Set up extension build and sign pipeline

eng/Signing.props

@@ -4,6 +4,7 @@
     <FileExtensionSignInfo Update=".nupkg" CertificateName="NuGet" />
     <FileExtensionSignInfo Update=".zip" CertificateName="None" />
     <FileExtensionSignInfo Update=".js" CertificateName="MicrosoftDotNet500" />
+    <FileExtensionSignInfo Update=".vsix" CertificateName="VsixSHA2" />
 
     <!-- add missing entry for .msi, this can be removed once aspire uses arcade 10.0 -->
     <FileExtensionSignInfo Include=".msi" CertificateName="MicrosoftDotNet500" Condition="!@(FileExtensionSignInfo->AnyHaveMetadataValue('Identity', '.msi'))" />
@@ -54,6 +55,7 @@
     <ItemsToSign Include="$(VisualStudioSetupInsertionPath)\**\*.zip" Condition="'$(PostBuildSign)' != 'true'" />
     <ItemsToSign Include="$(ArtifactsPackagesDir)**\aspire-cli-*.zip" />
     <ItemsToSign Include="$(ArtifactsPackagesDir)**\aspire-cli-*.tar.gz" />
+    <ItemsToSign Include="$(ArtifactsPackagesDir)**\aspire-vscode-*.vsix" />
     <ItemsToSignPostBuild Include="$(VisualStudioSetupInsertionPath)\**\*.zip" Condition="'$(PostBuildSign)' == 'true'" />
   </ItemGroup>
 </Project>

eng/pipelines/azure-pipelines.yml

@@ -127,6 +127,36 @@ extends:
 
     stages:
 
+    - stage: build_sign_extension
+      displayName: Build VS Code extension
+
+      jobs:
+      - template: /eng/common/templates-official/jobs/jobs.yml@self
+        parameters:
+          enableMicrobuild: true
+          enableTelemetry: true
+          jobs:
+          - job: BuildExtension
+            displayName: Build VS Code extension
+            timeoutInMinutes: 30
+
+            pool:
+              name: NetCore1ESPool-Internal
+              image: windows.vs2022preview.amd64
+              os: windows
+
+            preSteps:
+              - checkout: self
+                fetchDepth: 1
+                clean: true
+
+            steps:
+              - template: /eng/pipelines/templates/BuildExtension.yml
+                parameters:
+                  buildConfig: $(_BuildConfig)
+                  repoArtifactsPath: $(Build.Arcade.ArtifactsPath)
+                  repoLogPath: $(Build.Arcade.LogsPath)
+
     - stage: build_sign_native
       displayName: Build+Sign native packages
 

eng/pipelines/templates/BuildExtension.yml

@@ -0,0 +1,151 @@
+parameters:
+  - name: buildConfig
+    type: string
+  - name: repoArtifactsPath
+    type: string
+  - name: repoLogPath
+    type: string
+  - name: buildArgs
+    type: string
+    default: ''
+
+steps:
+  - task: NodeTool@0
+    displayName: 🟣Install node.js
+    inputs:
+      versionSpec: '20.x'
+
+  - task: PowerShell@2
+    displayName: 🟣Install yarn
+    inputs:
+      targetType: 'inline'
+      script: |
+        npm install -g yarn
+        yarn --version
+      workingDirectory: '$(Build.SourcesDirectory)'
+
+  - task: PowerShell@2
+    displayName: 🟣Install vsce
+    inputs:
+      targetType: 'inline'
+      script: |
+        npm install -g @vscode/vsce
+        vsce --version
+      workingDirectory: '$(Build.SourcesDirectory)'
+
+  - task: PowerShell@2
+    displayName: 🟣Install dependencies and run localization
+    inputs:
+      targetType: 'inline'
+      script: |
+        # Install dependencies
+        yarn install
+
+        # Compile
+        yarn compile
+
+        # Run localization
+        yarn ci-localize
+      workingDirectory: '$(Build.SourcesDirectory)/extension'
+      errorActionPreference: 'stop'
+    env:
+      YARN_CACHE_FOLDER: $(Pipeline.Workspace)/.yarn
+
+  - task: PowerShell@2
+    displayName: 🟣Package extension as VSIX
+    inputs:
+      targetType: 'inline'
+      script: |
+        # Read version from package.json and package with pre-release flag
+        $packageJson = Get-Content 'package.json' | ConvertFrom-Json
+        $version = $packageJson.version
+        Write-Host "Packaging extension version: $version"
+
+        # Create artifacts directory if it doesn't exist - use same pattern as native build
+        $artifactsDir = "${{ parameters.repoArtifactsPath }}packages"
+        if (-not (Test-Path $artifactsDir)) {
+          New-Item -ItemType Directory -Path $artifactsDir -Force
+        }
+
+        # Package extension using locally installed vsce
+        $vsixFileName = "aspire-vscode-$version.vsix"
+        vsce package --pre-release --out "$artifactsDir/$vsixFileName"
+
+        if ($LASTEXITCODE -ne 0) {
+          throw "Extension packaging failed with exit code $LASTEXITCODE"
+        }
+
+        Write-Host "Extension packaged successfully to: $artifactsDir/$vsixFileName"
+      workingDirectory: '$(Build.SourcesDirectory)/extension'
+      errorActionPreference: 'stop'
+
+  - task: PowerShell@2
+    displayName: 🟣List extension artifacts
+    inputs:
+      targetType: 'inline'
+      script: |
+        $artifactsDir = "${{ parameters.repoArtifactsPath }}packages"
+        if (Test-Path $artifactsDir) {
+          Get-ChildItem -Path $artifactsDir -Filter "*.vsix" | ForEach-Object {
+            Write-Host "Found extension artifact: $($_.FullName) (Size: $([math]::Round($_.Length/1KB,2)) KB)"
+          }
+        } else {
+          Write-Host "Artifacts directory not found: $artifactsDir"
+        }
+
+  # Sign the extension if this is not a test build
+  - ${{ if ne(variables['_SignType'], 'test') }}:
+    - task: PowerShell@2
+      displayName: 🟣Sign extension
+      inputs:
+        targetType: 'inline'
+        script: |
+          Write-Host "=== Extension Signing Debug Info ==="
+          Write-Host "Sign type: $(_SignType)"
+          Write-Host "Team name: $(_TeamName)"
+          $artifactsDir = "${{ parameters.repoArtifactsPath }}packages"
+          Write-Host "Artifacts directory: $artifactsDir"
+
+          Write-Host "=== Starting signing process ==="
+          # Use the Arcade common build script with explicit ArtifactsPackagesDir to ensure signing finds the VSIX files
+          $buildCmd = "$(Build.SourcesDirectory)\eng\common\build.cmd"
+          $buildArgs = @(
+            "-ci"
+            "-restore"
+            "-sign"
+            "/p:DotNetSignType=$(_SignType)"
+            "/p:TeamName=$(_TeamName)"
+            "/p:Sign=true"
+            "/p:SignType=$(_SignType)"
+            "/p:ArtifactsPackagesDir=$artifactsDir\"
+            "/v:normal"
+          )
+
+          Write-Host "Build command: $buildCmd"
+          Write-Host "Build args: $($buildArgs -join ' ')"
+
+          try {
+            & $buildCmd @buildArgs
+            if ($LASTEXITCODE -ne 0) {
+              Write-Host "Build.cmd failed with exit code: $LASTEXITCODE"
+              exit $LASTEXITCODE
+            }
+            Write-Host "Build.cmd completed successfully"
+          }
+          catch {
+            Write-Host "Error calling build.cmd: $_"
+            exit 1
+          }
+
+          Write-Host "=== Signing completed, listing files after ==="
+          Get-ChildItem $artifactsDir -Filter "*.vsix" | ForEach-Object {
+            Write-Host "  $($_.Name) - Size: $($_.Length) bytes - Modified: $($_.LastWriteTime)"
+          }
+        errorActionPreference: 'stop'
+      env:
+        SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+  - task: 1ES.PublishBuildArtifacts@1
+    displayName: 🟣Publish extension artifact
+    inputs:
+      PathtoPublish: '${{ parameters.repoArtifactsPath }}packages/'
+      ArtifactName: aspire-extension