trigger:
  branches:
    include:
      - refs/tags/*
resources:
  repositories:
    - repository: MicroBuildTemplate
      type: git
      name: 1ESPipelineTemplates/MicroBuildTemplate
      ref: refs/tags/release
variables:
  - name: TeamName
    value: Pyright
  - name: VSIX_NAME
    value: vscode-pyright.vsix
  - name: ARTIFACT_NAME_VSIX
    value: vsix
  - name: PACKAGE_NAME
    value: pyright.tgz
  - name: ARTIFACT_NAME_PACKAGE
    value: pyright
  - name: AZURE_ARTIFACTS_FEED
    value: 'https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/Pylance_PublicPackages/npm/registry/'

extends:
  template: azure-pipelines/MicroBuild.1ES.Official.Publish.yml@MicroBuildTemplate
  parameters:
    sdl:
      codeSignValidation:
        enabled: true
        additionalTargetsGlobPattern: -|**/gdn-vscode-pyright.vsix/**
      codeql:
        compiled:
          enabled: false
          justificationForDisabling: 'Running a scan on the Pyright-Build azure-pipelines.yml'
      sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
    pool:
      name: AzurePipelines-EO
      image: 1ESPT-Ubuntu22.04
      os: linux
    customBuildTags:
      - ES365AIMigrationTooling
    stages:
      - stage: BuildVsix
        jobs:
          - job: build_vsix
            displayName: Build VSIX
            timeoutInMinutes: 60
            pool:
              name: VSEngSS-MicroBuild2022-1ES # use windows for codesigning to make things easier https://dev.azure.com/devdiv/DevDiv/_wiki/wikis/DevDiv.wiki/650/MicroBuild-Signing
              os: windows
            templateContext:
              mb:
                signing:
                  enabled: true
                  signType: 'real'
                  signWithProd: true
              outputs:
                - output: pipelineArtifact
                  displayName: 'publish vsix artifact'
                  targetPath: 'build_output'
                  artifactName: $(ARTIFACT_NAME_VSIX)
            steps:
              - checkout: self
                fetchDepth: 1
                clean: true
                submodules: true
                fetchTags: false
                persistCredentials: True
              - task: NodeTool@0
                displayName: Use Node 24.15.0
                inputs:
                  versionSpec: 24.15.0
              - template: /build/templates/npmAuthenticate.yml@self
              - task: CmdLine@2
                displayName: npm install
                inputs:
                  script: npm run install:all
              - task: CmdLine@2
                displayName: Package VSIX
                inputs:
                  script: |
                    npm run package
                  workingDirectory: packages/vscode-pyright

              - task: PowerShell@2
                inputs:
                  targetType: 'inline'
                  script: 'Move-Item -Path "pyright-*.vsix" -Destination "$(VSIX_NAME)"'
                  workingDirectory: packages/vscode-pyright
                displayName: 'Move VSIX file'

              - task: CopyFiles@2
                displayName: 'Copy vsix to: build_output'
                inputs:
                  SourceFolder: packages/vscode-pyright
                  Contents: '$(VSIX_NAME)'
                  TargetFolder: build_output

              - script: |
                  npm install -g @vscode/vsce
                displayName: 'Install vsce and dependencies'

              - script: npx vsce generate-manifest -i $(VSIX_NAME) -o extension.manifest
                displayName: 'Generate extension manifest'
                workingDirectory: packages/vscode-pyright

              - task: NuGetToolInstaller@1
                displayName: 'Install NuGet'

              - task: NuGetCommand@2
                inputs:
                  command: 'restore'
                  restoreSolution: '$(Build.SourcesDirectory)/packages/vscode-pyright/packages.config'
                  restoreDirectory: '$(Build.SourcesDirectory)/packages/vscode-pyright/packages'

              - task: MSBuild@1
                displayName: 'Sign binaries'
                inputs:
                  solution: 'packages/vscode-pyright/sign.proj'
                  msbuildArguments: '/verbosity:diagnostic /p:SignType=real'

              - task: PowerShell@2
                displayName: 'Compare extension.manifest and extension.signature.p7s'
                inputs:
                  targetType: 'inline'
                  script: |
                    $manifestPath = "$(Build.SourcesDirectory)\packages\vscode-pyright\extension.manifest"
                    $signaturePath = "$(Build.SourcesDirectory)\packages\vscode-pyright\extension.signature.p7s"
                    $compareResult = Compare-Object (Get-Content $manifestPath) (Get-Content $signaturePath)
                    if ($compareResult -eq $null) {
                      Write-Error "Files are identical. Failing the build."
                      exit 1
                    } else {
                      Write-Output "Files are different."
                    }

              - task: CopyFiles@2
                displayName: 'Copy extension.manifest'
                inputs:
                  SourceFolder: 'packages/vscode-pyright'
                  Contents: 'extension.manifest'
                  TargetFolder: build_output

              - task: CopyFiles@2
                displayName: 'Copy extension.signature.p7s'
                inputs:
                  SourceFolder: 'packages/vscode-pyright'
                  Contents: 'extension.signature.p7s'
                  TargetFolder: build_output

      - stage: BuildNpm
        dependsOn: # Blank to allow running in parallel with BuildVsix
        jobs:
          - job: build_npm
            displayName: Build NPM
            templateContext:
              outputs:
                - output: pipelineArtifact
                  targetPath: '$(Build.ArtifactStagingDirectory)/${{ variables.ARTIFACT_NAME_PACKAGE }}/${{ variables.PACKAGE_NAME }}'
                  sbomBuildDropPath: '$(Build.ArtifactStagingDirectory)/${{ variables.ARTIFACT_NAME_PACKAGE }}'
                  artifactName: ${{ variables.ARTIFACT_NAME_PACKAGE }}
            steps:
              - checkout: self
                fetchDepth: 1
                clean: true
                submodules: true
                fetchTags: false
                persistCredentials: True
              - task: NodeTool@0
                displayName: Use Node 24.15.0
                inputs:
                  versionSpec: 24.15.0
              - template: /build/templates/npmAuthenticate.yml@self
              - task: CmdLine@2
                displayName: npm install
                inputs:
                  script: npm run install:all

              - script: npm pack
                displayName: npm pack
                workingDirectory: packages/pyright

              - script: mv pyright-*.tgz ${{ variables.PACKAGE_NAME }}
                displayName: Remove version from package name
                workingDirectory: packages/pyright

              # CredScan does not understand scanning a single file. So, it will default to scanning the whole folder that your output is pointing to.
              # We don't want it to scan the microbuild plugins, which is installed in the agent.stagedirectory by default.
              - task: CopyFiles@2
                displayName: 'Copy ${{ variables.PACKAGE_NAME }} to subfolder'
                inputs:
                  SourceFolder: packages/pyright
                  Contents: '${{ variables.PACKAGE_NAME }}'
                  TargetFolder: '$(Build.ArtifactStagingDirectory)/${{ variables.ARTIFACT_NAME_PACKAGE }}'

      - stage: CreateRelease
        dependsOn:
          - BuildVsix
          - BuildNpm
        jobs:
          - job: create_release
            displayName: Create GitHub Release
            templateContext:
              type: releaseJob
              isProduction: true
              inputs:
                - input: pipelineArtifact
                  artifactName: $(ARTIFACT_NAME_VSIX)
                  targetPath: $(Pipeline.Workspace)/$(ARTIFACT_NAME_VSIX)
                - input: pipelineArtifact
                  artifactName: $(ARTIFACT_NAME_PACKAGE)
                  targetPath: $(Pipeline.Workspace)/$(ARTIFACT_NAME_PACKAGE)
            steps:
              - checkout: none
              # Next step fails the build if https://github.com/microsoft/pyright/issues/10350 repros.
              - script: |
                  mkdir pyrightTest
                  cd pyrightTest
                  yarn
                  yarn add --dev $(Pipeline.Workspace)/$(ARTIFACT_NAME_PACKAGE)/$(PACKAGE_NAME)
                  node_modules/.bin/pyright --version
                displayName: Validate npm package
              - task: GitHubRelease@1 #https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/github-release-v1?view=azure-pipelines
                displayName: 'Create GitHub Release'
                inputs:
                  gitHubConnection: 'Github-Pylance' # The name of the GitHub service connection
                  repositoryName: 'microsoft/pyright' # The name of your GitHub repository
                  action: 'create'
                  isDraft: true
                  isPreRelease: false
                  addChangeLog: true
                  title: 'Published $(Build.SourceBranchName)'
                  assets: |
                    $(Pipeline.Workspace)/$(ARTIFACT_NAME_VSIX)/$(VSIX_NAME)
                    $(Pipeline.Workspace)/$(ARTIFACT_NAME_PACKAGE)/$(PACKAGE_NAME)

      - stage: WaitForValidation
        dependsOn:
          - CreateRelease
        jobs:
          - job: wait_for_validation
            displayName: Wait for manual validation
            pool: server
            templateContext:
              mb:
                publish:
                  enabled: false
            steps:
              - task: ManualValidation@0
                timeoutInMinutes: 120 # task times out in 2 hours
                inputs:
                  notifyUsers: '[DevDiv]\Python.Language Server,eric@traut.com'
                  instructions: 'In the next 2 hours please test the latest draft release of Pyright, then Publish the release in GitHub.'
                  onTimeout: 'reject' # require sign-off

      - stage: PublishToMarketplace
        dependsOn:
          - WaitForValidation
        jobs:
          - job: publish_extension
            displayName: Publish extension to marketplace
            steps:
              - checkout: none
              - task: NodeTool@0
                inputs:
                  versionSpec: 24.15.0
              - task: DownloadPipelineArtifact@2
                displayName: 'Download Artifacts from Validation Job'
                inputs:
                  buildType: 'current'
                  artifactName: '$(ARTIFACT_NAME_VSIX)'
                  targetPath: '$(System.ArtifactsDirectory)'
              # https://code.visualstudio.com/api/working-with-extensions/publishing-extension
              # Install dependencies and VS Code Extension Manager (vsce >= v2.26.1 needed)
              - script: |
                  npm install -g @vscode/vsce
                displayName: 'Install vsce and dependencies'
              # https://code.visualstudio.com/api/working-with-extensions/publishing-extension#get-a-personal-access-token
              # Publish to Marketplace
              # see. stackoverflow.com/collectives/ci-cd/articles/76873787/publish-azure-devops-extensions-using-azure-workload-identity
              # az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me --resource 499b84ac-1321-427f-aa17-267ca6975798
              - task: AzureCLI@2
                displayName: 'Publishing with Managed Identity'
                inputs:
                  azureSubscription: PyrightPublishPipelineSecureConnectionWithManagedIdentity
                  scriptType: 'pscore'
                  scriptLocation: 'inlineScript'
                  inlineScript: |
                    $aadToken = az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv
                    vsce publish --pat $aadToken --packagePath $(System.ArtifactsDirectory)/$(VSIX_NAME) --noVerify --manifestPath $(System.ArtifactsDirectory)/extension.manifest --signaturePath $(System.ArtifactsDirectory)/extension.signature.p7s

      - stage: PublishToNpm
        dependsOn:
          - WaitForValidation
          - PublishToMarketplace
        jobs:
          - job: publish_package
            displayName: Publish package to NPM

            pool:
              name: VSEngSS-MicroBuild2022-1ES # This pool is required to have the certs needed to publish using ESRP.
              os: windows
              image: server2022-microbuildVS2022-1es

            templateContext:
              type: releaseJob
              isProduction: true
              inputs:
                - input: pipelineArtifact
                  artifactName: $(ARTIFACT_NAME_PACKAGE)
                  targetPath: $(Build.StagingDirectory)/dist

            steps:
              - template: MicroBuild.Publish.yml@MicroBuildTemplate
                parameters:
                  intent: PackageDistribution
                  contentType: npm
                  contentSource: Folder
                  folderLocation: $(Build.StagingDirectory)/dist
                  waitForReleaseCompletion: true
                  owners: rchiodo@microsoft.com
                  approvers: grwheele@microsoft.com