Merge from vscode 718331d6f3ebd1b571530ab499edb266ddd493d5

build/azure-pipelines/darwin/product-build-darwin.yml

@@ -44,6 +44,13 @@ steps:
 
     git config user.email "vscode@microsoft.com"
     git config user.name "VSCode"
+
+    security create-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
+    security default-keychain -s $(agent.tempdirectory)/buildagent.keychain
+    security unlock-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
+    echo "$(macos-developer-certificate)" | base64 -D > $(agent.tempdirectory)/cert.p12
+    security import $(agent.tempdirectory)/cert.p12 -k $(agent.tempdirectory)/buildagent.keychain -P "$(macos-developer-certificate-key)" -T /usr/bin/codesign
+    security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd $(agent.tempdirectory)/buildagent.keychain
   displayName: Prepare tooling
 
 - script: |
@@ -114,30 +121,25 @@ steps:
   displayName: Run integration tests
   condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
-# Web Smoke Tests disabled due to https://github.com/microsoft/vscode/issues/80308
-# - script: |
-#     set -e
-#     cd test/smoke
-#     yarn compile
-#     cd -
-#     yarn smoketest --web --headless
-#   continueOnError: true
-#   displayName: Run web smoke tests
-#   condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
 - script: |
     set -e
     cd test/smoke
     yarn compile
     cd -
+    VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-darwin" \
     yarn smoketest --web --headless
   continueOnError: true
-  displayName: Run smoke tests
+  displayName: Run web smoke tests
   condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
 - script: |
     set -e
-    pushd ../VSCode-darwin && zip -r -X -y ../VSCode-darwin.zip * && popd
+    codesign -s 99FM488X57 --deep --force --options runtime --entitlements build/azure-pipelines/darwin/entitlements.plist $(agent.builddirectory)/VSCode-darwin/*.app
+  displayName: Set Hardened Entitlements
+
+- script: |
+    set -e
+    pushd $(agent.builddirectory)/VSCode-darwin && zip -r -X -y $(agent.builddirectory)/VSCode-darwin.zip * && popd
   displayName: Archive build
 
 - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
@@ -151,13 +153,53 @@ steps:
         {
           "keyCode": "CP-401337-Apple",
           "operationSetCode": "MacAppDeveloperSign",
-          "parameters": [ ],
+          "parameters": [
+            {
+              "parameterName": "Hardening",
+              "parameterValue": "--options=runtime"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 60
+  displayName: Codesign
+
+- script: |
+    zip -d $(agent.builddirectory)/VSCode-darwin.zip "*.pkg"
+  displayName: Clean Archive
+
+- script: |
+    APP_ROOT=$(agent.builddirectory)/VSCode-darwin
+    APP_NAME="`ls $APP_ROOT | head -n 1`"
+    BUNDLE_IDENTIFIER=$(node -p "require(\"$APP_ROOT/$APP_NAME/Contents/Resources/app/product.json\").darwinBundleIdentifier")
+    echo "##vso[task.setvariable variable=BundleIdentifier]$BUNDLE_IDENTIFIER"
+  displayName: Export bundle identifier
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)'
+    Pattern: 'VSCode-darwin.zip'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-401337-Apple",
+          "operationSetCode": "MacAppNotarize",
+          "parameters": [
+            {
+              "parameterName": "BundleId",
+              "parameterValue": "$(BundleIdentifier)"
+            }
+          ],
           "toolName": "sign",
           "toolVersion": "1.0"
         }
       ]
     SessionTimeout: 120
-  displayName: Codesign
+  displayName: Notarization
 
 - script: |
     set -e