.pkg
+                    $(Pipeline.Workspace)/assets/osx-arm64/*.pkg
+                    $(Pipeline.Workspace)/assets/linux-x64/deb/*.deb
+                    $(Pipeline.Workspace)/assets/linux-x64/tar/*.tar.gz
+                    $(Pipeline.Workspace)/assets/nuget/*.nupkg
+                    $(Pipeline.Workspace)/symbols/win-x86/*.zip
+                    $(Pipeline.Workspace)/symbols/osx-x64/*.tar.gz
+                    $(Pipeline.Workspace)/symbols/osx-arm64/*.tar.gz
+                  # Note: Linux symbols are found with the main .tar.gz assets
+
+          - job: nuget
+            displayName: 'Publish NuGet package'
+            condition: and(succeeded(), eq('${{ parameters.nuget }}', true))
+            pool:
+              name: GitClient-1ESHostedPool-intel-pc
+              image: ubuntu-x86_64-ado1es
+              os: linux
+            variables:
+              version: $[stageDependencies.prebuild.vars.outputs['version.value']]
+            templateContext:
+              inputs:
+                - input: pipelineArtifact
+                  artifactName: 'nuget_packages'
+                  targetPath: $(Pipeline.Workspace)/assets/nuget
+              outputs:
+                - output: nuget
+                  condition: and(succeeded(), eq('${{ parameters.nuget }}', true))
+                  displayName: 'Publish .NET Tool NuGet package'
+                  packagesToPush: $(Pipeline.Workspace)/assets/nuget/*.nupkg
+                  packageParentPath: $(Pipeline.Workspace)/assets/nuget
+                  nuGetFeedType: external
+                  publishPackageMetadata: true
+                  publishFeedCredentials: $(nugetConnectionName)