Merge commit 'be3e8236086165e5e45a5a10783823874b3f3ebd' as 'lib/vscode'

2020-12-15 15:52:33 -07:00
parent 6c5c22ea8e be3e823608
commit 41bee49d07
4649 changed files with 1311795 additions and 0 deletions
--- a/lib/vscode/build/azure-pipelines/win32/ESRPClient/NuGet.config
+++ b/lib/vscode/build/azure-pipelines/win32/ESRPClient/NuGet.config
@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+    <packageSources>
+        <add key="ESRP" value="https://microsoft.pkgs.visualstudio.com/_packaging/ESRP/nuget/v3/index.json" />
+    </packageSources>
+</configuration>
--- a/lib/vscode/build/azure-pipelines/win32/ESRPClient/packages.config
+++ b/lib/vscode/build/azure-pipelines/win32/ESRPClient/packages.config
@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Microsoft.ESRPClient" version="1.2.47" />
+</packages>
--- a/lib/vscode/build/azure-pipelines/win32/continuous-build-win32.yml
+++ b/lib/vscode/build/azure-pipelines/win32/continuous-build-win32.yml
@ -0,0 +1,87 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '2.x'
+    addToPath: true
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'vscode-build-cache'
+
+- powershell: |
+    yarn --frozen-lockfile
+  env:
+    CHILD_CONCURRENCY: "1"
+  displayName: Install Dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: '.yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'vscode-build-cache'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn postinstall }
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    yarn electron
+  displayName: Download Electron
+
+- powershell: |
+    yarn monaco-compile-check
+  displayName: Run Monaco Editor Checks
+
+- script: |
+    yarn valid-layers-check
+  displayName: Run Valid Layers Checks
+
+- powershell: |
+    yarn compile
+  displayName: Compile Sources
+
+- powershell: |
+    yarn download-builtin-extensions
+  displayName: Download Built-in Extensions
+
+- powershell: |
+    .\scripts\test.bat --tfs "Unit Tests"
+  displayName: Run Unit Tests (Electron)
+
+- powershell: |
+    yarn test-browser --browser chromium --browser firefox --tfs "Browser Unit Tests"
+  displayName: Run Unit Tests (Browser)
+
+- powershell: |
+    .\scripts\test-integration.bat --tfs "Integration Tests"
+  displayName: Run Integration Tests (Electron)
+
+- task: PublishPipelineArtifact@0
+  displayName: 'Publish Crash Reports'
+  inputs:
+    artifactName: crash-dump-windows
+    targetPath: .build\crashes
+  continueOnError: true
+  condition: failed()
+
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()
--- a/lib/vscode/build/azure-pipelines/win32/exec.ps1
+++ b/lib/vscode/build/azure-pipelines/win32/exec.ps1
@ -0,0 +1,24 @@
+# Taken from psake https://github.com/psake/psake
+
+<#
+.SYNOPSIS
+  This is a helper function that runs a scriptblock and checks the PS variable $lastexitcode
+  to see if an error occcured. If an error is detected then an exception is thrown.
+  This function allows you to run command-line programs without having to
+  explicitly check the $lastexitcode variable.
+
+.EXAMPLE
+  exec { svn info $repository_trunk } "Error executing SVN. Please verify SVN command-line client is installed"
+#>
+function Exec
+{
+	[CmdletBinding()]
+	param(
+		[Parameter(Position=0,Mandatory=1)][scriptblock]$cmd,
+		[Parameter(Position=1,Mandatory=0)][string]$errorMessage = ($msgs.error_bad_command -f $cmd)
+	)
+	& $cmd
+	if ($lastexitcode -ne 0) {
+		throw ("Exec: " + $errorMessage)
+	}
+}
--- a/lib/vscode/build/azure-pipelines/win32/import-esrp-auth-cert.ps1
+++ b/lib/vscode/build/azure-pipelines/win32/import-esrp-auth-cert.ps1
@ -0,0 +1,14 @@
+param ($CertBase64)
+$ErrorActionPreference = "Stop"
+
+$CertBytes = [System.Convert]::FromBase64String($CertBase64)
+$CertCollection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
+$CertCollection.Import($CertBytes, $null, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)
+
+$CertStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("My","LocalMachine")
+$CertStore.Open("ReadWrite")
+$CertStore.AddRange($CertCollection)
+$CertStore.Close()
+
+$ESRPAuthCertificateSubjectName = $CertCollection[0].Subject
+Write-Output ("##vso[task.setvariable variable=ESRPAuthCertificateSubjectName;]$ESRPAuthCertificateSubjectName")
--- a/lib/vscode/build/azure-pipelines/win32/product-build-win32-arm64.yml
+++ b/lib/vscode/build/azure-pipelines/win32/product-build-win32-arm64.yml
@ -0,0 +1,192 @@
+steps:
+- powershell: |
+    mkdir .build -ea 0
+    "$env:BUILD_SOURCEVERSION" | Out-File -Encoding ascii -NoNewLine .build\commit
+    "$env:VSCODE_QUALITY" | Out-File -Encoding ascii -NoNewLine .build\quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+
+- powershell: |
+    $ErrorActionPreference = "Stop"
+    exit 1
+  displayName: Check RestoreCache
+  condition: and(succeeded(), ne(variables['CacheRestored-Compilation'], 'true'))
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '2.x'
+    addToPath: true
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    "machine github.com`nlogin vscode`npassword $(github-distro-mixin-password)" | Out-File "$env:USERPROFILE\_netrc" -Encoding ASCII
+
+    exec { git config user.email "vscode@microsoft.com" }
+    exec { git config user.name "VSCode" }
+
+    mkdir .build -ea 0
+    "$(VSCODE_ARCH)" | Out-File -Encoding ascii -NoNewLine .build\arch
+  displayName: Prepare tooling
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git" }
+    exec { git fetch distro }
+    exec { git merge $(node -p "require('./package.json').distro") }
+  displayName: Merge distro
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/arch, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:npm_config_arch="$(VSCODE_ARCH)"
+    $env:CHILD_CONCURRENCY="1"
+    exec { yarn --frozen-lockfile }
+  displayName: Install dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/arch, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn postinstall }
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { node build/azure-pipelines/mixin }
+  displayName: Mix in quality
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-min-ci" }
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-code-helper" }
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-inno-updater" }
+  displayName: Build
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)/VSCode-win32-$(VSCODE_ARCH)'
+    Pattern: '*.dll,*.exe,*.node'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolSign",
+          "parameters": [
+            {
+              "parameterName": "OpusName",
+              "parameterValue": "VS Code"
+            },
+            {
+              "parameterName": "OpusInfo",
+              "parameterValue": "https://code.visualstudio.com/"
+            },
+            {
+              "parameterName": "Append",
+              "parameterValue": "/as"
+            },
+            {
+              "parameterName": "FileDigest",
+              "parameterValue": "/fd \"SHA256\""
+            },
+            {
+              "parameterName": "PageHash",
+              "parameterValue": "/NPH"
+            },
+            {
+              "parameterName": "TimeStamp",
+              "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        },
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolVerify",
+          "parameters": [
+            {
+              "parameterName": "VerifyAll",
+              "parameterValue": "/all"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+
+- task: NuGetCommand@2
+  displayName: Install ESRPClient.exe
+  inputs:
+    restoreSolution: 'build\azure-pipelines\win32\ESRPClient\packages.config'
+    feedsToUse: config
+    nugetConfigPath: 'build\azure-pipelines\win32\ESRPClient\NuGet.config'
+    externalFeedCredentials: 3fc0b7f7-da09-4ae7-a9c8-d69824b1819b
+    restoreDirectory: packages
+
+- task: ESRPImportCertTask@1
+  displayName: Import ESRP Request Signing Certificate
+  inputs:
+    ESRP: 'ESRP CodeSign'
+
+- task: PowerShell@2
+  inputs:
+    targetType: filePath
+    filePath: .\build\azure-pipelines\win32\import-esrp-auth-cert.ps1
+    arguments: "$(ESRP-SSL-AADAuth)"
+  displayName: Import ESRP Auth Certificate
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:AZURE_STORAGE_ACCESS_KEY_2 = "$(vscode-storage-key)"
+    $env:AZURE_DOCUMENTDB_MASTERKEY = "$(builds-docdb-key-readwrite)"
+    $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
+    .\build\azure-pipelines\win32\publish.ps1
+  displayName: Publish
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true
--- a/lib/vscode/build/azure-pipelines/win32/product-build-win32.yml
+++ b/lib/vscode/build/azure-pipelines/win32/product-build-win32.yml
@ -0,0 +1,254 @@
+steps:
+- powershell: |
+    mkdir .build -ea 0
+    "$env:BUILD_SOURCEVERSION" | Out-File -Encoding ascii -NoNewLine .build\commit
+    "$env:VSCODE_QUALITY" | Out-File -Encoding ascii -NoNewLine .build\quality
+  displayName: Prepare cache flag
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/commit, .build/quality'
+    targetfolder: '.build, out-build, out-vscode-min, out-vscode-reh-min, out-vscode-reh-web-min'
+    vstsFeed: 'npm-vscode'
+    platformIndependent: true
+    alias: 'Compilation'
+
+- powershell: |
+    $ErrorActionPreference = "Stop"
+    exit 1
+  displayName: Check RestoreCache
+  condition: and(succeeded(), ne(variables['CacheRestored-Compilation'], 'true'))
+
+- task: NodeTool@0
+  inputs:
+    versionSpec: "12.14.1"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.x"
+
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '2.x'
+    addToPath: true
+
+- task: AzureKeyVault@1
+  displayName: 'Azure Key Vault: Get Secrets'
+  inputs:
+    azureSubscription: 'vscode-builds-subscription'
+    KeyVaultName: vscode
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    "machine github.com`nlogin vscode`npassword $(github-distro-mixin-password)" | Out-File "$env:USERPROFILE\_netrc" -Encoding ASCII
+
+    exec { git config user.email "vscode@microsoft.com" }
+    exec { git config user.name "VSCode" }
+
+    mkdir .build -ea 0
+    "$(VSCODE_ARCH)" | Out-File -Encoding ascii -NoNewLine .build\arch
+  displayName: Prepare tooling
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { git remote add distro "https://github.com/$(VSCODE_MIXIN_REPO).git" }
+    exec { git fetch distro }
+    exec { git merge $(node -p "require('./package.json').distro") }
+  displayName: Merge distro
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.RestoreCacheV1.RestoreCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/arch, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:npm_config_arch="$(VSCODE_ARCH)"
+    $env:CHILD_CONCURRENCY="1"
+    exec { yarn --frozen-lockfile }
+  displayName: Install dependencies
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- task: 1ESLighthouseEng.PipelineArtifactCaching.SaveCacheV1.SaveCache@1
+  inputs:
+    keyfile: 'build/.cachesalt, .build/arch, .yarnrc, remote/.yarnrc, **/yarn.lock, !**/node_modules/**/yarn.lock, !**/.*/**/yarn.lock'
+    targetfolder: '**/node_modules, !**/node_modules/**/node_modules'
+    vstsFeed: 'npm-vscode'
+  condition: and(succeeded(), ne(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn postinstall }
+  displayName: Run postinstall scripts
+  condition: and(succeeded(), eq(variables['CacheRestored'], 'true'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { node build/azure-pipelines/mixin }
+  displayName: Mix in quality
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-min-ci" }
+    exec { yarn gulp "vscode-reh-win32-$env:VSCODE_ARCH-min-ci" }
+    exec { yarn gulp "vscode-reh-web-win32-$env:VSCODE_ARCH-min-ci" }
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-code-helper" }
+    exec { yarn gulp "vscode-win32-$env:VSCODE_ARCH-inno-updater" }
+  displayName: Build
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn electron $(VSCODE_ARCH) }
+    exec { .\scripts\test.bat --build --tfs "Unit Tests" }
+  displayName: Run unit tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { yarn test-browser --build --browser chromium --browser firefox --tfs "Browser Unit Tests" }
+  displayName: Run unit tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- powershell: |
+    # Figure out the full absolute path of the product we just built
+    # including the remote server and configure the integration tests
+    # to run with these builds instead of running out of sources.
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $AppRoot = "$(agent.builddirectory)\VSCode-win32-$(VSCODE_ARCH)"
+    $AppProductJson = Get-Content -Raw -Path "$AppRoot\resources\app\product.json" | ConvertFrom-Json
+    $AppNameShort = $AppProductJson.nameShort
+    exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-win32-$(VSCODE_ARCH)"; .\scripts\test-integration.bat --build --tfs "Integration Tests" }
+  displayName: Run integration tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-web-win32-$(VSCODE_ARCH)"; .\resources\server\test\test-web-integration.bat --browser firefox }
+  displayName: Run integration tests (Browser)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $AppRoot = "$(agent.builddirectory)\VSCode-win32-$(VSCODE_ARCH)"
+    $AppProductJson = Get-Content -Raw -Path "$AppRoot\resources\app\product.json" | ConvertFrom-Json
+    $AppNameShort = $AppProductJson.nameShort
+    exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-win32-$(VSCODE_ARCH)"; .\resources\server\test\test-remote-integration.bat }
+  displayName: Run remote integration tests (Electron)
+  condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+- task: PublishPipelineArtifact@0
+  inputs:
+    artifactName: crash-dump-windows-$(VSCODE_ARCH)
+    targetPath: .build\crashes
+  displayName: 'Publish Crash Reports'
+  continueOnError: true
+  condition: failed()
+
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)/VSCode-win32-$(VSCODE_ARCH),$(agent.builddirectory)/vscode-reh-win32-$(VSCODE_ARCH)'
+    Pattern: '*.dll,*.exe,*.node'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolSign",
+          "parameters": [
+            {
+              "parameterName": "OpusName",
+              "parameterValue": "VS Code"
+            },
+            {
+              "parameterName": "OpusInfo",
+              "parameterValue": "https://code.visualstudio.com/"
+            },
+            {
+              "parameterName": "Append",
+              "parameterValue": "/as"
+            },
+            {
+              "parameterName": "FileDigest",
+              "parameterValue": "/fd \"SHA256\""
+            },
+            {
+              "parameterName": "PageHash",
+              "parameterValue": "/NPH"
+            },
+            {
+              "parameterName": "TimeStamp",
+              "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        },
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolVerify",
+          "parameters": [
+            {
+              "parameterName": "VerifyAll",
+              "parameterValue": "/all"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+
+- task: NuGetCommand@2
+  displayName: Install ESRPClient.exe
+  inputs:
+    restoreSolution: 'build\azure-pipelines\win32\ESRPClient\packages.config'
+    feedsToUse: config
+    nugetConfigPath: 'build\azure-pipelines\win32\ESRPClient\NuGet.config'
+    externalFeedCredentials: 'ESRP Nuget'
+    restoreDirectory: packages
+
+- task: ESRPImportCertTask@1
+  displayName: Import ESRP Request Signing Certificate
+  inputs:
+    ESRP: 'ESRP CodeSign'
+
+- task: PowerShell@2
+  inputs:
+    targetType: filePath
+    filePath: .\build\azure-pipelines\win32\import-esrp-auth-cert.ps1
+    arguments: "$(ESRP-SSL-AADAuth)"
+  displayName: Import ESRP Auth Certificate
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:AZURE_STORAGE_ACCESS_KEY_2 = "$(vscode-storage-key)"
+    $env:AZURE_DOCUMENTDB_MASTERKEY = "$(builds-docdb-key-readwrite)"
+    $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
+    .\build\azure-pipelines\win32\publish.ps1
+  displayName: Publish
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true
--- a/lib/vscode/build/azure-pipelines/win32/publish.ps1
+++ b/lib/vscode/build/azure-pipelines/win32/publish.ps1
@ -0,0 +1,36 @@
+. build/azure-pipelines/win32/exec.ps1
+$ErrorActionPreference = "Stop"
+
+$Arch = "$env:VSCODE_ARCH"
+
+exec { yarn gulp "vscode-win32-$Arch-archive" "vscode-win32-$Arch-system-setup" "vscode-win32-$Arch-user-setup" --sign }
+
+$Repo = "$(pwd)"
+$Root = "$Repo\.."
+$SystemExe = "$Repo\.build\win32-$Arch\system-setup\VSCodeSetup.exe"
+$UserExe = "$Repo\.build\win32-$Arch\user-setup\VSCodeSetup.exe"
+$Zip = "$Repo\.build\win32-$Arch\archive\VSCode-win32-$Arch.zip"
+$LegacyServer = "$Root\vscode-reh-win32-$Arch"
+$Server = "$Root\vscode-server-win32-$Arch"
+$ServerZip = "$Repo\.build\vscode-server-win32-$Arch.zip"
+$Build = "$Root\VSCode-win32-$Arch"
+
+# Create server archive
+if ("$Arch" -ne "arm64") {
+	exec { xcopy $LegacyServer $Server /H /E /I }
+	exec { .\node_modules\7zip\7zip-lite\7z.exe a -tzip $ServerZip $Server -r }
+}
+
+# get version
+$PackageJson = Get-Content -Raw -Path "$Build\resources\app\package.json" | ConvertFrom-Json
+$Version = $PackageJson.version
+
+$AssetPlatform = if ("$Arch" -eq "ia32") { "win32" } else { "win32-$Arch" }
+
+exec { node build/azure-pipelines/common/createAsset.js "$AssetPlatform-archive" archive "VSCode-win32-$Arch-$Version.zip" $Zip }
+exec { node build/azure-pipelines/common/createAsset.js "$AssetPlatform" setup "VSCodeSetup-$Arch-$Version.exe" $SystemExe }
+exec { node build/azure-pipelines/common/createAsset.js "$AssetPlatform-user" setup "VSCodeUserSetup-$Arch-$Version.exe" $UserExe }
+
+if ("$Arch" -ne "arm64") {
+	exec { node build/azure-pipelines/common/createAsset.js "server-$AssetPlatform" archive "vscode-server-win32-$Arch.zip" $ServerZip }
+}
--- a/lib/vscode/build/azure-pipelines/win32/sign.ps1
+++ b/lib/vscode/build/azure-pipelines/win32/sign.ps1
@ -0,0 +1,71 @@
+function Create-TmpJson($Obj) {
+	$FileName = [System.IO.Path]::GetTempFileName()
+	ConvertTo-Json -Depth 100 $Obj | Out-File -Encoding UTF8 $FileName
+	return $FileName
+}
+
+$Auth = Create-TmpJson @{
+	Version = "1.0.0"
+	AuthenticationType = "AAD_CERT"
+	ClientId = $env:ESRPClientId
+	AuthCert = @{
+		SubjectName = $env:ESRPAuthCertificateSubjectName
+		StoreLocation = "LocalMachine"
+		StoreName = "My"
+		SendX5c = "true"
+	}
+	RequestSigningCert = @{
+		SubjectName = $env:ESRPCertificateSubjectName
+		StoreLocation = "LocalMachine"
+		StoreName = "My"
+	}
+}
+
+$Policy = Create-TmpJson @{
+	Version = "1.0.0"
+}
+
+$Input = Create-TmpJson @{
+	Version = "1.0.0"
+	SignBatches = @(
+		@{
+			SourceLocationType = "UNC"
+			SignRequestFiles = @(
+				@{
+					SourceLocation = $args[0]
+				}
+			)
+			SigningInfo = @{
+				Operations = @(
+					@{
+						KeyCode = "CP-230012"
+						OperationCode = "SigntoolSign"
+						Parameters = @{
+							OpusName = "VS Code"
+							OpusInfo = "https://code.visualstudio.com/"
+							Append = "/as"
+							FileDigest = "/fd `"SHA256`""
+							PageHash = "/NPH"
+							TimeStamp = "/tr `"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer`" /td sha256"
+						}
+						ToolName = "sign"
+						ToolVersion = "1.0"
+					},
+					@{
+						KeyCode = "CP-230012"
+						OperationCode = "SigntoolVerify"
+						Parameters = @{
+							VerifyAll = "/all"
+						}
+						ToolName = "sign"
+						ToolVersion = "1.0"
+					}
+				)
+			}
+		}
+	)
+}
+
+$Output = [System.IO.Path]::GetTempFileName()
+$ScriptPath = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent
+& "$ScriptPath\ESRPClient\packages\Microsoft.ESRPClient.*\tools\ESRPClient.exe" Sign -a $Auth -p $Policy -i $Input -o $Output