Merge commit 'be3e8236086165e5e45a5a10783823874b3f3ebd' as 'lib/vscode'

2020-12-15 15:52:33 -07:00
parent 6c5c22ea8e be3e823608
commit 41bee49d07
4649 changed files with 1311795 additions and 0 deletions
--- a/lib/vscode/build/azure-pipelines/common/.gitignore
+++ b/lib/vscode/build/azure-pipelines/common/.gitignore
@ -0,0 +1,2 @@
+node_modules/
+*.js
--- a/lib/vscode/build/azure-pipelines/common/createAsset.ts
+++ b/lib/vscode/build/azure-pipelines/common/createAsset.ts
@ -0,0 +1,133 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as fs from 'fs';
+import { Readable } from 'stream';
+import * as crypto from 'crypto';
+import * as azure from 'azure-storage';
+import * as mime from 'mime';
+import { CosmosClient } from '@azure/cosmos';
+
+interface Asset {
+	platform: string;
+	type: string;
+	url: string;
+	mooncakeUrl?: string;
+	hash: string;
+	sha256hash: string;
+	size: number;
+	supportsFastUpdate?: boolean;
+}
+
+if (process.argv.length !== 6) {
+	console.error('Usage: node createAsset.js PLATFORM TYPE NAME FILE');
+	process.exit(-1);
+}
+
+function hashStream(hashName: string, stream: Readable): Promise<string> {
+	return new Promise<string>((c, e) => {
+		const shasum = crypto.createHash(hashName);
+
+		stream
+			.on('data', shasum.update.bind(shasum))
+			.on('error', e)
+			.on('close', () => c(shasum.digest('hex')));
+	});
+}
+
+async function doesAssetExist(blobService: azure.BlobService, quality: string, blobName: string): Promise<boolean | undefined> {
+	const existsResult = await new Promise<azure.BlobService.BlobResult>((c, e) => blobService.doesBlobExist(quality, blobName, (err, r) => err ? e(err) : c(r)));
+	return existsResult.exists;
+}
+
+async function uploadBlob(blobService: azure.BlobService, quality: string, blobName: string, filePath: string, fileName: string): Promise<void> {
+	const blobOptions: azure.BlobService.CreateBlockBlobRequestOptions = {
+		contentSettings: {
+			contentType: mime.lookup(filePath),
+			contentDisposition: `attachment; filename="${fileName}"`,
+			cacheControl: 'max-age=31536000, public'
+		}
+	};
+
+	await new Promise<void>((c, e) => blobService.createBlockBlobFromLocalFile(quality, blobName, filePath, blobOptions, err => err ? e(err) : c()));
+}
+
+function getEnv(name: string): string {
+	const result = process.env[name];
+
+	if (typeof result === 'undefined') {
+		throw new Error('Missing env: ' + name);
+	}
+
+	return result;
+}
+
+async function main(): Promise<void> {
+	const [, , platform, type, fileName, filePath] = process.argv;
+	const quality = getEnv('VSCODE_QUALITY');
+	const commit = getEnv('BUILD_SOURCEVERSION');
+
+	console.log('Creating asset...');
+
+	const stat = await new Promise<fs.Stats>((c, e) => fs.stat(filePath, (err, stat) => err ? e(err) : c(stat)));
+	const size = stat.size;
+
+	console.log('Size:', size);
+
+	const stream = fs.createReadStream(filePath);
+	const [sha1hash, sha256hash] = await Promise.all([hashStream('sha1', stream), hashStream('sha256', stream)]);
+
+	console.log('SHA1:', sha1hash);
+	console.log('SHA256:', sha256hash);
+
+	const blobName = commit + '/' + fileName;
+	const storageAccount = process.env['AZURE_STORAGE_ACCOUNT_2']!;
+
+	const blobService = azure.createBlobService(storageAccount, process.env['AZURE_STORAGE_ACCESS_KEY_2']!)
+		.withFilter(new azure.ExponentialRetryPolicyFilter(20));
+
+	const blobExists = await doesAssetExist(blobService, quality, blobName);
+
+	if (blobExists) {
+		console.log(`Blob ${quality}, ${blobName} already exists, not publishing again.`);
+		return;
+	}
+
+	console.log('Uploading blobs to Azure storage...');
+
+	await uploadBlob(blobService, quality, blobName, filePath, fileName);
+
+	console.log('Blobs successfully uploaded.');
+
+	const asset: Asset = {
+		platform,
+		type,
+		url: `${process.env['AZURE_CDN_URL']}/${quality}/${blobName}`,
+		hash: sha1hash,
+		sha256hash,
+		size
+	};
+
+	// Remove this if we ever need to rollback fast updates for windows
+	if (/win32/.test(platform)) {
+		asset.supportsFastUpdate = true;
+	}
+
+	console.log('Asset:', JSON.stringify(asset, null, '  '));
+
+	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const scripts = client.database('builds').container(quality).scripts;
+	await scripts.storedProcedure('createAsset').execute('', [commit, asset, true]);
+}
+
+main().then(() => {
+	console.log('Asset successfully created');
+	process.exit(0);
+}, err => {
+	console.error(err);
+	process.exit(1);
+});
--- a/lib/vscode/build/azure-pipelines/common/createBuild.ts
+++ b/lib/vscode/build/azure-pipelines/common/createBuild.ts
@ -0,0 +1,60 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import { CosmosClient } from '@azure/cosmos';
+
+if (process.argv.length !== 3) {
+	console.error('Usage: node createBuild.js VERSION');
+	process.exit(-1);
+}
+
+function getEnv(name: string): string {
+	const result = process.env[name];
+
+	if (typeof result === 'undefined') {
+		throw new Error('Missing env: ' + name);
+	}
+
+	return result;
+}
+
+async function main(): Promise<void> {
+	const [, , _version] = process.argv;
+	const quality = getEnv('VSCODE_QUALITY');
+	const commit = getEnv('BUILD_SOURCEVERSION');
+	const queuedBy = getEnv('BUILD_QUEUEDBY');
+	const sourceBranch = getEnv('BUILD_SOURCEBRANCH');
+	const version = _version + (quality === 'stable' ? '' : `-${quality}`);
+
+	console.log('Creating build...');
+	console.log('Quality:', quality);
+	console.log('Version:', version);
+	console.log('Commit:', commit);
+
+	const build = {
+		id: commit,
+		timestamp: (new Date()).getTime(),
+		version,
+		isReleased: false,
+		sourceBranch,
+		queuedBy,
+		assets: [],
+		updates: {}
+	};
+
+	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const scripts = client.database('builds').container(quality).scripts;
+	await scripts.storedProcedure('createBuild').execute('', [{ ...build, _partitionKey: '' }]);
+}
+
+main().then(() => {
+	console.log('Build successfully created');
+	process.exit(0);
+}, err => {
+	console.error(err);
+	process.exit(1);
+});
--- a/lib/vscode/build/azure-pipelines/common/extract-telemetry.sh
+++ b/lib/vscode/build/azure-pipelines/common/extract-telemetry.sh
@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -e
+
+cd $BUILD_STAGINGDIRECTORY
+mkdir extraction
+cd extraction
+git clone --depth 1 https://github.com/microsoft/vscode-extension-telemetry.git
+git clone --depth 1 https://github.com/microsoft/vscode-chrome-debug-core.git
+git clone --depth 1 https://github.com/microsoft/vscode-node-debug2.git
+git clone --depth 1 https://github.com/microsoft/vscode-node-debug.git
+git clone --depth 1 https://github.com/microsoft/vscode-html-languageservice.git
+git clone --depth 1 https://github.com/microsoft/vscode-json-languageservice.git
+node $BUILD_SOURCESDIRECTORY/build/node_modules/.bin/vscode-telemetry-extractor --sourceDir $BUILD_SOURCESDIRECTORY --excludedDir $BUILD_SOURCESDIRECTORY/extensions --outputDir . --applyEndpoints
+node $BUILD_SOURCESDIRECTORY/build/node_modules/.bin/vscode-telemetry-extractor --config $BUILD_SOURCESDIRECTORY/build/azure-pipelines/common/telemetry-config.json -o .
+mkdir -p $BUILD_SOURCESDIRECTORY/.build/telemetry
+mv declarations-resolved.json $BUILD_SOURCESDIRECTORY/.build/telemetry/telemetry-core.json
+mv config-resolved.json $BUILD_SOURCESDIRECTORY/.build/telemetry/telemetry-extensions.json
+cd ..
+rm -rf extraction
--- a/lib/vscode/build/azure-pipelines/common/publish-webview.sh
+++ b/lib/vscode/build/azure-pipelines/common/publish-webview.sh
@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -e
+REPO="$(pwd)"
+
+# Publish webview contents
+PACKAGEJSON="$REPO/package.json"
+VERSION=$(node -p "require(\"$PACKAGEJSON\").version")
+
+node build/azure-pipelines/common/publish-webview.js "$REPO/src/vs/workbench/contrib/webview/browser/pre/"
--- a/lib/vscode/build/azure-pipelines/common/publish-webview.ts
+++ b/lib/vscode/build/azure-pipelines/common/publish-webview.ts
@ -0,0 +1,87 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as azure from 'azure-storage';
+import * as mime from 'mime';
+import * as minimist from 'minimist';
+import { basename, join } from 'path';
+
+const fileNames = [
+	'fake.html',
+	'host.js',
+	'index.html',
+	'main.js',
+	'service-worker.js'
+];
+
+async function assertContainer(blobService: azure.BlobService, container: string): Promise<void> {
+	await new Promise<void>((c, e) => blobService.createContainerIfNotExists(container, { publicAccessLevel: 'blob' }, err => err ? e(err) : c()));
+}
+
+async function doesBlobExist(blobService: azure.BlobService, container: string, blobName: string): Promise<boolean | undefined> {
+	const existsResult = await new Promise<azure.BlobService.BlobResult>((c, e) => blobService.doesBlobExist(container, blobName, (err, r) => err ? e(err) : c(r)));
+	return existsResult.exists;
+}
+
+async function uploadBlob(blobService: azure.BlobService, container: string, blobName: string, file: string): Promise<void> {
+	const blobOptions: azure.BlobService.CreateBlockBlobRequestOptions = {
+		contentSettings: {
+			contentType: mime.lookup(file),
+			cacheControl: 'max-age=31536000, public'
+		}
+	};
+
+	await new Promise<void>((c, e) => blobService.createBlockBlobFromLocalFile(container, blobName, file, blobOptions, err => err ? e(err) : c()));
+}
+
+async function publish(commit: string, files: readonly string[]): Promise<void> {
+
+	console.log('Publishing...');
+	console.log('Commit:', commit);
+	const storageAccount = process.env['AZURE_WEBVIEW_STORAGE_ACCOUNT']!;
+
+	const blobService = azure.createBlobService(storageAccount, process.env['AZURE_WEBVIEW_STORAGE_ACCESS_KEY']!)
+		.withFilter(new azure.ExponentialRetryPolicyFilter(20));
+
+	await assertContainer(blobService, commit);
+
+	for (const file of files) {
+		const blobName = basename(file);
+		const blobExists = await doesBlobExist(blobService, commit, blobName);
+		if (blobExists) {
+			console.log(`Blob ${commit}, ${blobName} already exists, not publishing again.`);
+			continue;
+		}
+		console.log('Uploading blob to Azure storage...');
+		await uploadBlob(blobService, commit, blobName, file);
+	}
+
+	console.log('Blobs successfully uploaded.');
+}
+
+function main(): void {
+	const commit = process.env['BUILD_SOURCEVERSION'];
+
+	if (!commit) {
+		console.warn('Skipping publish due to missing BUILD_SOURCEVERSION');
+		return;
+	}
+
+	const opts = minimist(process.argv.slice(2));
+	const [directory] = opts._;
+
+	const files = fileNames.map(fileName => join(directory, fileName));
+
+	publish(commit, files).catch(err => {
+		console.error(err);
+		process.exit(1);
+	});
+}
+
+if (process.argv.length < 3) {
+	console.error('Usage: node publish.js <directory>');
+	process.exit(-1);
+}
+main();
--- a/lib/vscode/build/azure-pipelines/common/releaseBuild.ts
+++ b/lib/vscode/build/azure-pipelines/common/releaseBuild.ts
@ -0,0 +1,70 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import { CosmosClient } from '@azure/cosmos';
+
+function getEnv(name: string): string {
+	const result = process.env[name];
+
+	if (typeof result === 'undefined') {
+		throw new Error('Missing env: ' + name);
+	}
+
+	return result;
+}
+
+interface Config {
+	id: string;
+	frozen: boolean;
+}
+
+function createDefaultConfig(quality: string): Config {
+	return {
+		id: quality,
+		frozen: false
+	};
+}
+
+async function getConfig(client: CosmosClient, quality: string): Promise<Config> {
+	const query = `SELECT TOP 1 * FROM c WHERE c.id = "${quality}"`;
+
+	const res = await client.database('builds').container('config').items.query(query).fetchAll();
+
+	if (res.resources.length === 0) {
+		return createDefaultConfig(quality);
+	}
+
+	return res.resources[0] as Config;
+}
+
+async function main(): Promise<void> {
+	const commit = getEnv('BUILD_SOURCEVERSION');
+	const quality = getEnv('VSCODE_QUALITY');
+
+	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const config = await getConfig(client, quality);
+
+	console.log('Quality config:', config);
+
+	if (config.frozen) {
+		console.log(`Skipping release because quality ${quality} is frozen.`);
+		return;
+	}
+
+	console.log(`Releasing build ${commit}...`);
+
+	const scripts = client.database('builds').container(quality).scripts;
+	await scripts.storedProcedure('releaseBuild').execute('', [commit]);
+}
+
+main().then(() => {
+	console.log('Build successfully released');
+	process.exit(0);
+}, err => {
+	console.error(err);
+	process.exit(1);
+});
--- a/lib/vscode/build/azure-pipelines/common/sync-mooncake.ts
+++ b/lib/vscode/build/azure-pipelines/common/sync-mooncake.ts
@ -0,0 +1,130 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as url from 'url';
+import * as azure from 'azure-storage';
+import * as mime from 'mime';
+import { CosmosClient } from '@azure/cosmos';
+
+function log(...args: any[]) {
+	console.log(...[`[${new Date().toISOString()}]`, ...args]);
+}
+
+function error(...args: any[]) {
+	console.error(...[`[${new Date().toISOString()}]`, ...args]);
+}
+
+if (process.argv.length < 3) {
+	error('Usage: node sync-mooncake.js <quality>');
+	process.exit(-1);
+}
+
+interface Build {
+	assets: Asset[];
+}
+
+interface Asset {
+	platform: string;
+	type: string;
+	url: string;
+	mooncakeUrl: string;
+	hash: string;
+	sha256hash: string;
+	size: number;
+	supportsFastUpdate?: boolean;
+}
+
+async function sync(commit: string, quality: string): Promise<void> {
+	log(`Synchronizing Mooncake assets for ${quality}, ${commit}...`);
+
+	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const container = client.database('builds').container(quality);
+
+	const query = `SELECT TOP 1 * FROM c WHERE c.id = "${commit}"`;
+	const res = await container.items.query<Build>(query, {}).fetchAll();
+
+	if (res.resources.length !== 1) {
+		throw new Error(`No builds found for ${commit}`);
+	}
+
+	const build = res.resources[0];
+
+	log(`Found build for ${commit}, with ${build.assets.length} assets`);
+
+	const storageAccount = process.env['AZURE_STORAGE_ACCOUNT_2']!;
+
+	const blobService = azure.createBlobService(storageAccount, process.env['AZURE_STORAGE_ACCESS_KEY_2']!)
+		.withFilter(new azure.ExponentialRetryPolicyFilter(20));
+
+	const mooncakeBlobService = azure.createBlobService(storageAccount, process.env['MOONCAKE_STORAGE_ACCESS_KEY']!, `${storageAccount}.blob.core.chinacloudapi.cn`)
+		.withFilter(new azure.ExponentialRetryPolicyFilter(20));
+
+	// mooncake is fussy and far away, this is needed!
+	blobService.defaultClientRequestTimeoutInMs = 10 * 60 * 1000;
+	mooncakeBlobService.defaultClientRequestTimeoutInMs = 10 * 60 * 1000;
+
+	for (const asset of build.assets) {
+		try {
+			const blobPath = url.parse(asset.url).path;
+
+			if (!blobPath) {
+				throw new Error(`Failed to parse URL: ${asset.url}`);
+			}
+
+			const blobName = blobPath.replace(/^\/\w+\//, '');
+
+			log(`Found ${blobName}`);
+
+			if (asset.mooncakeUrl) {
+				log(`  Already in Mooncake ✔️`);
+				continue;
+			}
+
+			const readStream = blobService.createReadStream(quality, blobName, undefined!);
+			const blobOptions: azure.BlobService.CreateBlockBlobRequestOptions = {
+				contentSettings: {
+					contentType: mime.lookup(blobPath),
+					cacheControl: 'max-age=31536000, public'
+				}
+			};
+
+			const writeStream = mooncakeBlobService.createWriteStreamToBlockBlob(quality, blobName, blobOptions, undefined);
+
+			log(`  Uploading to Mooncake...`);
+			await new Promise((c, e) => readStream.pipe(writeStream).on('finish', c).on('error', e));
+
+			log(`  Updating build in DB...`);
+			const mooncakeUrl = `${process.env['MOONCAKE_CDN_URL']}${blobPath}`;
+			await container.scripts.storedProcedure('setAssetMooncakeUrl')
+				.execute('', [commit, asset.platform, asset.type, mooncakeUrl]);
+
+			log(`  Done ✔️`);
+		} catch (err) {
+			error(err);
+		}
+	}
+
+	log(`All done ✔️`);
+}
+
+function main(): void {
+	const commit = process.env['BUILD_SOURCEVERSION'];
+
+	if (!commit) {
+		error('Skipping publish due to missing BUILD_SOURCEVERSION');
+		return;
+	}
+
+	const quality = process.argv[2];
+
+	sync(commit, quality).catch(err => {
+		error(err);
+		process.exit(1);
+	});
+}
+
+main();
--- a/lib/vscode/build/azure-pipelines/common/telemetry-config.json
+++ b/lib/vscode/build/azure-pipelines/common/telemetry-config.json
@ -0,0 +1,72 @@
+[
+	{
+		"eventPrefix": "typescript-language-features/",
+		"sourceDirs": [
+			"../../s/extensions/typescript-language-features"
+		],
+		"excludedDirs": [],
+		"applyEndpoints": true
+	},
+	{
+		"eventPrefix": "git/",
+		"sourceDirs": [
+			"../../s/extensions/git"
+		],
+		"excludedDirs": [],
+		"applyEndpoints": true
+	},
+	{
+		"eventPrefix": "extension-telemetry/",
+		"sourceDirs": [
+			"vscode-extension-telemetry"
+		],
+		"excludedDirs": [],
+		"applyEndpoints": true
+	},
+	{
+		"eventPrefix": "vscode-markdown/",
+		"sourceDirs": [
+			"../../s/extensions/markdown-language-features"
+		],
+		"excludedDirs": [],
+		"applyEndpoints": true
+	},
+	{
+		"eventPrefix": "html-language-features/",
+		"sourceDirs": [
+			"../../s/extensions/html-language-features",
+			"vscode-html-languageservice"
+		],
+		"excludedDirs": [],
+		"applyEndpoints": true
+	},
+	{
+		"eventPrefix": "json-language-features/",
+		"sourceDirs": [
+			"../../s/extensions/json-language-features",
+			"vscode-json-languageservice"
+		],
+		"excludedDirs": [],
+		"applyEndpoints": true
+	},
+	{
+		"eventPrefix": "ms-vscode.node2/",
+		"sourceDirs": [
+			"vscode-chrome-debug-core",
+			"vscode-node-debug2"
+		],
+		"excludedDirs": [],
+		"applyEndpoints": true,
+		"patchDebugEvents": true
+	},
+	{
+		"eventPrefix": "ms-vscode.node/",
+		"sourceDirs": [
+			"vscode-chrome-debug-core",
+			"vscode-node-debug"
+		],
+		"excludedDirs": [],
+		"applyEndpoints": true,
+		"patchDebugEvents": true
+	}
+]
--- a/lib/vscode/build/azure-pipelines/darwin/app-entitlements.plist
+++ b/lib/vscode/build/azure-pipelines/darwin/app-entitlements.plist
@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+</dict>
+</plist>
--- a/lib/vscode/build/azure-pipelines/darwin/continuous-build-darwin.yml
+++ b/lib/vscode/build/azure-pipelines/darwin/continuous-build-darwin.yml
@ -0,0 +1,79 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'vscode-build-cache'
+
+- script: |
+    CHILD_CONCURRENCY=1 yarn --frozen-lockfile
+  displayName: Install Dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'vscode-build-cache'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    yarn postinstall
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- script: |
+    yarn electron x64
+  displayName: Download Electron
+
+- script: |
+    yarn monaco-compile-check
+  displayName: Run Monaco Editor Checks
+
+- script: |
+    yarn valid-layers-check
+  displayName: Run Valid Layers Checks
+
+- script: |
+    yarn compile
+  displayName: Compile Sources
+
+- script: |
+    yarn download-builtin-extensions
+  displayName: Download Built-in Extensions
+
+- script: |
+    ./scripts/test.sh --tfs "Unit Tests"
+  displayName: Run Unit Tests (Electron)
+
+- script: |
+    yarn test-browser --browser chromium --browser webkit --browser firefox --tfs "Browser Unit Tests"
+  displayName: Run Unit Tests (Browser)
+
+- script: |
+    ./scripts/test-integration.sh --tfs "Integration Tests"
+  displayName: Run Integration Tests (Electron)
+
+- task: PublishPipelineArtifact@0
+  inputs:
+    artifactName: crash-dump-macos
+    targetPath: .build/crashes
+  displayName: 'Publish Crash Reports'
+  continueOnError: true
+  condition: failed()
+
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()
--- a/lib/vscode/build/azure-pipelines/darwin/helper-gpu-entitlements.plist
+++ b/lib/vscode/build/azure-pipelines/darwin/helper-gpu-entitlements.plist
@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+</dict>
+</plist>
--- a/lib/vscode/build/azure-pipelines/darwin/helper-plugin-entitlements.plist
+++ b/lib/vscode/build/azure-pipelines/darwin/helper-plugin-entitlements.plist
@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>
--- a/lib/vscode/build/azure-pipelines/darwin/helper-renderer-entitlements.plist
+++ b/lib/vscode/build/azure-pipelines/darwin/helper-renderer-entitlements.plist
@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+</dict>
+</plist>
--- a/lib/vscode/build/azure-pipelines/darwin/product-build-darwin.yml
+++ b/lib/vscode/build/azure-pipelines/darwin/product-build-darwin.yml
@ -0,0 +1,270 @@
+steps:
+- script: |
+    mkdir -p .build
+    echo -n $BUILD_SOURCEVERSION > .build/commit
+    echo -n $VSCODE_QUALITY > .build/quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+
+- script: |
+    set -e
+    exit 1
+  displayName: Check RestoreCache
+  condition: and(succeeded(), ne(variables['CacheRestored-Compilation'], 'true'))
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- script: |
+    set -e
+
+    cat << EOF > ~/.netrc
+    machine github.com
+    login vscode
+    password $(github-distro-mixin-password)
+    EOF
+
+    git config user.email "vscode@microsoft.com"
+    git config user.name "VSCode"
+  displayName: Prepare tooling
+
+- script: |
+    set -e
+    git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git"
+    git fetch distro
+    git merge $(node -p "require('./package.json').distro")
+  displayName: Merge distro
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+
+- script: |
+    set -e
+    CHILD_CONCURRENCY=1 yarn --frozen-lockfile
+  displayName: Install dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    yarn postinstall
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    node build/azure-pipelines/mixin
+  displayName: Mix in quality
+
+- script: |
+    set -e
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+      yarn gulp vscode-darwin-min-ci
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+      yarn gulp vscode-reh-darwin-min-ci
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+      yarn gulp vscode-reh-web-darwin-min-ci
+  displayName: Build
+
+- script: |
+    set -e
+    ./scripts/test.sh --build --tfs "Unit Tests"
+  displayName: Run unit tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    yarn test-browser --build --browser chromium --browser webkit --browser firefox --tfs "Browser Unit Tests"
+  displayName: Run unit tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    # Figure out the full absolute path of the product we just built
+    # including the remote server and configure the integration tests
+    # to run with these builds instead of running out of sources.
+    set -e
+    APP_ROOT=$(agent.builddirectory)/VSCode-darwin
+    APP_NAME="`ls $APP_ROOT | head -n 1`"
+    INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME/Contents/MacOS/Electron" \
+    VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-darwin" \
+    ./scripts/test-integration.sh --build --tfs "Integration Tests"
+  displayName: Run integration tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-darwin" \
+    ./resources/server/test/test-web-integration.sh --browser webkit
+  displayName: Run integration tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    APP_ROOT=$(agent.builddirectory)/VSCode-darwin
+    APP_NAME="`ls $APP_ROOT | head -n 1`"
+    INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME/Contents/MacOS/Electron" \
+    VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-darwin" \
+    ./resources/server/test/test-remote-integration.sh
+  displayName: Run remote integration tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    APP_ROOT=$(agent.builddirectory)/VSCode-darwin
+    APP_NAME="`ls $APP_ROOT | head -n 1`"
+    yarn smoketest --build "$APP_ROOT/$APP_NAME"
+  continueOnError: true
+  displayName: Run smoke tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-darwin" \
+    yarn smoketest --web --headless
+  continueOnError: true
+  displayName: Run smoke tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- task: PublishPipelineArtifact@0
+  inputs:
+    artifactName: crash-dump-macos
+    targetPath: .build/crashes
+  displayName: 'Publish Crash Reports'
+  continueOnError: true
+  condition: failed()
+
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()
+
+- script: |
+    set -e
+    security create-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
+    security default-keychain -s $(agent.tempdirectory)/buildagent.keychain
+    security unlock-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
+    echo "$(macos-developer-certificate)" | base64 -D > $(agent.tempdirectory)/cert.p12
+    security import $(agent.tempdirectory)/cert.p12 -k $(agent.tempdirectory)/buildagent.keychain -P "$(macos-developer-certificate-key)" -T /usr/bin/codesign
+    security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd $(agent.tempdirectory)/buildagent.keychain
+    DEBUG=electron-osx-sign* node build/darwin/sign.js
+  displayName: Set Hardened Entitlements
+
+- script: |
+    set -e
+    pushd $(agent.builddirectory)/VSCode-darwin && zip -r -X -y $(agent.builddirectory)/VSCode-darwin.zip * && popd
+  displayName: Archive build
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)'
+    Pattern: 'VSCode-darwin.zip'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-401337-Apple",
+          "operationSetCode": "MacAppDeveloperSign",
+          "parameters": [
+            {
+              "parameterName": "Hardening",
+              "parameterValue": "--options=runtime"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 60
+  displayName: Codesign
+
+- script: |
+    zip -d $(agent.builddirectory)/VSCode-darwin.zip "*.pkg"
+  displayName: Clean Archive
+
+- script: |
+    APP_ROOT=$(agent.builddirectory)/VSCode-darwin
+    APP_NAME="`ls $APP_ROOT | head -n 1`"
+    BUNDLE_IDENTIFIER=$(node -p "require(\"$APP_ROOT/$APP_NAME/Contents/Resources/app/product.json\").darwinBundleIdentifier")
+    echo "##vso[task.setvariable variable=BundleIdentifier]$BUNDLE_IDENTIFIER"
+  displayName: Export bundle identifier
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)'
+    Pattern: 'VSCode-darwin.zip'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-401337-Apple",
+          "operationSetCode": "MacAppNotarize",
+          "parameters": [
+            {
+              "parameterName": "BundleId",
+              "parameterValue": "$(BundleIdentifier)"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 60
+  displayName: Notarization
+
+- script: |
+    set -e
+    APP_ROOT=$(agent.builddirectory)/VSCode-darwin
+    APP_NAME="`ls $APP_ROOT | head -n 1`"
+    "$APP_ROOT/$APP_NAME/Contents/Resources/app/bin/code" --export-default-configuration=.build
+  displayName: Verify start after signing (export configuration)
+
+- script: |
+    set -e
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+    AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+    AZURE_STORAGE_ACCESS_KEY="$(ticino-storage-key)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(vscode-storage-key)" \
+    VSCODE_ARCH="$(VSCODE_ARCH)" \
+    ./build/azure-pipelines/darwin/publish.sh
+  displayName: Publish
+
+- script: |
+    AZURE_STORAGE_ACCESS_KEY="$(ticino-storage-key)" \
+    yarn gulp upload-vscode-configuration
+  displayName: Upload configuration (for Bing settings search)
+  continueOnError: true
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true
--- a/lib/vscode/build/azure-pipelines/darwin/publish.sh
+++ b/lib/vscode/build/azure-pipelines/darwin/publish.sh
@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -e
+
+# publish the build
+node build/azure-pipelines/common/createAsset.js \
+	darwin \
+	archive \
+	"VSCode-darwin-$VSCODE_QUALITY.zip" \
+	../VSCode-darwin.zip
+
+if [ "$VSCODE_ARCH" == "x64" ]; then
+	# package Remote Extension Host
+	pushd .. && mv vscode-reh-darwin vscode-server-darwin && zip -Xry vscode-server-darwin.zip vscode-server-darwin && popd
+
+	# publish Remote Extension Host
+	node build/azure-pipelines/common/createAsset.js \
+		server-darwin \
+		archive-unsigned \
+		"vscode-server-darwin.zip" \
+		../vscode-server-darwin.zip
+fi
--- a/lib/vscode/build/azure-pipelines/distro-build.yml
+++ b/lib/vscode/build/azure-pipelines/distro-build.yml
@ -0,0 +1,42 @@
+trigger:
+  branches:
+    include: ['master', 'release/*']
+pr:
+  branches:
+    include: ['master', 'release/*']
+
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- script: |
+    set -e
+
+    cat << EOF > ~/.netrc
+    machine github.com
+    login vscode
+    password $(github-distro-mixin-password)
+    EOF
+
+    git config user.email "vscode@microsoft.com"
+    git config user.name "VSCode"
+
+    git remote add distro "https://github.com/$VSCODE_MIXIN_REPO.git"
+    git fetch distro
+
+    # Push master branch into oss/master
+    git push distro origin/master:refs/heads/oss/master
+
+    # Push every release branch into oss/release
+    git for-each-ref --format="%(refname:short)" refs/remotes/origin/release/* | sed 's/^origin\/\(.*\)$/\0:refs\/heads\/oss\/\1/' | xargs git push distro
+
+    git merge $(node -p "require('./package.json').distro")
+
+  displayName: Sync & Merge Distro
--- a/lib/vscode/build/azure-pipelines/exploration-build.yml
+++ b/lib/vscode/build/azure-pipelines/exploration-build.yml
@ -0,0 +1,40 @@
+pool:
+  vmImage: 'Ubuntu-16.04'
+
+trigger:
+  branches:
+    include: ['master']
+pr:
+  branches:
+    include: ['master']
+
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- script: |
+    set -e
+
+    cat << EOF > ~/.netrc
+    machine github.com
+    login vscode
+    password $(github-distro-mixin-password)
+    EOF
+
+    git config user.email "vscode@microsoft.com"
+    git config user.name "VSCode"
+
+    git checkout origin/electron-11.x.y
+    git merge origin/master
+
+    # Push master branch into exploration branch
+    git push origin HEAD:electron-11.x.y
+
+  displayName: Sync & Merge Exploration
--- a/lib/vscode/build/azure-pipelines/linux/.gitignore
+++ b/lib/vscode/build/azure-pipelines/linux/.gitignore
@ -0,0 +1 @@
+pat
--- a/lib/vscode/build/azure-pipelines/linux/continuous-build-linux.yml
+++ b/lib/vscode/build/azure-pipelines/linux/continuous-build-linux.yml
@ -0,0 +1,92 @@
+steps:
+- script: |
+    set -e
+    sudo apt-get update
+    sudo apt-get install -y libxkbfile-dev pkg-config libsecret-1-dev libxss1 dbus xvfb libgtk-3-0
+    sudo cp build/azure-pipelines/linux/xvfb.init /etc/init.d/xvfb
+    sudo chmod +x /etc/init.d/xvfb
+    sudo update-rc.d xvfb defaults
+    sudo service xvfb start
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'vscode-build-cache'
+
+- script: |
+    CHILD_CONCURRENCY=1 yarn --frozen-lockfile
+  displayName: Install Dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'vscode-build-cache'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    yarn postinstall
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- script: |
+    yarn electron x64
+  displayName: Download Electron
+
+- script: |
+    yarn gulp hygiene
+  displayName: Run Hygiene Checks
+
+- script: |
+    yarn monaco-compile-check
+  displayName: Run Monaco Editor Checks
+
+- script: |
+    yarn valid-layers-check
+  displayName: Run Valid Layers Checks
+
+- script: |
+    yarn compile
+  displayName: Compile Sources
+
+- script: |
+    yarn download-builtin-extensions
+  displayName: Download Built-in Extensions
+
+- script: |
+    DISPLAY=:10 ./scripts/test.sh --tfs "Unit Tests"
+  displayName: Run Unit Tests (Electron)
+
+- script: |
+    DISPLAY=:10 yarn test-browser --browser chromium --tfs "Browser Unit Tests"
+  displayName: Run Unit Tests (Browser)
+
+- script: |
+    DISPLAY=:10 ./scripts/test-integration.sh --tfs "Integration Tests"
+  displayName: Run Integration Tests (Electron)
+
+- task: PublishPipelineArtifact@0
+  inputs:
+    artifactName: crash-dump-linux
+    targetPath: .build/crashes
+  displayName: 'Publish Crash Reports'
+  continueOnError: true
+  condition: failed()
+
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/alpine/build.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/alpine/build.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/alpine/prebuild.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/alpine/prebuild.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/alpine/publish.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/alpine/publish.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/arm64/build.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/arm64/build.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/arm64/prebuild.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/arm64/prebuild.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/arm64/publish.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/arm64/publish.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/armhf/build.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/armhf/build.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/armhf/prebuild.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/armhf/prebuild.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/multiarch/armhf/publish.sh
+++ b/lib/vscode/build/azure-pipelines/linux/multiarch/armhf/publish.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -e
+echo 'noop'
--- a/lib/vscode/build/azure-pipelines/linux/product-build-linux-multiarch.yml
+++ b/lib/vscode/build/azure-pipelines/linux/product-build-linux-multiarch.yml
@ -0,0 +1,115 @@
+steps:
+- script: |
+    mkdir -p .build
+    echo -n $BUILD_SOURCEVERSION > .build/commit
+    echo -n $VSCODE_QUALITY > .build/quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+
+- script: |
+    set -e
+    exit 1
+  displayName: Check RestoreCache
+  condition: and(succeeded(), ne(variables['CacheRestored-Compilation'], 'true'))
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- task: Docker@1
+  displayName: 'Pull image'
+  inputs:
+    azureSubscriptionEndpoint: 'vscode-builds-subscription'
+    azureContainerRegistry: vscodehub.azurecr.io
+    command: 'Run an image'
+    imageName: 'vscode-linux-build-agent:$(VSCODE_ARCH)'
+    containerCommand: uname
+
+- script: |
+    set -e
+
+    cat << EOF > ~/.netrc
+    machine github.com
+    login vscode
+    password $(github-distro-mixin-password)
+    EOF
+
+    git config user.email "vscode@microsoft.com"
+    git config user.name "VSCode"
+  displayName: Prepare tooling
+
+- script: |
+    set -e
+    git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git"
+    git fetch distro
+    git merge $(node -p "require('./package.json').distro")
+  displayName: Merge distro
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+
+- script: |
+    set -e
+    CHILD_CONCURRENCY=1 yarn --frozen-lockfile
+  displayName: Install dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    yarn postinstall
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    node build/azure-pipelines/mixin
+  displayName: Mix in quality
+
+- script: |
+    set -e
+    CHILD_CONCURRENCY=1 ./build/azure-pipelines/linux/multiarch/$(VSCODE_ARCH)/prebuild.sh
+  displayName: Prebuild
+
+- script: |
+    set -e
+    ./build/azure-pipelines/linux/multiarch/$(VSCODE_ARCH)/build.sh
+  displayName: Build
+
+- script: |
+    set -e
+    AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(vscode-storage-key)" \
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+    ./build/azure-pipelines/linux/multiarch/$(VSCODE_ARCH)/publish.sh
+  displayName: Publish
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true
--- a/lib/vscode/build/azure-pipelines/linux/product-build-linux.yml
+++ b/lib/vscode/build/azure-pipelines/linux/product-build-linux.yml
@ -0,0 +1,217 @@
+steps:
+- script: |
+    mkdir -p .build
+    echo -n $BUILD_SOURCEVERSION > .build/commit
+    echo -n $VSCODE_QUALITY > .build/quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+
+- script: |
+    set -e
+    exit 1
+  displayName: Check RestoreCache
+  condition: and(succeeded(), ne(variables['CacheRestored-Compilation'], 'true'))
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- script: |
+    set -e
+    cat << EOF > ~/.netrc
+    machine github.com
+    login vscode
+    password $(github-distro-mixin-password)
+    EOF
+
+    git config user.email "vscode@microsoft.com"
+    git config user.name "VSCode"
+  displayName: Prepare tooling
+
+- script: |
+    set -e
+    git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git"
+    git fetch distro
+    git merge $(node -p "require('./package.json').distro")
+  displayName: Merge distro
+
+- script: |
+    echo -n $VSCODE_ARCH > .build/arch
+  displayName: Prepare arch cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: '.build/arch, build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+
+- script: |
+    set -e
+    CHILD_CONCURRENCY=1 npm_config_arch=$(NPM_ARCH) yarn --frozen-lockfile
+  displayName: Install dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: '.build/arch, build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    yarn postinstall
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    node build/azure-pipelines/mixin
+  displayName: Mix in quality
+
+- script: |
+    set -e
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+      yarn gulp vscode-linux-$(VSCODE_ARCH)-min-ci
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+      yarn gulp vscode-reh-linux-$(VSCODE_ARCH)-min-ci
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+      yarn gulp vscode-reh-web-linux-$(VSCODE_ARCH)-min-ci
+  displayName: Build
+
+- script: |
+    set -e
+    service xvfb start
+  displayName: Start xvfb
+  condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    DISPLAY=:10 ./scripts/test.sh --build --tfs "Unit Tests"
+  displayName: Run unit tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    DISPLAY=:10 yarn test-browser --build --browser chromium --tfs "Browser Unit Tests"
+  displayName: Run unit tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    # Figure out the full absolute path of the product we just built
+    # including the remote server and configure the integration tests
+    # to run with these builds instead of running out of sources.
+    set -e
+    APP_ROOT=$(agent.builddirectory)/VSCode-linux-$(VSCODE_ARCH)
+    APP_NAME=$(node -p "require(\"$APP_ROOT/resources/app/product.json\").applicationName")
+    INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME" \
+    VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-linux-$(VSCODE_ARCH)" \
+    DISPLAY=:10 ./scripts/test-integration.sh --build --tfs "Integration Tests"
+  displayName: Run integration tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-linux-$(VSCODE_ARCH)" \
+    DISPLAY=:10 ./resources/server/test/test-web-integration.sh --browser chromium
+  displayName: Run integration tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    APP_ROOT=$(agent.builddirectory)/VSCode-linux-$(VSCODE_ARCH)
+    APP_NAME=$(node -p "require(\"$APP_ROOT/resources/app/product.json\").applicationName")
+    INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME" \
+    VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-linux-$(VSCODE_ARCH)" \
+    DISPLAY=:10 ./resources/server/test/test-remote-integration.sh
+  displayName: Run remote integration tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- task: PublishPipelineArtifact@0
+  inputs:
+    artifactName: 'crash-dump-linux-$(VSCODE_ARCH)'
+    targetPath: .build/crashes
+  displayName: 'Publish Crash Reports'
+  continueOnError: true
+  condition: failed()
+
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: and(succeededOrFailed(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -e
+    yarn gulp "vscode-linux-$(VSCODE_ARCH)-build-deb"
+    yarn gulp "vscode-linux-$(VSCODE_ARCH)-build-rpm"
+  displayName: Build deb, rpm packages
+
+- script: |
+    set -e
+    yarn gulp "vscode-linux-$(VSCODE_ARCH)-prepare-snap"
+  displayName: Prepare snap package
+  condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'))
+
+# needed for code signing
+- task: UseDotNet@2
+  displayName: 'Install .NET Core SDK 2.x'
+  inputs:
+    version: 2.x
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '.build/linux/rpm'
+    Pattern: '*.rpm'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-450779-Pgp",
+          "operationSetCode": "LinuxSign",
+          "parameters": [ ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+  displayName: Codesign rpm
+
+- script: |
+    set -e
+    AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(vscode-storage-key)" \
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+    VSCODE_ARCH="$(VSCODE_ARCH)" \
+    ./build/azure-pipelines/linux/publish.sh
+  displayName: Publish
+
+- task: PublishPipelineArtifact@0
+  displayName: 'Publish Pipeline Artifact'
+  inputs:
+    artifactName: 'snap-$(VSCODE_ARCH)'
+    targetPath: .build/linux/snap-tarball
+  condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'))
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true
--- a/lib/vscode/build/azure-pipelines/linux/publish.sh
+++ b/lib/vscode/build/azure-pipelines/linux/publish.sh
@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -e
+REPO="$(pwd)"
+ROOT="$REPO/.."
+
+# Publish tarball
+PLATFORM_LINUX="linux-$VSCODE_ARCH"
+BUILDNAME="VSCode-$PLATFORM_LINUX"
+BUILD_VERSION="$(date +%s)"
+[ -z "$VSCODE_QUALITY" ] && TARBALL_FILENAME="code-$VSCODE_ARCH-$BUILD_VERSION.tar.gz" || TARBALL_FILENAME="code-$VSCODE_QUALITY-$VSCODE_ARCH-$BUILD_VERSION.tar.gz"
+TARBALL_PATH="$ROOT/$TARBALL_FILENAME"
+
+rm -rf $ROOT/code-*.tar.*
+(cd $ROOT && tar -czf $TARBALL_PATH $BUILDNAME)
+
+node build/azure-pipelines/common/createAsset.js "$PLATFORM_LINUX" archive-unsigned "$TARBALL_FILENAME" "$TARBALL_PATH"
+
+# Publish Remote Extension Host
+LEGACY_SERVER_BUILD_NAME="vscode-reh-$PLATFORM_LINUX"
+SERVER_BUILD_NAME="vscode-server-$PLATFORM_LINUX"
+SERVER_TARBALL_FILENAME="vscode-server-$PLATFORM_LINUX.tar.gz"
+SERVER_TARBALL_PATH="$ROOT/$SERVER_TARBALL_FILENAME"
+
+rm -rf $ROOT/vscode-server-*.tar.*
+(cd $ROOT && mv $LEGACY_SERVER_BUILD_NAME $SERVER_BUILD_NAME && tar --owner=0 --group=0 -czf $SERVER_TARBALL_PATH $SERVER_BUILD_NAME)
+
+node build/azure-pipelines/common/createAsset.js "server-$PLATFORM_LINUX" archive-unsigned "$SERVER_TARBALL_FILENAME" "$SERVER_TARBALL_PATH"
+
+# Publish DEB
+case $VSCODE_ARCH in
+	x64) DEB_ARCH="amd64" ;;
+	*) DEB_ARCH="$VSCODE_ARCH" ;;
+esac
+
+PLATFORM_DEB="linux-deb-$VSCODE_ARCH"
+DEB_FILENAME="$(ls $REPO/.build/linux/deb/$DEB_ARCH/deb/)"
+DEB_PATH="$REPO/.build/linux/deb/$DEB_ARCH/deb/$DEB_FILENAME"
+
+node build/azure-pipelines/common/createAsset.js "$PLATFORM_DEB" package "$DEB_FILENAME" "$DEB_PATH"
+
+# Publish RPM
+case $VSCODE_ARCH in
+	x64) RPM_ARCH="x86_64" ;;
+	armhf) RPM_ARCH="armv7hl" ;;
+	arm64) RPM_ARCH="aarch64" ;;
+	*) RPM_ARCH="$VSCODE_ARCH" ;;
+esac
+
+PLATFORM_RPM="linux-rpm-$VSCODE_ARCH"
+RPM_FILENAME="$(ls $REPO/.build/linux/rpm/$RPM_ARCH/ | grep .rpm)"
+RPM_PATH="$REPO/.build/linux/rpm/$RPM_ARCH/$RPM_FILENAME"
+
+node build/azure-pipelines/common/createAsset.js "$PLATFORM_RPM" package "$RPM_FILENAME" "$RPM_PATH"
+
+if [ "$VSCODE_ARCH" == "x64" ]; then
+	# Publish Snap
+	# Pack snap tarball artifact, in order to preserve file perms
+	mkdir -p $REPO/.build/linux/snap-tarball
+	SNAP_TARBALL_PATH="$REPO/.build/linux/snap-tarball/snap-$VSCODE_ARCH.tar.gz"
+	rm -rf $SNAP_TARBALL_PATH
+	(cd .build/linux && tar -czf $SNAP_TARBALL_PATH snap)
+fi
--- a/lib/vscode/build/azure-pipelines/linux/snap-build-linux.yml
+++ b/lib/vscode/build/azure-pipelines/linux/snap-build-linux.yml
@ -0,0 +1,52 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- task: DownloadPipelineArtifact@0
+  displayName: 'Download Pipeline Artifact'
+  inputs:
+    artifactName: snap-x64
+    targetPath: .build/linux/snap-tarball
+
+- script: |
+    set -e
+
+    # Get snapcraft version
+    snapcraft --version
+
+    # Make sure we get latest packages
+    sudo apt-get update
+    sudo apt-get upgrade -y
+
+    # Define variables
+    REPO="$(pwd)"
+    SNAP_ROOT="$REPO/.build/linux/snap/x64"
+
+    # Install build dependencies
+    (cd build && yarn)
+
+    # Unpack snap tarball artifact, in order to preserve file perms
+    SNAP_TARBALL_PATH="$REPO/.build/linux/snap-tarball/snap-x64.tar.gz"
+    (cd .build/linux && tar -xzf $SNAP_TARBALL_PATH)
+
+    # Create snap package
+    BUILD_VERSION="$(date +%s)"
+    SNAP_FILENAME="code-$VSCODE_QUALITY-$BUILD_VERSION.snap"
+    SNAP_PATH="$SNAP_ROOT/$SNAP_FILENAME"
+    (cd $SNAP_ROOT/code-* && sudo --preserve-env snapcraft snap --output "$SNAP_PATH")
+
+    # Publish snap package
+    AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(vscode-storage-key)" \
+    node build/azure-pipelines/common/createAsset.js "linux-snap-x64" package "$SNAP_FILENAME" "$SNAP_PATH"
--- a/lib/vscode/build/azure-pipelines/linux/xvfb.init
+++ b/lib/vscode/build/azure-pipelines/linux/xvfb.init
@ -0,0 +1,53 @@
+#!/bin/bash
+#
+# /etc/rc.d/init.d/xvfbd
+#
+# chkconfig: 345 95 28
+# description: Starts/Stops X Virtual Framebuffer server
+# processname: Xvfb
+#
+### BEGIN INIT INFO
+# Provides:          xvfb
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start xvfb at boot time
+# Description:       Enable xvfb provided by daemon.
+### END INIT INFO
+
+[ "${NETWORKING}" = "no" ] && exit 0
+
+PROG="/usr/bin/Xvfb"
+PROG_OPTIONS=":10 -ac -screen 0 1024x768x24"
+PROG_OUTPUT="/tmp/Xvfb.out"
+
+case "$1" in
+	start)
+		echo "Starting : X Virtual Frame Buffer "
+		$PROG $PROG_OPTIONS>>$PROG_OUTPUT 2>&1 &
+		disown -ar
+	;;
+	stop)
+		echo "Shutting down : X Virtual Frame Buffer"
+		killproc $PROG
+		RETVAL=$?
+		[ $RETVAL -eq 0 ] && /bin/rm -f /var/lock/subsys/Xvfb
+		/var/run/Xvfb.pid
+		echo
+	;;
+	restart|reload)
+		$0 stop
+		$0 start
+		RETVAL=$?
+	;;
+	status)
+		status Xvfb
+		RETVAL=$?
+	;;
+	*)
+		echo $"Usage: $0 (start|stop|restart|reload|status)"
+		exit 1
+esac
+
+exit $RETVAL
--- a/lib/vscode/build/azure-pipelines/mixin.ts
+++ b/lib/vscode/build/azure-pipelines/mixin.ts
@ -0,0 +1,86 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as json from 'gulp-json-editor';
+const buffer = require('gulp-buffer');
+import * as filter from 'gulp-filter';
+import * as es from 'event-stream';
+import * as Vinyl from 'vinyl';
+import * as vfs from 'vinyl-fs';
+import * as fancyLog from 'fancy-log';
+import * as ansiColors from 'ansi-colors';
+import * as fs from 'fs';
+import * as path from 'path';
+
+interface IBuiltInExtension {
+	readonly name: string;
+	readonly version: string;
+	readonly repo: string;
+	readonly metadata: any;
+}
+
+interface OSSProduct {
+	readonly builtInExtensions: IBuiltInExtension[];
+	readonly webBuiltInExtensions?: IBuiltInExtension[];
+}
+
+interface Product {
+	readonly builtInExtensions?: IBuiltInExtension[] | { 'include'?: IBuiltInExtension[], 'exclude'?: string[] };
+	readonly webBuiltInExtensions?: IBuiltInExtension[];
+}
+
+function main() {
+	const quality = process.env['VSCODE_QUALITY'];
+
+	if (!quality) {
+		console.log('Missing VSCODE_QUALITY, skipping mixin');
+		return;
+	}
+
+	const productJsonFilter = filter(f => f.relative === 'product.json', { restore: true });
+
+	fancyLog(ansiColors.blue('[mixin]'), `Mixing in sources:`);
+	return vfs
+		.src(`quality/${quality}/**`, { base: `quality/${quality}` })
+		.pipe(filter(f => !f.isDirectory()))
+		.pipe(productJsonFilter)
+		.pipe(buffer())
+		.pipe(json((o: Product) => {
+			const ossProduct = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'product.json'), 'utf8')) as OSSProduct;
+			let builtInExtensions = ossProduct.builtInExtensions;
+
+			if (Array.isArray(o.builtInExtensions)) {
+				fancyLog(ansiColors.blue('[mixin]'), 'Overwriting built-in extensions:', o.builtInExtensions.map(e => e.name));
+
+				builtInExtensions = o.builtInExtensions;
+			} else if (o.builtInExtensions) {
+				const include = o.builtInExtensions['include'] || [];
+				const exclude = o.builtInExtensions['exclude'] || [];
+
+				fancyLog(ansiColors.blue('[mixin]'), 'OSS built-in extensions:', builtInExtensions.map(e => e.name));
+				fancyLog(ansiColors.blue('[mixin]'), 'Including built-in extensions:', include.map(e => e.name));
+				fancyLog(ansiColors.blue('[mixin]'), 'Excluding built-in extensions:', exclude);
+
+				builtInExtensions = builtInExtensions.filter(ext => !include.find(e => e.name === ext.name) && !exclude.find(name => name === ext.name));
+				builtInExtensions = [...builtInExtensions, ...include];
+
+				fancyLog(ansiColors.blue('[mixin]'), 'Final built-in extensions:', builtInExtensions.map(e => e.name));
+			} else {
+				fancyLog(ansiColors.blue('[mixin]'), 'Inheriting OSS built-in extensions', builtInExtensions.map(e => e.name));
+			}
+
+			return { webBuiltInExtensions: ossProduct.webBuiltInExtensions, ...o, builtInExtensions };
+		}))
+		.pipe(productJsonFilter.restore)
+		.pipe(es.mapSync(function (f: Vinyl) {
+			fancyLog(ansiColors.blue('[mixin]'), f.relative, ansiColors.green('✔︎'));
+			return f;
+		}))
+		.pipe(vfs.dest('.'));
+}
+
+main();
--- a/lib/vscode/build/azure-pipelines/product-build.yml
+++ b/lib/vscode/build/azure-pipelines/product-build.yml
@ -0,0 +1,161 @@
+trigger: none
+pr: none
+
+schedules:
+- cron: "0 5 * * Mon-Fri"
+  displayName: Mon-Fri at 7:00
+  branches:
+    include:
+    - master
+
+resources:
+  containers:
+  - container: vscode-x64
+    image: vscodehub.azurecr.io/vscode-linux-build-agent:x64
+    endpoint: VSCodeHub
+  - container: vscode-arm64
+    image: vscodehub.azurecr.io/vscode-linux-build-agent:stretch-arm64
+    endpoint: VSCodeHub
+  - container: vscode-armhf
+    image: vscodehub.azurecr.io/vscode-linux-build-agent:stretch-armhf
+    endpoint: VSCodeHub
+  - container: snapcraft
+    image: snapcore/snapcraft:stable
+
+stages:
+- stage: Compile
+  jobs:
+  - job: Compile
+    pool:
+      vmImage: 'Ubuntu-16.04'
+    container: vscode-x64
+    steps:
+    - template: product-compile.yml
+
+- stage: Windows
+  dependsOn:
+  - Compile
+  condition: and(succeeded(), eq(variables['VSCODE_COMPILE_ONLY'], 'false'))
+  pool:
+    vmImage: VS2017-Win2016
+  jobs:
+  - job: Windows
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_WIN32'], 'true'))
+    variables:
+      VSCODE_ARCH: x64
+    steps:
+    - template: win32/product-build-win32.yml
+
+  - job: Windows32
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_WIN32_32BIT'], 'true'))
+    variables:
+      VSCODE_ARCH: ia32
+    steps:
+    - template: win32/product-build-win32.yml
+
+  - job: WindowsARM64
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_WIN32_ARM64'], 'true'))
+    variables:
+      VSCODE_ARCH: arm64
+    steps:
+    - template: win32/product-build-win32-arm64.yml
+
+- stage: Linux
+  dependsOn:
+  - Compile
+  condition: and(succeeded(), eq(variables['VSCODE_COMPILE_ONLY'], 'false'))
+  pool:
+    vmImage: 'Ubuntu-16.04'
+  jobs:
+  - job: Linux
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_LINUX'], 'true'))
+    container: vscode-x64
+    variables:
+      VSCODE_ARCH: x64
+      NPM_ARCH: x64
+    steps:
+    - template: linux/product-build-linux.yml
+
+  - job: LinuxSnap
+    dependsOn:
+    - Linux
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_LINUX'], 'true'))
+    container: snapcraft
+    variables:
+      VSCODE_ARCH: x64
+    steps:
+    - template: linux/snap-build-linux.yml
+
+  - job: LinuxArmhf
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_LINUX_ARMHF'], 'true'))
+    container: vscode-armhf
+    variables:
+      VSCODE_ARCH: armhf
+      NPM_ARCH: armv7l
+    steps:
+    - template: linux/product-build-linux.yml
+
+  - job: LinuxArm64
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_LINUX_ARM64'], 'true'))
+    container: vscode-arm64
+    variables:
+      VSCODE_ARCH: arm64
+      NPM_ARCH: arm64
+    steps:
+    - template: linux/product-build-linux.yml
+
+  - job: LinuxAlpine
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_LINUX_ALPINE'], 'true'))
+    variables:
+      VSCODE_ARCH: alpine
+    steps:
+    - template: linux/product-build-linux-multiarch.yml
+
+  - job: LinuxWeb
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_WEB'], 'true'))
+    variables:
+      VSCODE_ARCH: x64
+    steps:
+    - template: web/product-build-web.yml
+
+- stage: macOS
+  dependsOn:
+  - Compile
+  condition: and(succeeded(), eq(variables['VSCODE_COMPILE_ONLY'], 'false'))
+  pool:
+    vmImage: macOS-latest
+  jobs:
+  - job: macOS
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_MACOS'], 'true'))
+    variables:
+      VSCODE_ARCH: x64
+    steps:
+    - template: darwin/product-build-darwin.yml
+
+- stage: Mooncake
+  dependsOn:
+  - Windows
+  - Linux
+  - macOS
+  condition: and(succeededOrFailed(), eq(variables['VSCODE_COMPILE_ONLY'], 'false'))
+  pool:
+    vmImage: 'Ubuntu-16.04'
+  jobs:
+  - job: SyncMooncake
+    displayName: Sync Mooncake
+    steps:
+    - template: sync-mooncake.yml
+
+- stage: Publish
+  dependsOn:
+  - Windows
+  - Linux
+  - macOS
+  condition: and(succeeded(), eq(variables['VSCODE_COMPILE_ONLY'], 'false'), or(eq(variables['VSCODE_RELEASE'], 'true'), and(or(eq(variables['VSCODE_QUALITY'], 'insider'), eq(variables['VSCODE_QUALITY'], 'exploration')), eq(variables['Build.Reason'], 'Schedule'))))
+  pool:
+    vmImage: 'Ubuntu-16.04'
+  jobs:
+  - job: BuildService
+    displayName: Build Service
+    steps:
+    - template: release.yml
--- a/lib/vscode/build/azure-pipelines/product-compile.yml
+++ b/lib/vscode/build/azure-pipelines/product-compile.yml
@ -0,0 +1,146 @@
+steps:
+- script: |
+    mkdir -p .build
+    echo -n $BUILD_SOURCEVERSION > .build/commit
+    echo -n $VSCODE_QUALITY > .build/quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+    dryRun: true
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    set -e
+    cat << EOF > ~/.netrc
+    machine github.com
+    login vscode
+    password $(github-distro-mixin-password)
+    EOF
+
+    git config user.email "vscode@microsoft.com"
+    git config user.name "VSCode"
+  displayName: Prepare tooling
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    set -e
+    git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git"
+    git fetch distro
+    git merge $(node -p "require('./package.json').distro")
+  displayName: Merge distro
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    echo -n $VSCODE_ARCH > .build/arch
+  displayName: Prepare arch cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: '.build/arch, build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    set -e
+    CHILD_CONCURRENCY=1 yarn --frozen-lockfile
+  displayName: Install dependencies
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: '.build/arch, build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'), ne(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    yarn postinstall
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'), eq(variables['CacheRestored'], 'true'))
+
+# Mixin must run before optimize, because the CSS loader will
+# inline small SVGs
+- script: |
+    set -e
+    node build/azure-pipelines/mixin
+  displayName: Mix in quality
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    set -e
+    yarn gulp hygiene
+    yarn monaco-compile-check
+    yarn valid-layers-check
+  displayName: Run hygiene, monaco compile & valid layers checks
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- script: |
+    set -
+    ./build/azure-pipelines/common/extract-telemetry.sh
+  displayName: Extract Telemetry
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    set -e
+    AZURE_WEBVIEW_STORAGE_ACCESS_KEY="$(vscode-webview-storage-key)" \
+    ./build/azure-pipelines/common/publish-webview.sh
+  displayName: Publish Webview
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    set -e
+    yarn gulp compile-build
+    yarn gulp compile-extensions-build
+    yarn gulp minify-vscode
+    yarn gulp minify-vscode-reh
+    yarn gulp minify-vscode-reh-web
+  displayName: Compile
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    set -e
+    AZURE_STORAGE_ACCESS_KEY="$(ticino-storage-key)" \
+      node build/azure-pipelines/upload-sourcemaps
+  displayName: Upload sourcemaps
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- script: |
+    set -e
+    VERSION=`node -p "require(\"./package.json\").version"`
+    AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+      node build/azure-pipelines/common/createBuild.js $VERSION
+  displayName: Create build
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+  condition: and(succeeded(), ne(variables['CacheExists-Compilation'], 'true'))
--- a/lib/vscode/build/azure-pipelines/publish-types/.gitignore
+++ b/lib/vscode/build/azure-pipelines/publish-types/.gitignore
@ -0,0 +1,2 @@
+node_modules/
+*.js
--- a/lib/vscode/build/azure-pipelines/publish-types/check-version.ts
+++ b/lib/vscode/build/azure-pipelines/publish-types/check-version.ts
@ -0,0 +1,43 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as cp from 'child_process';
+
+let tag = '';
+try {
+	tag = cp
+		.execSync('git describe --tags `git rev-list --tags --max-count=1`')
+		.toString()
+		.trim();
+
+	if (!isValidTag(tag)) {
+		throw Error(`Invalid tag ${tag}`);
+	}
+} catch (err) {
+	console.error(err);
+	console.error('Failed to update types');
+	process.exit(1);
+}
+
+function isValidTag(t: string) {
+	if (t.split('.').length !== 3) {
+		return false;
+	}
+
+	const [major, minor, bug] = t.split('.');
+
+	// Only release for tags like 1.34.0
+	if (bug !== '0') {
+		return false;
+	}
+
+	if (isNaN(parseInt(major, 10)) || isNaN(parseInt(minor, 10))) {
+		return false;
+	}
+
+	return true;
+}
--- a/lib/vscode/build/azure-pipelines/publish-types/publish-types.yml
+++ b/lib/vscode/build/azure-pipelines/publish-types/publish-types.yml
@ -0,0 +1,83 @@
+# Publish @types/vscode for each release
+
+trigger:
+  branches:
+    include: ['refs/tags/*']
+
+pr: none
+
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- bash: |
+    TAG_VERSION=$(git describe --tags `git rev-list --tags --max-count=1`)
+    CHANNEL="G1C14HJ2F"
+
+    if [ "$TAG_VERSION" == "1.999.0" ]; then
+      MESSAGE="<!here>. Someone pushed 1.999.0 tag. Please delete it ASAP from remote and local."
+
+      curl -X POST -H "Authorization: Bearer $(SLACK_TOKEN)" \
+      -H 'Content-type: application/json; charset=utf-8' \
+      --data '{"channel":"'"$CHANNEL"'", "link_names": true, "text":"'"$MESSAGE"'"}' \
+      https://slack.com/api/chat.postMessage
+
+      exit 1
+    fi
+  displayName: Check 1.999.0 tag
+
+- bash: |
+    # Install build dependencies
+    (cd build && yarn)
+    node build/azure-pipelines/publish-types/check-version.js
+  displayName: Check version
+
+- bash: |
+    git config --global user.email "vscode@microsoft.com"
+    git config --global user.name "VSCode"
+
+    git clone https://$(GITHUB_TOKEN)@github.com/DefinitelyTyped/DefinitelyTyped.git --depth=1
+    node build/azure-pipelines/publish-types/update-types.js
+
+    TAG_VERSION=$(git describe --tags `git rev-list --tags --max-count=1`)
+
+    cd DefinitelyTyped
+
+    git diff --color | cat
+    git add -A
+    git status
+    git checkout -b "vscode-types-$TAG_VERSION"
+    git commit -m "VS Code $TAG_VERSION Extension API"
+    git push origin "vscode-types-$TAG_VERSION"
+
+  displayName: Push update to DefinitelyTyped
+
+- bash: |
+    TAG_VERSION=$(git describe --tags `git rev-list --tags --max-count=1`)
+    CHANNEL="G1C14HJ2F"
+
+    MESSAGE="DefinitelyTyped/DefinitelyTyped#vscode-types-$TAG_VERSION created. Endgame master, please open this link, examine changes and create a PR:"
+    LINK="https://github.com/DefinitelyTyped/DefinitelyTyped/compare/vscode-types-$TAG_VERSION?quick_pull=1&body=Updating%20VS%20Code%20Extension%20API.%20See%20https%3A%2F%2Fgithub.com%2Fmicrosoft%2Fvscode%2Fissues%2F70175%20for%20details."
+    MESSAGE2="[@eamodio, @jrieken, @kmaetzel, @egamma]. Please review and merge PR to publish @types/vscode."
+
+    curl -X POST -H "Authorization: Bearer $(SLACK_TOKEN)" \
+    -H 'Content-type: application/json; charset=utf-8' \
+    --data '{"channel":"'"$CHANNEL"'", "link_names": true, "text":"'"$MESSAGE"'"}' \
+    https://slack.com/api/chat.postMessage
+
+    curl -X POST -H "Authorization: Bearer $(SLACK_TOKEN)" \
+    -H 'Content-type: application/json; charset=utf-8' \
+    --data '{"channel":"'"$CHANNEL"'", "link_names": true, "text":"'"$LINK"'"}' \
+    https://slack.com/api/chat.postMessage
+
+    curl -X POST -H "Authorization: Bearer $(SLACK_TOKEN)" \
+    -H 'Content-type: application/json; charset=utf-8' \
+    --data '{"channel":"'"$CHANNEL"'", "link_names": true, "text":"'"$MESSAGE2"'"}' \
+    https://slack.com/api/chat.postMessage
+
+  displayName: Send message on Slack
--- a/lib/vscode/build/azure-pipelines/publish-types/update-types.ts
+++ b/lib/vscode/build/azure-pipelines/publish-types/update-types.ts
@ -0,0 +1,85 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as fs from 'fs';
+import * as cp from 'child_process';
+import * as path from 'path';
+
+let tag = '';
+try {
+	tag = cp
+		.execSync('git describe --tags `git rev-list --tags --max-count=1`')
+		.toString()
+		.trim();
+
+	const dtsUri = `https://raw.githubusercontent.com/microsoft/vscode/${tag}/src/vs/vscode.d.ts`;
+	const outPath = path.resolve(process.cwd(), 'DefinitelyTyped/types/vscode/index.d.ts');
+	cp.execSync(`curl ${dtsUri} --output ${outPath}`);
+
+	updateDTSFile(outPath, tag);
+
+	console.log(`Done updating vscode.d.ts at ${outPath}`);
+} catch (err) {
+	console.error(err);
+	console.error('Failed to update types');
+	process.exit(1);
+}
+
+function updateDTSFile(outPath: string, tag: string) {
+	const oldContent = fs.readFileSync(outPath, 'utf-8');
+	const newContent = getNewFileContent(oldContent, tag);
+
+	fs.writeFileSync(outPath, newContent);
+}
+
+function repeat(str: string, times: number): string {
+	const result = new Array(times);
+	for (let i = 0; i < times; i++) {
+		result[i] = str;
+	}
+	return result.join('');
+}
+
+function convertTabsToSpaces(str: string): string {
+	return str.replace(/\t/gm, value => repeat('    ', value.length));
+}
+
+function getNewFileContent(content: string, tag: string) {
+	const oldheader = [
+		`/*---------------------------------------------------------------------------------------------`,
+		` *  Copyright (c) Microsoft Corporation. All rights reserved.`,
+		` *  Licensed under the MIT License. See License.txt in the project root for license information.`,
+		` *--------------------------------------------------------------------------------------------*/`
+	].join('\n');
+
+	return convertTabsToSpaces(getNewFileHeader(tag) + content.slice(oldheader.length));
+}
+
+function getNewFileHeader(tag: string) {
+	const [major, minor] = tag.split('.');
+	const shorttag = `${major}.${minor}`;
+
+	const header = [
+		`// Type definitions for Visual Studio Code ${shorttag}`,
+		`// Project: https://github.com/microsoft/vscode`,
+		`// Definitions by: Visual Studio Code Team, Microsoft <https://github.com/microsoft>`,
+		`// Definitions: https://github.com/DefinitelyTyped/DefinitelyTyped`,
+		``,
+		`/*---------------------------------------------------------------------------------------------`,
+		` *  Copyright (c) Microsoft Corporation. All rights reserved.`,
+		` *  Licensed under the MIT License.`,
+		` *  See https://github.com/microsoft/vscode/blob/master/LICENSE.txt for license information.`,
+		` *--------------------------------------------------------------------------------------------*/`,
+		``,
+		`/**`,
+		` * Type Definition for Visual Studio Code ${shorttag} Extension API`,
+		` * See https://code.visualstudio.com/api for more information`,
+		` */`
+	].join('\n');
+
+	return header;
+}
--- a/lib/vscode/build/azure-pipelines/release.yml
+++ b/lib/vscode/build/azure-pipelines/release.yml
@ -0,0 +1,22 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "10.x"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- script: |
+    set -e
+
+    (cd build ; yarn)
+
+    AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+    node build/azure-pipelines/common/releaseBuild.js
--- a/lib/vscode/build/azure-pipelines/sync-mooncake.yml
+++ b/lib/vscode/build/azure-pipelines/sync-mooncake.yml
@ -0,0 +1,24 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- script: |
+    set -e
+
+    (cd build ; yarn)
+
+    AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(vscode-storage-key)" \
+    MOONCAKE_STORAGE_ACCESS_KEY="$(vscode-mooncake-storage-key)" \
+    node build/azure-pipelines/common/sync-mooncake.js "$VSCODE_QUALITY"
--- a/lib/vscode/build/azure-pipelines/upload-cdn.ts
+++ b/lib/vscode/build/azure-pipelines/upload-cdn.ts
@ -0,0 +1,40 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as path from 'path';
+import * as es from 'event-stream';
+import * as Vinyl from 'vinyl';
+import * as vfs from 'vinyl-fs';
+import * as util from '../lib/util';
+import * as filter from 'gulp-filter';
+import * as gzip from 'gulp-gzip';
+const azure = require('gulp-azure-storage');
+
+const root = path.dirname(path.dirname(__dirname));
+const commit = util.getVersion(root);
+
+function main() {
+	return vfs.src('**', { cwd: '../vscode-web', base: '../vscode-web', dot: true })
+		.pipe(filter(f => !f.isDirectory()))
+		.pipe(gzip({ append: false }))
+		.pipe(es.through(function (data: Vinyl) {
+			console.log('Uploading CDN file:', data.relative); // debug
+			this.emit('data', data);
+		}))
+		.pipe(azure.upload({
+			account: process.env.AZURE_STORAGE_ACCOUNT,
+			key: process.env.AZURE_STORAGE_ACCESS_KEY,
+			container: process.env.VSCODE_QUALITY,
+			prefix: commit + '/',
+			contentSettings: {
+				contentEncoding: 'gzip',
+				cacheControl: 'max-age=31536000, public'
+			}
+		}));
+}
+
+main();
--- a/lib/vscode/build/azure-pipelines/upload-sourcemaps.ts
+++ b/lib/vscode/build/azure-pipelines/upload-sourcemaps.ts
@ -0,0 +1,67 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as path from 'path';
+import * as es from 'event-stream';
+import * as Vinyl from 'vinyl';
+import * as vfs from 'vinyl-fs';
+import * as util from '../lib/util';
+// @ts-ignore
+import * as deps from '../dependencies';
+const azure = require('gulp-azure-storage');
+
+const root = path.dirname(path.dirname(__dirname));
+const commit = util.getVersion(root);
+
+// optionally allow to pass in explicit base/maps to upload
+const [, , base, maps] = process.argv;
+
+function src(base: string, maps = `${base}/**/*.map`) {
+	return vfs.src(maps, { base })
+		.pipe(es.mapSync((f: Vinyl) => {
+			f.path = `${f.base}/core/${f.relative}`;
+			return f;
+		}));
+}
+
+function main() {
+	const sources = [];
+
+	// vscode client maps (default)
+	if (!base) {
+		const vs = src('out-vscode-min'); // client source-maps only
+		sources.push(vs);
+
+		const productionDependencies: { name: string, path: string, version: string }[] = deps.getProductionDependencies(root);
+		const productionDependenciesSrc = productionDependencies.map(d => path.relative(root, d.path)).map(d => `./${d}/**/*.map`);
+		const nodeModules = vfs.src(productionDependenciesSrc, { base: '.' })
+			.pipe(util.cleanNodeModules(path.join(root, 'build', '.moduleignore')));
+		sources.push(nodeModules);
+
+		const extensionsOut = vfs.src(['.build/extensions/**/*.js.map', '!**/node_modules/**'], { base: '.build' });
+		sources.push(extensionsOut);
+	}
+
+	// specific client base/maps
+	else {
+		sources.push(src(base, maps));
+	}
+
+	return es.merge(...sources)
+		.pipe(es.through(function (data: Vinyl) {
+			console.log('Uploading Sourcemap', data.relative); // debug
+			this.emit('data', data);
+		}))
+		.pipe(azure.upload({
+			account: process.env.AZURE_STORAGE_ACCOUNT,
+			key: process.env.AZURE_STORAGE_ACCESS_KEY,
+			container: 'sourcemaps',
+			prefix: commit + '/'
+		}));
+}
+
+main();
--- a/lib/vscode/build/azure-pipelines/web/product-build-web.yml
+++ b/lib/vscode/build/azure-pipelines/web/product-build-web.yml
@ -0,0 +1,113 @@
+steps:
+- script: |
+    mkdir -p .build
+    echo -n $BUILD_SOURCEVERSION > .build/commit
+    echo -n $VSCODE_QUALITY > .build/quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+
+- script: |
+    set -e
+    exit 1
+  displayName: Check RestoreCache
+  condition: and(succeeded(), ne(variables['CacheRestored-Compilation'], 'true'))
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- script: |
+    set -e
+    cat << EOF > ~/.netrc
+    machine github.com
+    login vscode
+    password $(github-distro-mixin-password)
+    EOF
+
+    git config user.email "vscode@microsoft.com"
+    git config user.name "VSCode"
+  displayName: Prepare tooling
+
+- script: |
+    set -e
+    git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git"
+    git fetch distro
+    git merge $(node -p "require('./package.json').distro")
+  displayName: Merge distro
+
+# - task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+#   inputs:
+#     keyfile: 'build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+#     targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+#     vstsFeed: 'npm-vscode'
+
+- script: |
+    set -e
+    CHILD_CONCURRENCY=1 yarn --frozen-lockfile
+  displayName: Install dependencies
+  # condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+# - task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+#   inputs:
+#     keyfile: 'build/.cachesalt, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+#     targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+#     vstsFeed: 'npm-vscode'
+#   condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+# - script: |
+#     set -e
+#     yarn postinstall
+#   displayName: Run postinstall scripts
+#   condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- script: |
+    set -e
+    node build/azure-pipelines/mixin
+  displayName: Mix in quality
+
+- script: |
+    set -e
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+      yarn gulp vscode-web-min-ci
+  displayName: Build
+
+- script: |
+    set -e
+    AZURE_STORAGE_ACCOUNT="$(web-storage-account)" \
+    AZURE_STORAGE_ACCESS_KEY="$(web-storage-key)" \
+      node build/azure-pipelines/upload-cdn.js
+  displayName: Upload to CDN
+
+  # upload only the workbench.web.api.js source maps because
+  # we just compiled these bits in the previous step and the
+  # general task to upload source maps has already been run
+- script: |
+    set -e
+    AZURE_STORAGE_ACCESS_KEY="$(ticino-storage-key)" \
+      node build/azure-pipelines/upload-sourcemaps out-vscode-web-min out-vscode-web-min/vs/workbench/workbench.web.api.js.map
+  displayName: Upload sourcemaps (Web)
+
+- script: |
+    set -e
+    AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(vscode-storage-key)" \
+    VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+    ./build/azure-pipelines/web/publish.sh
+  displayName: Publish
--- a/lib/vscode/build/azure-pipelines/web/publish.sh
+++ b/lib/vscode/build/azure-pipelines/web/publish.sh
@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -e
+REPO="$(pwd)"
+ROOT="$REPO/.."
+
+# Publish Web Client
+WEB_BUILD_NAME="vscode-web"
+WEB_TARBALL_FILENAME="vscode-web.tar.gz"
+WEB_TARBALL_PATH="$ROOT/$WEB_TARBALL_FILENAME"
+
+rm -rf $ROOT/vscode-web.tar.*
+
+(cd $ROOT && tar --owner=0 --group=0 -czf $WEB_TARBALL_PATH $WEB_BUILD_NAME)
+
+node build/azure-pipelines/common/createAsset.js web-standalone archive-unsigned "$WEB_TARBALL_FILENAME" "$WEB_TARBALL_PATH"
--- a/lib/vscode/build/azure-pipelines/win32/ESRPClient/NuGet.config
+++ b/lib/vscode/build/azure-pipelines/win32/ESRPClient/NuGet.config
@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+    <packageSources>
+        <add key="ESRP" value="https://microsoft.pkgs.visualstudio.com/_packaging/ESRP/nuget/v3/index.json" />
+    </packageSources>
+</configuration>
--- a/lib/vscode/build/azure-pipelines/win32/ESRPClient/packages.config
+++ b/lib/vscode/build/azure-pipelines/win32/ESRPClient/packages.config
@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Microsoft.ESRPClient" version="1.2.47" />
+</packages>
--- a/lib/vscode/build/azure-pipelines/win32/continuous-build-win32.yml
+++ b/lib/vscode/build/azure-pipelines/win32/continuous-build-win32.yml
@ -0,0 +1,87 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '2.x'
+    addToPath: true
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'vscode-build-cache'
+
+- powershell: |
+    yarn --frozen-lockfile
+  env:
+    CHILD_CONCURRENCY: "1"
+  displayName: Install Dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'vscode-build-cache'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn postinstall }
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    yarn electron
+  displayName: Download Electron
+
+- powershell: |
+    yarn monaco-compile-check
+  displayName: Run Monaco Editor Checks
+
+- script: |
+    yarn valid-layers-check
+  displayName: Run Valid Layers Checks
+
+- powershell: |
+    yarn compile
+  displayName: Compile Sources
+
+- powershell: |
+    yarn download-builtin-extensions
+  displayName: Download Built-in Extensions
+
+- powershell: |
+    .\scripts\test.bat --tfs "Unit Tests"
+  displayName: Run Unit Tests (Electron)
+
+- powershell: |
+    yarn test-browser --browser chromium --browser firefox --tfs "Browser Unit Tests"
+  displayName: Run Unit Tests (Browser)
+
+- powershell: |
+    .\scripts\test-integration.bat --tfs "Integration Tests"
+  displayName: Run Integration Tests (Electron)
+
+- task: PublishPipelineArtifact@0
+  displayName: 'Publish Crash Reports'
+  inputs:
+    artifactName: crash-dump-windows
+    targetPath: .build\crashes
+  continueOnError: true
+  condition: failed()
+
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()
--- a/lib/vscode/build/azure-pipelines/win32/exec.ps1
+++ b/lib/vscode/build/azure-pipelines/win32/exec.ps1
@ -0,0 +1,24 @@
+# Taken from psake https://github.com/psake/psake
+
+<#
+.SYNOPSIS
+  This is a helper function that runs a scriptblock and checks the PS variable $lastexitcode
+  to see if an error occcured. If an error is detected then an exception is thrown.
+  This function allows you to run command-line programs without having to
+  explicitly check the $lastexitcode variable.
+
+.EXAMPLE
+  exec { svn info $repository_trunk } "Error executing SVN. Please verify SVN command-line client is installed"
+#>
+function Exec
+{
+	[CmdletBinding()]
+	param(
+		[Parameter(Position=0,Mandatory=1)][scriptblock]$cmd,
+		[Parameter(Position=1,Mandatory=0)][string]$errorMessage = ($msgs.error_bad_command -f $cmd)
+	)
+	& $cmd
+	if ($lastexitcode -ne 0) {
+		throw ("Exec: " + $errorMessage)
+	}
+}
--- a/lib/vscode/build/azure-pipelines/win32/import-esrp-auth-cert.ps1
+++ b/lib/vscode/build/azure-pipelines/win32/import-esrp-auth-cert.ps1
@ -0,0 +1,14 @@
+param ($CertBase64)
+$ErrorActionPreference = "Stop"
+
+$CertBytes = [System.Convert]::FromBase64String($CertBase64)
+$CertCollection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
+$CertCollection.Import($CertBytes, $null, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)
+
+$CertStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("My","LocalMachine")
+$CertStore.Open("ReadWrite")
+$CertStore.AddRange($CertCollection)
+$CertStore.Close()
+
+$ESRPAuthCertificateSubjectName = $CertCollection[0].Subject
+Write-Output ("##vso[task.setvariable variable=ESRPAuthCertificateSubjectName;]$ESRPAuthCertificateSubjectName")
--- a/lib/vscode/build/azure-pipelines/win32/product-build-win32-arm64.yml
+++ b/lib/vscode/build/azure-pipelines/win32/product-build-win32-arm64.yml
@ -0,0 +1,192 @@
+steps:
+- powershell: |
+    mkdir .build -ea 0
+    "$env:BUILD_SOURCEVERSION" | Out-File -Encoding ascii -NoNewLine .build\commit
+    "$env:VSCODE_QUALITY" | Out-File -Encoding ascii -NoNewLine .build\quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+
+- powershell: |
+    $ErrorActionPreference = "Stop"
+    exit 1
+  displayName: Check RestoreCache
+  condition: and(succeeded(), ne(variables['CacheRestored-Compilation'], 'true'))
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '2.x'
+    addToPath: true
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    "machine github.com`nlogin vscode`npassword $(github-distro-mixin-password)" | Out-File "$env:USERPROFILE\_netrc" -Encoding ASCII
+
+    exec { git config user.email "vscode@microsoft.com" }
+    exec { git config user.name "VSCode" }
+
+    mkdir .build -ea 0
+    "$(VSCODE_ARCH)" | Out-File -Encoding ascii -NoNewLine .build\arch
+  displayName: Prepare tooling
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git" }
+    exec { git fetch distro }
+    exec { git merge $(node -p "require('./package.json').distro") }
+  displayName: Merge distro
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/arch, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:npm_config_arch="$(VSCODE_ARCH)"
+    $env:CHILD_CONCURRENCY="1"
+    exec { yarn --frozen-lockfile }
+  displayName: Install dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/arch, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn postinstall }
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { node build/azure-pipelines/mixin }
+  displayName: Mix in quality
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-min-ci" }
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-code-helper" }
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-inno-updater" }
+  displayName: Build
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)/VSCode-win32-$(VSCODE_ARCH)'
+    Pattern: '*.dll,*.exe,*.node'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolSign",
+          "parameters": [
+            {
+              "parameterName": "OpusName",
+              "parameterValue": "VS Code"
+            },
+            {
+              "parameterName": "OpusInfo",
+              "parameterValue": "https://code.visualstudio.com/"
+            },
+            {
+              "parameterName": "Append",
+              "parameterValue": "/as"
+            },
+            {
+              "parameterName": "FileDigest",
+              "parameterValue": "/fd \"SHA256\""
+            },
+            {
+              "parameterName": "PageHash",
+              "parameterValue": "/NPH"
+            },
+            {
+              "parameterName": "TimeStamp",
+              "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        },
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolVerify",
+          "parameters": [
+            {
+              "parameterName": "VerifyAll",
+              "parameterValue": "/all"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+
+- task: NuGetCommand@2
+  displayName: Install ESRPClient.exe
+  inputs:
+    restoreSolution: 'build\azure-pipelines\win32\ESRPClient\packages.config'
+    feedsToUse: config
+    nugetConfigPath: 'build\azure-pipelines\win32\ESRPClient\NuGet.config'
+    externalFeedCredentials: 3fc0b7f7-da09-4ae7-a9c8-d69824b1819b
+    restoreDirectory: packages
+
+- task: ESRPImportCertTask@1
+  displayName: Import ESRP Request Signing Certificate
+  inputs:
+    ESRP: 'ESRP CodeSign'
+
+- task: PowerShell@2
+  inputs:
+    targetType: filePath
+    filePath: .\build\azure-pipelines\win32\import-esrp-auth-cert.ps1
+    arguments: "$(ESRP-SSL-AADAuth)"
+  displayName: Import ESRP Auth Certificate
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:AZURE_STORAGE_ACCESS_KEY_2 = "$(vscode-storage-key)"
+    $env:AZURE_DOCUMENTDB_MASTERKEY = "$(builds-docdb-key-readwrite)"
+    $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
+    .\build\azure-pipelines\win32\publish.ps1
+  displayName: Publish
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true
--- a/lib/vscode/build/azure-pipelines/win32/product-build-win32.yml
+++ b/lib/vscode/build/azure-pipelines/win32/product-build-win32.yml
@ -0,0 +1,254 @@
+steps:
+- powershell: |
+    mkdir .build -ea 0
+    "$env:BUILD_SOURCEVERSION" | Out-File -Encoding ascii -NoNewLine .build\commit
+    "$env:VSCODE_QUALITY" | Out-File -Encoding ascii -NoNewLine .build\quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+
+- powershell: |
+    $ErrorActionPreference = "Stop"
+    exit 1
+  displayName: Check RestoreCache
+  condition: and(succeeded(), ne(variables['CacheRestored-Compilation'], 'true'))
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '2.x'
+    addToPath: true
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    "machine github.com`nlogin vscode`npassword $(github-distro-mixin-password)" | Out-File "$env:USERPROFILE\_netrc" -Encoding ASCII
+
+    exec { git config user.email "vscode@microsoft.com" }
+    exec { git config user.name "VSCode" }
+
+    mkdir .build -ea 0
+    "$(VSCODE_ARCH)" | Out-File -Encoding ascii -NoNewLine .build\arch
+  displayName: Prepare tooling
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git" }
+    exec { git fetch distro }
+    exec { git merge $(node -p "require('./package.json').distro") }
+  displayName: Merge distro
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/arch, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:npm_config_arch="$(VSCODE_ARCH)"
+    $env:CHILD_CONCURRENCY="1"
+    exec { yarn --frozen-lockfile }
+  displayName: Install dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/arch, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn postinstall }
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { node build/azure-pipelines/mixin }
+  displayName: Mix in quality
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-min-ci" }
+    exec { yarn gulp "vscode-reh-win32-$env:VSCODE_ARCH-min-ci" }
+    exec { yarn gulp "vscode-reh-web-win32-$env:VSCODE_ARCH-min-ci" }
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-code-helper" }
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-inno-updater" }
+  displayName: Build
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn electron $(VSCODE_ARCH) }
+    exec { .\scripts\test.bat --build --tfs "Unit Tests" }
+  displayName: Run unit tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn test-browser --build --browser chromium --browser firefox --tfs "Browser Unit Tests" }
+  displayName: Run unit tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- powershell: |
+    # Figure out the full absolute path of the product we just built
+    # including the remote server and configure the integration tests
+    # to run with these builds instead of running out of sources.
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $AppRoot = "$(agent.builddirectory)\VSCode-win32-$(VSCODE_ARCH)"
+    $AppProductJson = Get-Content -Raw -Path "$AppRoot\resources\app\product.json" | ConvertFrom-Json
+    $AppNameShort = $AppProductJson.nameShort
+    exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-win32-$(VSCODE_ARCH)"; .\scripts\test-integration.bat --build --tfs "Integration Tests" }
+  displayName: Run integration tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-web-win32-$(VSCODE_ARCH)"; .\resources\server\test\test-web-integration.bat --browser firefox }
+  displayName: Run integration tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $AppRoot = "$(agent.builddirectory)\VSCode-win32-$(VSCODE_ARCH)"
+    $AppProductJson = Get-Content -Raw -Path "$AppRoot\resources\app\product.json" | ConvertFrom-Json
+    $AppNameShort = $AppProductJson.nameShort
+    exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-win32-$(VSCODE_ARCH)"; .\resources\server\test\test-remote-integration.bat }
+  displayName: Run remote integration tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- task: PublishPipelineArtifact@0
+  inputs:
+    artifactName: crash-dump-windows-$(VSCODE_ARCH)
+    targetPath: .build\crashes
+  displayName: 'Publish Crash Reports'
+  continueOnError: true
+  condition: failed()
+
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)/VSCode-win32-$(VSCODE_ARCH),$(agent.builddirectory)/vscode-reh-win32-$(VSCODE_ARCH)'
+    Pattern: '*.dll,*.exe,*.node'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolSign",
+          "parameters": [
+            {
+              "parameterName": "OpusName",
+              "parameterValue": "VS Code"
+            },
+            {
+              "parameterName": "OpusInfo",
+              "parameterValue": "https://code.visualstudio.com/"
+            },
+            {
+              "parameterName": "Append",
+              "parameterValue": "/as"
+            },
+            {
+              "parameterName": "FileDigest",
+              "parameterValue": "/fd \"SHA256\""
+            },
+            {
+              "parameterName": "PageHash",
+              "parameterValue": "/NPH"
+            },
+            {
+              "parameterName": "TimeStamp",
+              "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        },
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolVerify",
+          "parameters": [
+            {
+              "parameterName": "VerifyAll",
+              "parameterValue": "/all"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+
+- task: NuGetCommand@2
+  displayName: Install ESRPClient.exe
+  inputs:
+    restoreSolution: 'build\azure-pipelines\win32\ESRPClient\packages.config'
+    feedsToUse: config
+    nugetConfigPath: 'build\azure-pipelines\win32\ESRPClient\NuGet.config'
+    externalFeedCredentials: 'ESRP Nuget'
+    restoreDirectory: packages
+
+- task: ESRPImportCertTask@1
+  displayName: Import ESRP Request Signing Certificate
+  inputs:
+    ESRP: 'ESRP CodeSign'
+
+- task: PowerShell@2
+  inputs:
+    targetType: filePath
+    filePath: .\build\azure-pipelines\win32\import-esrp-auth-cert.ps1
+    arguments: "$(ESRP-SSL-AADAuth)"
+  displayName: Import ESRP Auth Certificate
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:AZURE_STORAGE_ACCESS_KEY_2 = "$(vscode-storage-key)"
+    $env:AZURE_DOCUMENTDB_MASTERKEY = "$(builds-docdb-key-readwrite)"
+    $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
+    .\build\azure-pipelines\win32\publish.ps1
+  displayName: Publish
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true
--- a/lib/vscode/build/azure-pipelines/win32/publish.ps1
+++ b/lib/vscode/build/azure-pipelines/win32/publish.ps1
@ -0,0 +1,36 @@
+. build/azure-pipelines/win32/exec.ps1
+$ErrorActionPreference = "Stop"
+
+$Arch = "$env:VSCODE_ARCH"
+
+exec { yarn gulp "vscode-win32-$Arch-archive" "vscode-win32-$Arch-system-setup" "vscode-win32-$Arch-user-setup" --sign }
+
+$Repo = "$(pwd)"
+$Root = "$Repo\.."
+$SystemExe = "$Repo\.build\win32-$Arch\system-setup\VSCodeSetup.exe"
+$UserExe = "$Repo\.build\win32-$Arch\user-setup\VSCodeSetup.exe"
+$Zip = "$Repo\.build\win32-$Arch\archive\VSCode-win32-$Arch.zip"
+$LegacyServer = "$Root\vscode-reh-win32-$Arch"
+$Server = "$Root\vscode-server-win32-$Arch"
+$ServerZip = "$Repo\.build\vscode-server-win32-$Arch.zip"
+$Build = "$Root\VSCode-win32-$Arch"
+
+# Create server archive
+if ("$Arch" -ne "arm64") {
+	exec { xcopy $LegacyServer $Server /H /E /I }
+	exec { .\node_modules\7zip\7zip-lite\7z.exe a -tzip $ServerZip $Server -r }
+}
+
+# get version
+$PackageJson = Get-Content -Raw -Path "$Build\resources\app\package.json" | ConvertFrom-Json
+$Version = $PackageJson.version
+
+$AssetPlatform = if ("$Arch" -eq "ia32") { "win32" } else { "win32-$Arch" }
+
+exec { node build/azure-pipelines/common/createAsset.js "$AssetPlatform-archive" archive "VSCode-win32-$Arch-$Version.zip" $Zip }
+exec { node build/azure-pipelines/common/createAsset.js "$AssetPlatform" setup "VSCodeSetup-$Arch-$Version.exe" $SystemExe }
+exec { node build/azure-pipelines/common/createAsset.js "$AssetPlatform-user" setup "VSCodeUserSetup-$Arch-$Version.exe" $UserExe }
+
+if ("$Arch" -ne "arm64") {
+	exec { node build/azure-pipelines/common/createAsset.js "server-$AssetPlatform" archive "vscode-server-win32-$Arch.zip" $ServerZip }
+}
--- a/lib/vscode/build/azure-pipelines/win32/sign.ps1
+++ b/lib/vscode/build/azure-pipelines/win32/sign.ps1
@ -0,0 +1,71 @@
+function Create-TmpJson($Obj) {
+	$FileName = [System.IO.Path]::GetTempFileName()
+	ConvertTo-Json -Depth 100 $Obj | Out-File -Encoding UTF8 $FileName
+	return $FileName
+}
+
+$Auth = Create-TmpJson @{
+	Version = "1.0.0"
+	AuthenticationType = "AAD_CERT"
+	ClientId = $env:ESRPClientId
+	AuthCert = @{
+		SubjectName = $env:ESRPAuthCertificateSubjectName
+		StoreLocation = "LocalMachine"
+		StoreName = "My"
+		SendX5c = "true"
+	}
+	RequestSigningCert = @{
+		SubjectName = $env:ESRPCertificateSubjectName
+		StoreLocation = "LocalMachine"
+		StoreName = "My"
+	}
+}
+
+$Policy = Create-TmpJson @{
+	Version = "1.0.0"
+}
+
+$Input = Create-TmpJson @{
+	Version = "1.0.0"
+	SignBatches = @(
+		@{
+			SourceLocationType = "UNC"
+			SignRequestFiles = @(
+				@{
+					SourceLocation = $args[0]
+				}
+			)
+			SigningInfo = @{
+				Operations = @(
+					@{
+						KeyCode = "CP-230012"
+						OperationCode = "SigntoolSign"
+						Parameters = @{
+							OpusName = "VS Code"
+							OpusInfo = "https://code.visualstudio.com/"
+							Append = "/as"
+							FileDigest = "/fd `"SHA256`""
+							PageHash = "/NPH"
+							TimeStamp = "/tr `"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer`" /td sha256"
+						}
+						ToolName = "sign"
+						ToolVersion = "1.0"
+					},
+					@{
+						KeyCode = "CP-230012"
+						OperationCode = "SigntoolVerify"
+						Parameters = @{
+							VerifyAll = "/all"
+						}
+						ToolName = "sign"
+						ToolVersion = "1.0"
+					}
+				)
+			}
+		}
+	)
+}
+
+$Output = [System.IO.Path]::GetTempFileName()
+$ScriptPath = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent
+& "$ScriptPath\ESRPClient\packages\Microsoft.ESRPClient.*\tools\ESRPClient.exe" Sign -a $Auth -p $Policy -i $Input -o $Output