Merge from master

build/azure-pipelines/common/.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+*.js

build/azure-pipelines/common/installDistro.ts

@@ -0,0 +1,18 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as  cp from 'child_process';
+
+function yarnInstall(packageName: string): void {
+	cp.execSync(`yarn add --no-lockfile ${packageName}`);
+}
+
+const product = require('../../../product.json');
+const dependencies = product.dependencies || {} as { [name: string]: string; };
+
+Object.keys(dependencies).forEach(name => {
+	const url = dependencies[name];
+	yarnInstall(url);
+});

build/azure-pipelines/common/publish.ts

@@ -0,0 +1,286 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as fs from 'fs';
+import { execSync } from 'child_process';
+import { Readable } from 'stream';
+import * as crypto from 'crypto';
+import * as azure from 'azure-storage';
+import * as mime from 'mime';
+import * as minimist from 'minimist';
+import { DocumentClient, NewDocument } from 'documentdb';
+
+if (process.argv.length < 6) {
+	console.error('Usage: node publish.js <product> <platform> <type> <name> <version> <commit> <is_update> <file>');
+	process.exit(-1);
+}
+
+function hashStream(hashName: string, stream: Readable): Promise<string> {
+	return new Promise<string>((c, e) => {
+		const shasum = crypto.createHash(hashName);
+
+		stream
+			.on('data', shasum.update.bind(shasum))
+			.on('error', e)
+			.on('close', () => c(shasum.digest('hex')));
+	});
+}
+
+interface Config {
+	id: string;
+	frozen: boolean;
+}
+
+function createDefaultConfig(quality: string): Config {
+	return {
+		id: quality,
+		frozen: false
+	};
+}
+
+function getConfig(quality: string): Promise<Config> {
+	const client = new DocumentClient(process.env['AZURE_DOCUMENTDB_ENDPOINT']!, { masterKey: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const collection = 'dbs/builds/colls/config';
+	const query = {
+		query: `SELECT TOP 1 * FROM c WHERE c.id = @quality`,
+		parameters: [
+			{ name: '@quality', value: quality }
+		]
+	};
+
+	return new Promise<Config>((c, e) => {
+		client.queryDocuments(collection, query).toArray((err, results) => {
+			if (err && err.code !== 409) { return e(err); }
+
+			c(!results || results.length === 0 ? createDefaultConfig(quality) : results[0] as any as Config);
+		});
+	});
+}
+
+interface Asset {
+	platform: string;
+	type: string;
+	url: string;
+	mooncakeUrl: string;
+	hash: string;
+	sha256hash: string;
+	size: number;
+	supportsFastUpdate?: boolean;
+}
+
+function createOrUpdate(commit: string, quality: string, platform: string, type: string, release: NewDocument, asset: Asset, isUpdate: boolean): Promise<void> {
+	const client = new DocumentClient(process.env['AZURE_DOCUMENTDB_ENDPOINT']!, { masterKey: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const collection = 'dbs/builds/colls/' + quality;
+	const updateQuery = {
+		query: 'SELECT TOP 1 * FROM c WHERE c.id = @id',
+		parameters: [{ name: '@id', value: commit }]
+	};
+
+	let updateTries = 0;
+
+	function update(): Promise<void> {
+		updateTries++;
+
+		return new Promise<void>((c, e) => {
+			client.queryDocuments(collection, updateQuery).toArray((err, results) => {
+				if (err) { return e(err); }
+				if (results.length !== 1) { return e(new Error('No documents')); }
+
+				const release = results[0];
+
+				release.assets = [
+					...release.assets.filter((a: any) => !(a.platform === platform && a.type === type)),
+					asset
+				];
+
+				if (isUpdate) {
+					release.updates[platform] = type;
+				}
+
+				client.replaceDocument(release._self, release, err => {
+					if (err && err.code === 409 && updateTries < 5) { return c(update()); }
+					if (err) { return e(err); }
+
+					console.log('Build successfully updated.');
+					c();
+				});
+			});
+		});
+	}
+
+	return new Promise<void>((c, e) => {
+		client.createDocument(collection, release, err => {
+			if (err && err.code === 409) { return c(update()); }
+			if (err) { return e(err); }
+
+			console.log('Build successfully published.');
+			c();
+		});
+	});
+}
+
+async function assertContainer(blobService: azure.BlobService, quality: string): Promise<void> {
+	await new Promise((c, e) => blobService.createContainerIfNotExists(quality, { publicAccessLevel: 'blob' }, err => err ? e(err) : c()));
+}
+
+async function doesAssetExist(blobService: azure.BlobService, quality: string, blobName: string): Promise<boolean | undefined> {
+	const existsResult = await new Promise<azure.BlobService.BlobResult>((c, e) => blobService.doesBlobExist(quality, blobName, (err, r) => err ? e(err) : c(r)));
+	return existsResult.exists;
+}
+
+async function uploadBlob(blobService: azure.BlobService, quality: string, blobName: string, file: string): Promise<void> {
+	const blobOptions: azure.BlobService.CreateBlockBlobRequestOptions = {
+		contentSettings: {
+			contentType: mime.lookup(file),
+			cacheControl: 'max-age=31536000, public'
+		}
+	};
+
+	await new Promise((c, e) => blobService.createBlockBlobFromLocalFile(quality, blobName, file, blobOptions, err => err ? e(err) : c()));
+}
+
+interface PublishOptions {
+	'upload-only': boolean;
+}
+
+async function publish(commit: string, quality: string, platform: string, type: string, name: string, version: string, _isUpdate: string, file: string, opts: PublishOptions): Promise<void> {
+	const isUpdate = _isUpdate === 'true';
+
+	const queuedBy = process.env['BUILD_QUEUEDBY']!;
+	const sourceBranch = process.env['BUILD_SOURCEBRANCH']!;
+	const isReleased = quality === 'insider'
+		&& /^master$|^refs\/heads\/master$/.test(sourceBranch)
+		&& /Project Collection Service Accounts|Microsoft.VisualStudio.Services.TFS/.test(queuedBy);
+
+	console.log('Publishing...');
+	console.log('Quality:', quality);
+	console.log('Platform:', platform);
+	console.log('Type:', type);
+	console.log('Name:', name);
+	console.log('Version:', version);
+	console.log('Commit:', commit);
+	console.log('Is Update:', isUpdate);
+	console.log('Is Released:', isReleased);
+	console.log('File:', file);
+
+	const stat = await new Promise<fs.Stats>((c, e) => fs.stat(file, (err, stat) => err ? e(err) : c(stat)));
+	const size = stat.size;
+
+	console.log('Size:', size);
+
+	const stream = fs.createReadStream(file);
+	const [sha1hash, sha256hash] = await Promise.all([hashStream('sha1', stream), hashStream('sha256', stream)]);
+
+	console.log('SHA1:', sha1hash);
+	console.log('SHA256:', sha256hash);
+
+	const blobName = commit + '/' + name;
+	const storageAccount = process.env['AZURE_STORAGE_ACCOUNT_2']!;
+
+	const blobService = azure.createBlobService(storageAccount, process.env['AZURE_STORAGE_ACCESS_KEY_2']!)
+		.withFilter(new azure.ExponentialRetryPolicyFilter(20));
+
+	const mooncakeBlobService = azure.createBlobService(storageAccount, process.env['MOONCAKE_STORAGE_ACCESS_KEY']!, `${storageAccount}.blob.core.chinacloudapi.cn`)
+		.withFilter(new azure.ExponentialRetryPolicyFilter(20));
+
+	// mooncake is fussy and far away, this is needed!
+	mooncakeBlobService.defaultClientRequestTimeoutInMs = 10 * 60 * 1000;
+
+	await Promise.all([
+		assertContainer(blobService, quality),
+		assertContainer(mooncakeBlobService, quality)
+	]);
+
+	const [blobExists, moooncakeBlobExists] = await Promise.all([
+		doesAssetExist(blobService, quality, blobName),
+		doesAssetExist(mooncakeBlobService, quality, blobName)
+	]);
+
+	const promises: Array<Promise<void>> = [];
+
+	if (!blobExists) {
+		promises.push(uploadBlob(blobService, quality, blobName, file));
+	}
+
+	if (!moooncakeBlobExists) {
+		promises.push(uploadBlob(mooncakeBlobService, quality, blobName, file));
+	}
+
+	if (promises.length === 0) {
+		console.log(`Blob ${quality}, ${blobName} already exists, not publishing again.`);
+		return;
+	}
+
+	console.log('Uploading blobs to Azure storage...');
+
+	await Promise.all(promises);
+
+	console.log('Blobs successfully uploaded.');
+
+	const config = await getConfig(quality);
+
+	console.log('Quality config:', config);
+
+	const asset: Asset = {
+		platform: platform,
+		type: type,
+		url: `${process.env['AZURE_CDN_URL']}/${quality}/${blobName}`,
+		mooncakeUrl: `${process.env['MOONCAKE_CDN_URL']}/${quality}/${blobName}`,
+		hash: sha1hash,
+		sha256hash,
+		size
+	};
+
+	// Remove this if we ever need to rollback fast updates for windows
+	if (/win32/.test(platform)) {
+		asset.supportsFastUpdate = true;
+	}
+
+	console.log('Asset:', JSON.stringify(asset, null, '  '));
+
+	const release = {
+		id: commit,
+		timestamp: (new Date()).getTime(),
+		version,
+		isReleased: config.frozen ? false : isReleased,
+		sourceBranch,
+		queuedBy,
+		assets: [] as Array<Asset>,
+		updates: {} as any
+	};
+
+	if (!opts['upload-only']) {
+		release.assets.push(asset);
+
+		if (isUpdate) {
+			release.updates[platform] = type;
+		}
+	}
+
+	await createOrUpdate(commit, quality, platform, type, release, asset, isUpdate);
+}
+
+function main(): void {
+	if (process.env['VSCODE_BUILD_SKIP_PUBLISH']) {
+		console.warn('Skipping publish due to VSCODE_BUILD_SKIP_PUBLISH');
+		return;
+	}
+
+	const opts = minimist<PublishOptions>(process.argv.slice(2), {
+		boolean: ['upload-only']
+	});
+
+	const [quality, platform, type, name, version, _isUpdate, file] = opts._;
+	const commit = execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();
+
+	publish(commit, quality, platform, type, name, version, _isUpdate, file, opts).catch(err => {
+		console.error(err);
+		process.exit(1);
+	});
+}
+
+main();

build/azure-pipelines/common/symbols.ts

@@ -0,0 +1,219 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as request from 'request';
+import { createReadStream, createWriteStream, unlink, mkdir } from 'fs';
+import * as github from 'github-releases';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { promisify } from 'util';
+
+const BASE_URL = 'https://rink.hockeyapp.net/api/2/';
+const HOCKEY_APP_TOKEN_HEADER = 'X-HockeyAppToken';
+
+export interface IVersions {
+	app_versions: IVersion[];
+}
+
+export interface IVersion {
+	id: number;
+	version: string;
+}
+
+export interface IApplicationAccessor {
+	accessToken: string;
+	appId: string;
+}
+
+export interface IVersionAccessor extends IApplicationAccessor {
+	id: string;
+}
+
+enum Platform {
+	WIN_32 = 'win32-ia32',
+	WIN_64 = 'win32-x64',
+	LINUX_32 = 'linux-ia32',
+	LINUX_64 = 'linux-x64',
+	MAC_OS = 'darwin-x64'
+}
+
+function symbolsZipName(platform: Platform, electronVersion: string, insiders: boolean): string {
+	return `${insiders ? 'insiders' : 'stable'}-symbols-v${electronVersion}-${platform}.zip`;
+}
+
+const SEED = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+async function tmpFile(name: string): Promise<string> {
+	let res = '';
+	for (let i = 0; i < 8; i++) {
+		res += SEED.charAt(Math.floor(Math.random() * SEED.length));
+	}
+
+	const tmpParent = join(tmpdir(), res);
+
+	await promisify(mkdir)(tmpParent);
+
+	return join(tmpParent, name);
+}
+
+function getVersions(accessor: IApplicationAccessor): Promise<IVersions> {
+	return asyncRequest<IVersions>({
+		url: `${BASE_URL}/apps/${accessor.appId}/app_versions`,
+		method: 'GET',
+		headers: {
+			[HOCKEY_APP_TOKEN_HEADER]: accessor.accessToken
+		}
+	});
+}
+
+function createVersion(accessor: IApplicationAccessor, version: string): Promise<IVersion> {
+	return asyncRequest<IVersion>({
+		url: `${BASE_URL}/apps/${accessor.appId}/app_versions/new`,
+		method: 'POST',
+		headers: {
+			[HOCKEY_APP_TOKEN_HEADER]: accessor.accessToken
+		},
+		formData: {
+			bundle_version: version
+		}
+	});
+}
+
+function updateVersion(accessor: IVersionAccessor, symbolsPath: string) {
+	return asyncRequest<IVersions>({
+		url: `${BASE_URL}/apps/${accessor.appId}/app_versions/${accessor.id}`,
+		method: 'PUT',
+		headers: {
+			[HOCKEY_APP_TOKEN_HEADER]: accessor.accessToken
+		},
+		formData: {
+			dsym: createReadStream(symbolsPath)
+		}
+	});
+}
+
+function asyncRequest<T>(options: request.UrlOptions & request.CoreOptions): Promise<T> {
+	return new Promise<T>((resolve, reject) => {
+		request(options, (error, _response, body) => {
+			if (error) {
+				reject(error);
+			} else {
+				resolve(JSON.parse(body));
+			}
+		});
+	});
+}
+
+function downloadAsset(repository: any, assetName: string, targetPath: string, electronVersion: string) {
+	return new Promise((resolve, reject) => {
+		repository.getReleases({ tag_name: `v${electronVersion}` }, (err: any, releases: any) => {
+			if (err) {
+				reject(err);
+			} else {
+				const asset = releases[0].assets.filter((asset: any) => asset.name === assetName)[0];
+				if (!asset) {
+					reject(new Error(`Asset with name ${assetName} not found`));
+				} else {
+					repository.downloadAsset(asset, (err: any, reader: any) => {
+						if (err) {
+							reject(err);
+						} else {
+							const writer = createWriteStream(targetPath);
+							writer.on('error', reject);
+							writer.on('close', resolve);
+							reader.on('error', reject);
+
+							reader.pipe(writer);
+						}
+					});
+				}
+			}
+		});
+	});
+}
+
+interface IOptions {
+	repository: string;
+	platform: Platform;
+	versions: { code: string; insiders: boolean; electron: string; };
+	access: { hockeyAppToken: string; hockeyAppId: string; githubToken: string };
+}
+
+async function ensureVersionAndSymbols(options: IOptions) {
+
+	// Check version does not exist
+	console.log(`HockeyApp: checking for existing version ${options.versions.code} (${options.platform})`);
+	const versions = await getVersions({ accessToken: options.access.hockeyAppToken, appId: options.access.hockeyAppId });
+	if (versions.app_versions.some(v => v.version === options.versions.code)) {
+		console.log(`HockeyApp: Returning without uploading symbols because version ${options.versions.code} (${options.platform}) was already found`);
+		return;
+	}
+
+	// Download symbols for platform and electron version
+	const symbolsName = symbolsZipName(options.platform, options.versions.electron, options.versions.insiders);
+	const symbolsPath = await tmpFile('symbols.zip');
+	console.log(`HockeyApp: downloading symbols ${symbolsName} for electron ${options.versions.electron} (${options.platform}) into ${symbolsPath}`);
+	await downloadAsset(new (github as any)({ repo: options.repository, token: options.access.githubToken }), symbolsName, symbolsPath, options.versions.electron);
+
+	// Create version
+	console.log(`HockeyApp: creating new version ${options.versions.code} (${options.platform})`);
+	const version = await createVersion({ accessToken: options.access.hockeyAppToken, appId: options.access.hockeyAppId }, options.versions.code);
+
+	// Upload symbols
+	console.log(`HockeyApp: uploading symbols for version ${options.versions.code} (${options.platform})`);
+	await updateVersion({ id: String(version.id), accessToken: options.access.hockeyAppToken, appId: options.access.hockeyAppId }, symbolsPath);
+
+	// Cleanup
+	await promisify(unlink)(symbolsPath);
+}
+
+// Environment
+const pakage = require('../../../package.json');
+const product = require('../../../product.json');
+const repository = product.electronRepository;
+const electronVersion = require('../../lib/electron').getElectronVersion();
+const insiders = product.quality !== 'stable';
+let codeVersion = pakage.version;
+if (insiders) {
+	codeVersion = `${codeVersion}-insider`;
+}
+const githubToken = process.argv[2];
+const hockeyAppToken = process.argv[3];
+const is64 = process.argv[4] === 'x64';
+const hockeyAppId = process.argv[5];
+
+let platform: Platform;
+if (process.platform === 'darwin') {
+	platform = Platform.MAC_OS;
+} else if (process.platform === 'win32') {
+	platform = is64 ? Platform.WIN_64 : Platform.WIN_32;
+} else {
+	platform = is64 ? Platform.LINUX_64 : Platform.LINUX_32;
+}
+
+// Create version and upload symbols in HockeyApp
+if (repository && codeVersion && electronVersion && (product.quality === 'stable' || product.quality === 'insider')) {
+	ensureVersionAndSymbols({
+		repository,
+		platform,
+		versions: {
+			code: codeVersion,
+			insiders,
+			electron: electronVersion
+		},
+		access: {
+			githubToken,
+			hockeyAppToken,
+			hockeyAppId
+		}
+	}).then(() => {
+		console.log('HockeyApp: done');
+	}).catch(error => {
+		console.error(`HockeyApp: error (${error})`);
+	});
+} else {
+	console.log(`HockeyApp: skipping due to unexpected context (repository: ${repository}, codeVersion: ${codeVersion}, electronVersion: ${electronVersion}, quality: ${product.quality})`);
+}

build/azure-pipelines/darwin/continuous-build-darwin.yml

@@ -0,0 +1,40 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "8.12.0"
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.10.1"
+- script: |
+    yarn
+  displayName: Install Dependencies
+- script: |
+    yarn gulp electron-x64
+  displayName: Download Electron
+- script: |
+    yarn gulp hygiene
+  displayName: Run Hygiene Checks
+- script: |
+    yarn monaco-compile-check
+  displayName: Run Monaco Editor Checks
+- script: |
+    yarn strict-null-check
+  displayName: Run Strict Null Checks
+- script: |
+    yarn compile
+  displayName: Compile Sources
+- script: |
+    yarn download-builtin-extensions
+  displayName: Download Built-in Extensions
+- script: |
+    ./scripts/test.sh --tfs "Unit Tests"
+  displayName: Run Unit Tests
+- script: |
+    ./scripts/test-integration.sh --tfs "Integration Tests"
+  displayName: Run Integration Tests
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()

build/azure-pipelines/darwin/product-build-darwin.yml

@@ -0,0 +1,91 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "8.12.0"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.10.1"
+
+- script: |
+    set -e
+    echo "machine monacotools.visualstudio.com password $(VSO_PAT)" > ~/.netrc
+    yarn
+    yarn gulp -- hygiene
+    yarn monaco-compile-check
+    yarn strict-null-check
+    VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)" yarn gulp -- mixin
+    node build/azure-pipelines/common/installDistro.js
+    node build/lib/builtInExtensions.js
+  displayName: Prepare build
+
+- script: |
+    set -e
+    VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)" \
+    AZURE_STORAGE_ACCESS_KEY="$(AZURE_STORAGE_ACCESS_KEY)" \
+    yarn gulp -- vscode-darwin-min upload-vscode-sourcemaps
+  displayName: Build
+
+- script: |
+    set -e
+    ./scripts/test.sh --build --tfs "Unit Tests"
+    # APP_NAME="`ls $(agent.builddirectory)/VSCode-darwin | head -n 1`"
+    # yarn smoketest -- --build "$(agent.builddirectory)/VSCode-darwin/$APP_NAME"
+  displayName: Run unit tests
+
+- script: |
+    set -e
+    pushd ../VSCode-darwin && zip -r -X -y ../VSCode-darwin.zip * && popd
+  displayName: Archive build
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)'
+    Pattern: 'VSCode-darwin.zip'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-401337-Apple",
+          "operationSetCode": "MacAppDeveloperSign",
+          "parameters": [ ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+  displayName: Codesign
+
+- script: |
+    set -e
+
+    # remove pkg from archive
+    zip -d ../VSCode-darwin.zip "*.pkg"
+
+    # publish the build
+    PACKAGEJSON=`ls ../VSCode-darwin/*.app/Contents/Resources/app/package.json`
+    VERSION=`node -p "require(\"$PACKAGEJSON\").version"`
+    AZURE_DOCUMENTDB_MASTERKEY="$(AZURE_DOCUMENTDB_MASTERKEY)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(AZURE_STORAGE_ACCESS_KEY_2)" \
+    MOONCAKE_STORAGE_ACCESS_KEY="$(MOONCAKE_STORAGE_ACCESS_KEY)" \
+    node build/azure-pipelines/common/publish.js \
+      "$(VSCODE_QUALITY)" \
+      darwin \
+      archive \
+      "VSCode-darwin-$(VSCODE_QUALITY).zip" \
+      $VERSION \
+      true \
+      ../VSCode-darwin.zip
+
+    # publish hockeyapp symbols
+    node build/azure-pipelines/common/symbols.js "$(VSCODE_MIXIN_PASSWORD)" "$(VSCODE_HOCKEYAPP_TOKEN)" "$(VSCODE_ARCH)" "$(VSCODE_HOCKEYAPP_ID_MACOS)"
+
+    # upload configuration
+    AZURE_STORAGE_ACCESS_KEY="$(AZURE_STORAGE_ACCESS_KEY)" \
+    yarn gulp -- upload-vscode-configuration
+  displayName: Publish
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true

build/azure-pipelines/linux/.gitignore

@@ -0,0 +1 @@
+pat

build/azure-pipelines/linux/continuous-build-linux.yml

@@ -0,0 +1,45 @@
+steps:
+- script: |
+    set -e
+    sudo apt-get update
+    sudo apt-get install -y libxkbfile-dev pkg-config libsecret-1-dev libxss1 libgconf-2-4 dbus xvfb libgtk-3-0
+    sudo cp build/azure-pipelines/linux/xvfb.init /etc/init.d/xvfb
+    sudo chmod +x /etc/init.d/xvfb
+    sudo update-rc.d xvfb defaults
+    sudo service xvfb start
+- task: NodeTool@0
+  inputs:
+    versionSpec: "8.12.0"
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.10.1"
+- script: |
+    yarn
+  displayName: Install Dependencies
+- script: |
+    yarn gulp electron-x64
+  displayName: Download Electron
+- script: |
+    yarn gulp hygiene
+  displayName: Run Hygiene Checks
+- script: |
+    yarn monaco-compile-check
+  displayName: Run Monaco Editor Checks
+- script: |
+    yarn strict-null-check
+  displayName: Run Strict Null Checks
+- script: |
+    yarn compile
+  displayName: Compile Sources
+- script: |
+    yarn download-builtin-extensions
+  displayName: Download Built-in Extensions
+- script: |
+    DISPLAY=:10 ./scripts/test.sh --tfs "Unit Tests"
+  displayName: Run Unit Tests
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()

build/azure-pipelines/linux/frozen-check.js

@@ -0,0 +1,40 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const documentdb_1 = require("documentdb");
+function createDefaultConfig(quality) {
+    return {
+        id: quality,
+        frozen: false
+    };
+}
+function getConfig(quality) {
+    const client = new documentdb_1.DocumentClient(process.env['AZURE_DOCUMENTDB_ENDPOINT'], { masterKey: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+    const collection = 'dbs/builds/colls/config';
+    const query = {
+        query: `SELECT TOP 1 * FROM c WHERE c.id = @quality`,
+        parameters: [
+            { name: '@quality', value: quality }
+        ]
+    };
+    return new Promise((c, e) => {
+        client.queryDocuments(collection, query).toArray((err, results) => {
+            if (err && err.code !== 409) {
+                return e(err);
+            }
+            c(!results || results.length === 0 ? createDefaultConfig(quality) : results[0]);
+        });
+    });
+}
+getConfig(process.argv[2])
+    .then(config => {
+    console.log(config.frozen);
+    process.exit(0);
+})
+    .catch(err => {
+    console.error(err);
+    process.exit(1);
+});

build/azure-pipelines/linux/product-build-linux.yml

@@ -0,0 +1,112 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "8.12.0"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.10.1"
+
+- script: |
+    set -e
+    export npm_config_arch="$(VSCODE_ARCH)"
+    if [[ "$(VSCODE_ARCH)" == "ia32" ]]; then
+      export PKG_CONFIG_PATH="/usr/lib/i386-linux-gnu/pkgconfig"
+    fi
+
+    echo "machine monacotools.visualstudio.com password $(VSO_PAT)" > ~/.netrc
+    CHILD_CONCURRENCY=1 yarn
+    npm run gulp -- hygiene
+    npm run monaco-compile-check
+    npm run strict-null-check
+    VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)" npm run gulp -- mixin
+    node build/azure-pipelines/common/installDistro.js
+    node build/lib/builtInExtensions.js
+
+- script: |
+    set -e
+    VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)" npm run gulp -- vscode-linux-$(VSCODE_ARCH)-min
+  name: build
+
+- script: |
+    set -e
+    npm run gulp -- "electron-$(VSCODE_ARCH)"
+
+    # xvfb seems to be crashing often, let's make sure it's always up
+    service xvfb start
+
+    DISPLAY=:10 ./scripts/test.sh --build --tfs "Unit Tests"
+    # yarn smoketest -- --build "$(agent.builddirectory)/VSCode-linux-$(VSCODE_ARCH)"
+  name: test
+
+- script: |
+    set -e
+    REPO="$(pwd)"
+    ROOT="$REPO/.."
+    ARCH="$(VSCODE_ARCH)"
+
+    # Publish tarball
+    PLATFORM_LINUX="linux-$(VSCODE_ARCH)"
+    [[ "$ARCH" == "ia32" ]] && DEB_ARCH="i386" || DEB_ARCH="amd64"
+    [[ "$ARCH" == "ia32" ]] && RPM_ARCH="i386" || RPM_ARCH="x86_64"
+    BUILDNAME="VSCode-$PLATFORM_LINUX"
+    BUILD="$ROOT/$BUILDNAME"
+    BUILD_VERSION="$(date +%s)"
+    [ -z "$VSCODE_QUALITY" ] && TARBALL_FILENAME="code-$BUILD_VERSION.tar.gz" || TARBALL_FILENAME="code-$VSCODE_QUALITY-$BUILD_VERSION.tar.gz"
+    TARBALL_PATH="$ROOT/$TARBALL_FILENAME"
+    PACKAGEJSON="$BUILD/resources/app/package.json"
+    VERSION=$(node -p "require(\"$PACKAGEJSON\").version")
+
+    rm -rf $ROOT/code-*.tar.*
+    (cd $ROOT && tar -czf $TARBALL_PATH $BUILDNAME)
+
+    AZURE_DOCUMENTDB_MASTERKEY="$(AZURE_DOCUMENTDB_MASTERKEY)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(AZURE_STORAGE_ACCESS_KEY_2)" \
+    MOONCAKE_STORAGE_ACCESS_KEY="$(MOONCAKE_STORAGE_ACCESS_KEY)" \
+    node build/azure-pipelines/common/publish.js "$VSCODE_QUALITY" "$PLATFORM_LINUX" archive-unsigned "$TARBALL_FILENAME" "$VERSION" true "$TARBALL_PATH"
+
+    # Publish hockeyapp symbols
+    node build/azure-pipelines/common/symbols.js "$(VSCODE_MIXIN_PASSWORD)" "$(VSCODE_HOCKEYAPP_TOKEN)" "$(VSCODE_ARCH)" "$(VSCODE_HOCKEYAPP_ID_LINUX64)"
+
+    # Publish DEB
+    npm run gulp -- "vscode-linux-$(VSCODE_ARCH)-build-deb"
+    PLATFORM_DEB="linux-deb-$ARCH"
+    [[ "$ARCH" == "ia32" ]] && DEB_ARCH="i386" || DEB_ARCH="amd64"
+    DEB_FILENAME="$(ls $REPO/.build/linux/deb/$DEB_ARCH/deb/)"
+    DEB_PATH="$REPO/.build/linux/deb/$DEB_ARCH/deb/$DEB_FILENAME"
+
+    AZURE_DOCUMENTDB_MASTERKEY="$(AZURE_DOCUMENTDB_MASTERKEY)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(AZURE_STORAGE_ACCESS_KEY_2)" \
+    MOONCAKE_STORAGE_ACCESS_KEY="$(MOONCAKE_STORAGE_ACCESS_KEY)" \
+    node build/azure-pipelines/common/publish.js "$VSCODE_QUALITY" "$PLATFORM_DEB" package "$DEB_FILENAME" "$VERSION" true "$DEB_PATH"
+
+    # Publish RPM
+    npm run gulp -- "vscode-linux-$(VSCODE_ARCH)-build-rpm"
+    PLATFORM_RPM="linux-rpm-$ARCH"
+    [[ "$ARCH" == "ia32" ]] && RPM_ARCH="i386" || RPM_ARCH="x86_64"
+    RPM_FILENAME="$(ls $REPO/.build/linux/rpm/$RPM_ARCH/ | grep .rpm)"
+    RPM_PATH="$REPO/.build/linux/rpm/$RPM_ARCH/$RPM_FILENAME"
+
+    AZURE_DOCUMENTDB_MASTERKEY="$(AZURE_DOCUMENTDB_MASTERKEY)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(AZURE_STORAGE_ACCESS_KEY_2)" \
+    MOONCAKE_STORAGE_ACCESS_KEY="$(MOONCAKE_STORAGE_ACCESS_KEY)" \
+    node build/azure-pipelines/common/publish.js "$VSCODE_QUALITY" "$PLATFORM_RPM" package "$RPM_FILENAME" "$VERSION" true "$RPM_PATH"
+
+    # Publish Snap
+    npm run gulp -- "vscode-linux-$(VSCODE_ARCH)-prepare-snap"
+
+    # Pack snap tarball artifact, in order to preserve file perms
+    mkdir -p $REPO/.build/linux/snap-tarball
+    SNAP_TARBALL_PATH="$REPO/.build/linux/snap-tarball/snap-$(VSCODE_ARCH).tar.gz"
+    rm -rf $SNAP_TARBALL_PATH
+    (cd .build/linux && tar -czf $SNAP_TARBALL_PATH snap)
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true
+
+- task: PublishPipelineArtifact@0
+  displayName: 'Publish Pipeline Artifact'
+  inputs:
+    artifactName: snap-$(VSCODE_ARCH)
+    targetPath: .build/linux/snap-tarball

build/azure-pipelines/linux/snap-build-linux.yml

@@ -0,0 +1,42 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "8.12.0"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.10.1"
+
+- task: DownloadPipelineArtifact@0
+  displayName: 'Download Pipeline Artifact'
+  inputs:
+    artifactName: snap-$(VSCODE_ARCH)
+    targetPath: .build/linux/snap-tarball
+
+- script: |
+    set -e
+
+    REPO="$(pwd)"
+    ARCH="$(VSCODE_ARCH)"
+    SNAP_ROOT="$REPO/.build/linux/snap/$ARCH"
+
+    # Install build dependencies
+    (cd build && yarn)
+
+    # Unpack snap tarball artifact, in order to preserve file perms
+    SNAP_TARBALL_PATH="$REPO/.build/linux/snap-tarball/snap-$ARCH.tar.gz"
+    (cd .build/linux && tar -xzf $SNAP_TARBALL_PATH)
+
+    # Create snap package
+    BUILD_VERSION="$(date +%s)"
+    SNAP_FILENAME="code-$VSCODE_QUALITY-$BUILD_VERSION.snap"
+    PACKAGEJSON="$(ls $SNAP_ROOT/code*/usr/share/code*/resources/app/package.json)"
+    VERSION=$(node -p "require(\"$PACKAGEJSON\").version")
+    SNAP_PATH="$SNAP_ROOT/$SNAP_FILENAME"
+    (cd $SNAP_ROOT/code-* && snapcraft snap --output "$SNAP_PATH")
+
+    # Publish snap package
+    AZURE_DOCUMENTDB_MASTERKEY="$(AZURE_DOCUMENTDB_MASTERKEY)" \
+    AZURE_STORAGE_ACCESS_KEY_2="$(AZURE_STORAGE_ACCESS_KEY_2)" \
+    MOONCAKE_STORAGE_ACCESS_KEY="$(MOONCAKE_STORAGE_ACCESS_KEY)" \
+    node build/azure-pipelines/common/publish.js "$VSCODE_QUALITY" "linux-snap-$ARCH" package "$SNAP_FILENAME" "$VERSION" true "$SNAP_PATH"

build/azure-pipelines/linux/xvfb.init

@@ -0,0 +1,53 @@
+#!/bin/bash
+#
+# /etc/rc.d/init.d/xvfbd
+#
+# chkconfig: 345 95 28
+# description: Starts/Stops X Virtual Framebuffer server
+# processname: Xvfb
+#
+### BEGIN INIT INFO
+# Provides:          xvfb
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start xvfb at boot time
+# Description:       Enable xvfb provided by daemon.
+### END INIT INFO
+
+[ "${NETWORKING}" = "no" ] && exit 0
+
+PROG="/usr/bin/Xvfb"
+PROG_OPTIONS=":10 -ac"
+PROG_OUTPUT="/tmp/Xvfb.out"
+
+case "$1" in
+	start)
+		echo "Starting : X Virtual Frame Buffer "
+		$PROG $PROG_OPTIONS>>$PROG_OUTPUT 2>&1 &
+		disown -ar
+	;;
+	stop)
+		echo "Shutting down : X Virtual Frame Buffer"
+		killproc $PROG
+		RETVAL=$?
+		[ $RETVAL -eq 0 ] && /bin/rm -f /var/lock/subsys/Xvfb
+		/var/run/Xvfb.pid
+		echo
+	;;
+	restart|reload)
+		$0 stop
+		$0 start
+		RETVAL=$?
+	;;
+	status)
+		status Xvfb
+		RETVAL=$?
+	;;
+	*)
+		echo $"Usage: $0 (start|stop|restart|reload|status)"
+		exit 1
+esac
+
+exit $RETVAL

build/azure-pipelines/product-build.yml

@@ -0,0 +1,65 @@
+resources:
+  containers:
+  - container: vscode-x64
+    image: joaomoreno/vscode-linux-build-agent:x64
+  - container: vscode-ia32
+    image: joaomoreno/vscode-linux-build-agent:ia32
+  - container: snapcraft
+    image: snapcore/snapcraft
+
+jobs:
+- job: Windows
+  condition: eq(variables['VSCODE_BUILD_WIN32'], 'true')
+  pool:
+    vmImage: VS2017-Win2016
+  variables:
+    VSCODE_ARCH: x64
+  steps:
+  - template: win32/product-build-win32.yml
+
+- job: Windows32
+  condition: eq(variables['VSCODE_BUILD_WIN32_32BIT'], 'true')
+  pool:
+    vmImage: VS2017-Win2016
+  variables:
+    VSCODE_ARCH: ia32
+  steps:
+  - template: win32/product-build-win32.yml
+
+- job: Linux
+  condition: eq(variables['VSCODE_BUILD_LINUX'], 'true')
+  pool:
+    vmImage: 'Ubuntu-16.04'
+  variables:
+    VSCODE_ARCH: x64
+  container: vscode-x64
+  steps:
+  - template: linux/product-build-linux.yml
+
+- job: LinuxSnap
+  condition: eq(variables['VSCODE_BUILD_LINUX'], 'true')
+  pool:
+    vmImage: 'Ubuntu-16.04'
+  variables:
+    VSCODE_ARCH: x64
+  container: snapcraft
+  dependsOn: Linux
+  steps:
+  - template: linux/snap-build-linux.yml
+
+- job: Linux32
+  condition: eq(variables['VSCODE_BUILD_LINUX_32BIT'], 'true')
+  pool:
+    vmImage: 'Ubuntu-16.04'
+  variables:
+    VSCODE_ARCH: ia32
+  container: vscode-ia32
+  steps:
+  - template: linux/product-build-linux.yml
+
+- job: macOS
+  condition: eq(variables['VSCODE_BUILD_MACOS'], 'true')
+  pool:
+    vmImage: macOS 10.13
+  steps:
+  - template: darwin/product-build-darwin.yml

build/azure-pipelines/win32/ESRPClient/NuGet.config

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+    <packageSources>
+        <add key="ESRP" value="https://microsoft.pkgs.visualstudio.com/_packaging/ESRP/nuget/v3/index.json" />
+    </packageSources>
+</configuration>

build/azure-pipelines/win32/ESRPClient/packages.config

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="EsrpClient" version="1.0.27" />
+</packages>

build/azure-pipelines/win32/continuous-build-win32.yml

@@ -0,0 +1,44 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "8.12.0"
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.10.1"
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '2.x'
+    addToPath: true
+- powershell: |
+    yarn
+  displayName: Install Dependencies
+- powershell: |
+    yarn gulp electron
+  displayName: Download Electron
+- powershell: |
+    yarn gulp hygiene
+  displayName: Run Hygiene Checks
+- powershell: |
+    yarn monaco-compile-check
+  displayName: Run Monaco Editor Checks
+- script: |
+    yarn strict-null-check
+  displayName: Run Strict Null Checks
+- powershell: |
+    yarn compile
+  displayName: Compile Sources
+- powershell: |
+    yarn download-builtin-extensions
+  displayName: Download Built-in Extensions
+- powershell: |
+    .\scripts\test.bat --tfs "Unit Tests"
+  displayName: Run Unit Tests
+- powershell: |
+    .\scripts\test-integration.bat --tfs "Integration Tests"
+  displayName: Run Integration Tests
+- task: PublishTestResults@2
+  displayName: Publish Tests Results
+  inputs:
+    testResultsFiles: '*-results.xml'
+    searchFolder: '$(Build.ArtifactStagingDirectory)/test-results'
+  condition: succeededOrFailed()

build/azure-pipelines/win32/exec.ps1

@@ -0,0 +1,24 @@
+# Taken from psake https://github.com/psake/psake
+
+<#
+.SYNOPSIS
+  This is a helper function that runs a scriptblock and checks the PS variable $lastexitcode
+  to see if an error occcured. If an error is detected then an exception is thrown.
+  This function allows you to run command-line programs without having to
+  explicitly check the $lastexitcode variable.
+
+.EXAMPLE
+  exec { svn info $repository_trunk } "Error executing SVN. Please verify SVN command-line client is installed"
+#>
+function Exec
+{
+	[CmdletBinding()]
+	param(
+		[Parameter(Position=0,Mandatory=1)][scriptblock]$cmd,
+		[Parameter(Position=1,Mandatory=0)][string]$errorMessage = ($msgs.error_bad_command -f $cmd)
+	)
+	& $cmd
+	if ($lastexitcode -ne 0) {
+		throw ("Exec: " + $errorMessage)
+	}
+}

build/azure-pipelines/win32/import-esrp-auth-cert.ps1

@@ -0,0 +1,14 @@
+Param(
+  [string]$AuthCertificateBase64,
+  [string]$AuthCertificateKey
+)
+
+# Import auth certificate
+$AuthCertificateFileName = [System.IO.Path]::GetTempFileName()
+$AuthCertificateBytes = [Convert]::FromBase64String($AuthCertificateBase64)
+[IO.File]::WriteAllBytes($AuthCertificateFileName, $AuthCertificateBytes)
+$AuthCertificate = Import-PfxCertificate -FilePath $AuthCertificateFileName -CertStoreLocation Cert:\LocalMachine\My -Password (ConvertTo-SecureString $AuthCertificateKey -AsPlainText -Force)
+rm $AuthCertificateFileName
+$ESRPAuthCertificateSubjectName = $AuthCertificate.Subject
+
+Write-Output ("##vso[task.setvariable variable=ESRPAuthCertificateSubjectName;]$ESRPAuthCertificateSubjectName")

build/azure-pipelines/win32/product-build-win32.yml

@@ -0,0 +1,152 @@
+steps:
+- task: NodeTool@0
+  inputs:
+    versionSpec: "8.12.0"
+
+- task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
+  inputs:
+    versionSpec: "1.10.1"
+
+- task: UsePythonVersion@0
+  inputs:
+    versionSpec: '2.x'
+    addToPath: true
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    "machine monacotools.visualstudio.com password $(VSO_PAT)" | Out-File "$env:USERPROFILE\_netrc" -Encoding ASCII
+    $env:npm_config_arch="$(VSCODE_ARCH)"
+    $env:CHILD_CONCURRENCY="1"
+    $env:VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)"
+    exec { yarn }
+    exec { npm run gulp -- hygiene }
+    exec { npm run monaco-compile-check }
+    exec { npm run strict-null-check }
+    exec { npm run gulp -- mixin }
+    exec { node build/azure-pipelines/common/installDistro.js }
+    exec { node build/lib/builtInExtensions.js }
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    $env:VSCODE_MIXIN_PASSWORD="$(VSCODE_MIXIN_PASSWORD)"
+    exec { npm run gulp -- "vscode-win32-$(VSCODE_ARCH)-min" }
+    exec { npm run gulp -- "vscode-win32-$(VSCODE_ARCH)-inno-updater" }
+  name: build
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { npm run gulp -- "electron-$(VSCODE_ARCH)" }
+    exec { .\scripts\test.bat --build --tfs "Unit Tests" }
+    # yarn smoketest -- --build "$(agent.builddirectory)\VSCode-win32-$(VSCODE_ARCH)"
+  name: test
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '$(agent.builddirectory)/VSCode-win32-$(VSCODE_ARCH)'
+    Pattern: '*.dll,*.exe,*.node'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolSign",
+          "parameters": [
+            {
+              "parameterName": "OpusName",
+              "parameterValue": "VS Code"
+            },
+            {
+              "parameterName": "OpusInfo",
+              "parameterValue": "https://code.visualstudio.com/"
+            },
+            {
+              "parameterName": "Append",
+              "parameterValue": "/as"
+            },
+            {
+              "parameterName": "FileDigest",
+              "parameterValue": "/fd \"SHA256\""
+            },
+            {
+              "parameterName": "PageHash",
+              "parameterValue": "/NPH"
+            },
+            {
+              "parameterName": "TimeStamp",
+              "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        },
+        {
+          "keyCode": "CP-230012",
+          "operationSetCode": "SigntoolVerify",
+          "parameters": [
+            {
+              "parameterName": "VerifyAll",
+              "parameterValue": "/all"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+
+- task: NuGetCommand@2
+  displayName: Install ESRPClient.exe
+  inputs:
+    restoreSolution: 'build\azure-pipelines\win32\ESRPClient\packages.config'
+    feedsToUse: config
+    nugetConfigPath: 'build\azure-pipelines\win32\ESRPClient\NuGet.config'
+    externalFeedCredentials: 3fc0b7f7-da09-4ae7-a9c8-d69824b1819b
+    restoreDirectory: packages
+
+- task: ESRPImportCertTask@1
+  displayName: Import ESRP Request Signing Certificate
+  inputs:
+    ESRP: 'ESRP CodeSign'
+
+- powershell: |
+    $ErrorActionPreference = "Stop"
+    .\build\azure-pipelines\win32\import-esrp-auth-cert.ps1 -AuthCertificateBase64 $(ESRP_AUTH_CERTIFICATE) -AuthCertificateKey $(ESRP_AUTH_CERTIFICATE_KEY)
+  displayName: Import ESRP Auth Certificate
+
+- powershell: |
+    . build/azure-pipelines/win32/exec.ps1
+    $ErrorActionPreference = "Stop"
+    exec { npm run gulp -- "vscode-win32-$(VSCODE_ARCH)-archive" "vscode-win32-$(VSCODE_ARCH)-system-setup" "vscode-win32-$(VSCODE_ARCH)-user-setup" --sign }
+
+    $Repo = "$(pwd)"
+    $Root = "$Repo\.."
+    $SystemExe = "$Repo\.build\win32-$(VSCODE_ARCH)\system-setup\VSCodeSetup.exe"
+    $UserExe = "$Repo\.build\win32-$(VSCODE_ARCH)\user-setup\VSCodeSetup.exe"
+    $Zip = "$Repo\.build\win32-$(VSCODE_ARCH)\archive\VSCode-win32-$(VSCODE_ARCH).zip"
+    $Build = "$Root\VSCode-win32-$(VSCODE_ARCH)"
+
+    # get version
+    $PackageJson = Get-Content -Raw -Path "$Build\resources\app\package.json" | ConvertFrom-Json
+    $Version = $PackageJson.version
+    $Quality = "$env:VSCODE_QUALITY"
+    $env:AZURE_STORAGE_ACCESS_KEY_2 = "$(AZURE_STORAGE_ACCESS_KEY_2)"
+    $env:MOONCAKE_STORAGE_ACCESS_KEY = "$(MOONCAKE_STORAGE_ACCESS_KEY)"
+    $env:AZURE_DOCUMENTDB_MASTERKEY = "$(AZURE_DOCUMENTDB_MASTERKEY)"
+
+    $assetPlatform = if ("$(VSCODE_ARCH)" -eq "ia32") { "win32" } else { "win32-x64" }
+
+    exec { node build/azure-pipelines/common/publish.js $Quality "$global:assetPlatform-archive" archive "VSCode-win32-$(VSCODE_ARCH)-$Version.zip" $Version true $Zip }
+    exec { node build/azure-pipelines/common/publish.js $Quality "$global:assetPlatform" setup "VSCodeSetup-$(VSCODE_ARCH)-$Version.exe" $Version true $SystemExe }
+    exec { node build/azure-pipelines/common/publish.js $Quality "$global:assetPlatform-user" setup "VSCodeUserSetup-$(VSCODE_ARCH)-$Version.exe" $Version true $UserExe }
+
+    # publish hockeyapp symbols
+    $hockeyAppId = if ("$(VSCODE_ARCH)" -eq "ia32") { "$(VSCODE_HOCKEYAPP_ID_WIN32)" } else { "$(VSCODE_HOCKEYAPP_ID_WIN64)" }
+    exec { node build/azure-pipelines/common/symbols.js "$(VSCODE_MIXIN_PASSWORD)" "$(VSCODE_HOCKEYAPP_TOKEN)" "$(VSCODE_ARCH)" $hockeyAppId }
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  continueOnError: true

build/azure-pipelines/win32/sign.ps1

@@ -0,0 +1,70 @@
+function Create-TmpJson($Obj) {
+	$FileName = [System.IO.Path]::GetTempFileName()
+	ConvertTo-Json -Depth 100 $Obj | Out-File -Encoding UTF8 $FileName
+	return $FileName
+}
+
+$Auth = Create-TmpJson @{
+	Version = "1.0.0"
+	AuthenticationType = "AAD_CERT"
+	ClientId = $env:ESRPClientId
+	AuthCert = @{
+		SubjectName = $env:ESRPAuthCertificateSubjectName
+		StoreLocation = "LocalMachine"
+		StoreName = "My"
+	}
+	RequestSigningCert = @{
+		SubjectName = $env:ESRPCertificateSubjectName
+		StoreLocation = "LocalMachine"
+		StoreName = "My"
+	}
+}
+
+$Policy = Create-TmpJson @{
+	Version = "1.0.0"
+}
+
+$Input = Create-TmpJson @{
+	Version = "1.0.0"
+	SignBatches = @(
+		@{
+			SourceLocationType = "UNC"
+			SignRequestFiles = @(
+				@{
+					SourceLocation = $args[0]
+				}
+			)
+			SigningInfo = @{
+				Operations = @(
+					@{
+						KeyCode = "CP-230012"
+						OperationCode = "SigntoolSign"
+						Parameters = @{
+							OpusName = "VS Code"
+							OpusInfo = "https://code.visualstudio.com/"
+							Append = "/as"
+							FileDigest = "/fd `"SHA256`""
+							PageHash = "/NPH"
+							TimeStamp = "/tr `"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer`" /td sha256"
+						}
+						ToolName = "sign"
+						ToolVersion = "1.0"
+					},
+					@{
+						KeyCode = "CP-230012"
+						OperationCode = "SigntoolVerify"
+						Parameters = @{
+							VerifyAll = "/all"
+						}
+						ToolName = "sign"
+						ToolVersion = "1.0"
+					}
+				)
+			}
+		}
+	)
+}
+
+$Output = [System.IO.Path]::GetTempFileName()
+$ScriptPath = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent
+& "$ScriptPath\ESRPClient\packages\EsrpClient.1.0.27\tools\ESRPClient.exe" Sign -a $Auth -p $Policy -i $Input -o $Output