azure-pipelines.yml

pool:
  vmImage: 'windows-latest'

variables:
- group: 'code-sign-config'
- group: 'nuget-package-config'
- group: 'github-config'

stages:

- stage: versioning
  displayName: Get Version
  jobs:
  - job: get_version
    displayName: Generate Version from Git tags
    steps:
    - checkout: self
      fetchTags: true
      fetchDepth: 0
    - task: PowerShell@2
      displayName: 'Generate Semantic Version'
      name: gitver
      inputs:
        filePath: 'azure-gitversion.ps1'
        failOnStderr: true
        pwsh: true

- stage: build
  displayName: Build Application
  dependsOn: versioning
  variables:
    BuildConfiguration: 'release'
    SemVersion: $[ stageDependencies.versioning.get_version.outputs['gitver.SemVersion'] ]
    MajorVersion: $[ stageDependencies.versioning.get_version.outputs['gitver.MajorVersion'] ]
    MinorVersion: $[ stageDependencies.versioning.get_version.outputs['gitver.MinorVersion'] ]
    PatchVersion: $[ stageDependencies.versioning.get_version.outputs['gitver.PatchVersion'] ]  
  jobs:  
  - job: create_setups
    displayName: Build, Publish and Sign
    variables:
      NUGET_PACKAGES: '$(Pipeline.Workspace)/.nuget/packages'
    steps:
    - checkout: self
    - task: DownloadSecureFile@1
      displayName: 'Download Client Authentication Certificate'
      name: SM_CLIENT_CERT_FILE
      inputs:
        secureFile: ClientCert.p12
    - task: SSMClientToolsSetup@1
      displayName: 'Setup DigiCert Tools'
      condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
      inputs:
        APIKey: '$(SM_API_KEY)'
    - task: PowerShell@2
      displayName: 'Prepare DigiCert Code Signing'
      condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
      env:
        SM_CLIENT_CERT_FILE : $(SM_CLIENT_CERT_FILE.secureFilePath)
      inputs:
        targetType: 'inline'
        script: |
          $env:PATH += ';C:\Program Files\DigiCert\DigiCert Keylocker Tools'
          smctl credentials save $(SM_API_KEY) $(SM_CLIENT_CERT_PASSWORD)
          smctl windows certsync --keypair-alias=$(SM_KEYPAIR_ALIAS)
        failOnStderr: true
        pwsh: true
    - task: Assembly-Info-NetCore@3
      displayName: 'Apply Assembly Infos'
      inputs:
        Path: '$(Build.SourcesDirectory)'
        FileNames: '**/*.csproj'
        InsertAttributes: true
        FileEncoding: 'auto'
        WriteBOM: false
        VersionNumber: '$(MajorVersion).$(MinorVersion).$(PatchVersion).$(Build.BuildId)'
        FileVersionNumber: '$(MajorVersion).$(MinorVersion).$(PatchVersion).$(Build.BuildId)'
        InformationalVersion: '$(SemVersion)'
        LogLevel: 'verbose'
        FailOnWarning: false
        DisableTelemetry: true
    - task: Cache@2
      displayName: 'Cache NuGet packages'
      inputs:
        key: 'nuget | "$(Agent.OS)" | **/*.csproj'
        restoreKeys: 'nuget | "$(Agent.OS)"'
        path: $(NUGET_PACKAGES)
    - task: DotNetCoreCLI@2
      displayName: 'Restore'
      inputs:
        command: 'restore'
        projects: '*.slnx'
        feedsToUse: 'select'
        vstsFeed: '340e7a34-33ea-4418-8b72-d55dcb74efa7/dd1a6c3c-4e29-44c2-a80d-9d6c7004ac57'
    - task: DotNetCoreCLI@2
      displayName: 'Build'
      inputs:
        command: 'build'
        projects: '*.slnx'
        arguments: '-c $(BuildConfiguration) --no-restore /p:ContinuousIntegrationBuild=true'
    - task: DotNetCoreCLI@2
      displayName: 'Test'
      inputs:
        command: 'test'
        projects: '*.slnx'
        arguments: '-c $(BuildConfiguration) --no-build'
        testRunTitle: 'Perform unit tests'
    - task: DotNetCoreCLI@2
      displayName: 'Pack'
      inputs:
        command: 'pack'
        packagesToPack: 'src/OpenCodeList.Net.csproj'
        nobuild: true
        arguments: '/p:ContinuousIntegrationBuild=true'
        versioningScheme: 'byEnvVar'
        versionEnvVar: 'SemVersion'
    - task: NuGetCommand@2
      displayName: 'Sign'
      condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
      env:
        SM_CLIENT_CERT_FILE : $(SM_CLIENT_CERT_FILE.secureFilePath)
        SM_HOST : $(SM_HOST)
      inputs:
        command: 'custom'
        arguments: 'sign $(Build.ArtifactStagingDirectory)/**/*.nupkg -Timestamper http://timestamp.digicert.com -CertificateFingerprint $(SM_CERT_FINGERPRINT) -HashAlgorithm SHA256 -Verbosity detailed -Overwrite'
    - publish: '$(Build.ArtifactStagingDirectory)'
      artifact: drop
      
- stage: github
  displayName: Publish Source
  dependsOn: build
  condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
  jobs:
  - job: push_to_github
    displayName: Push Source to GitHub
    steps:
    - checkout: self
      fetchTags: true
      fetchDepth: 0
    - task: PowerShell@2
      displayName: 'Push to GitHub'
      inputs:
        targetType: 'inline'
        pwsh: true
        script: |

          $ErrorActionPreference = 'Stop'

          try {
            
            # Configure Git identity
            git config user.name  'azure-devops-bot'
            git config user.email 'azuredevops@stueber.nomail'

            # Add 'github' remote
            git remote add github "https://$($env:PAT)@github.com/openpotato/opencodelist.net.git"

            # Fetch remote main if it exists (ok to fail if repo is empty)
            git fetch --prune github main
            $fetchCode = $LASTEXITCODE

            # If remote branch exists, only push when remote is an ancestor of HEAD (fast-forward safe)
            if ($fetchCode -eq 0) {
              git merge-base --is-ancestor github/main HEAD
              if ($LASTEXITCODE -ne 0) {
                Write-Error "Remote has commits not in local (or histories diverged). Aborting push."
              }
            }

            # Push only the main branch (fast-forward or create remote if missing)
            git push --tags github HEAD:refs/heads/main
            if ($LASTEXITCODE -ne 0) { throw "git push failed with exit code $LASTEXITCODE" }
            
          }
          finally {
            
            # Remove the remote so the PAT isn't left in .git/config
            git remote remove github 2>$null | Out-Null
            
          }
      env:
        PAT: $(PAT)

- stage: deploy
  displayName: Deploy
  dependsOn: [versioning, build] 
  variables:
    SemVersion: $[ stageDependencies.versioning.get_version.outputs['gitver.SemVersion'] ]
  jobs:
  - job: upload
    displayName: Upload Package
    steps:
    - download: current
      artifact: drop
    - task: NuGetCommand@2
      displayName: 'Publish preview to internal feed'
      condition: and(succeeded(), ne(variables['Build.SourceBranch'], 'refs/heads/main'))
      inputs:
        command: 'push'
        packagesToPush: '$(Pipeline.Workspace)/**/*.nupkg;!$(Pipeline.Workspace)/**/*.symbols.nupkg'
        nuGetFeedType: 'internal'
        publishVstsFeed: '340e7a34-33ea-4418-8b72-d55dcb74efa7/dd1a6c3c-4e29-44c2-a80d-9d6c7004ac57'
    - task: NuGetCommand@2
      displayName: 'Publish to nuget.org'
      condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
      inputs:
        command: 'push'
        packagesToPush: '$(Pipeline.Workspace)/**/*.nupkg;!$(Pipeline.Workspace)/**/*.symbols.nupkg'
        nuGetFeedType: 'external'
        publishFeedCredentials: 'STUEBER SYSTEMS | nuget.org'