Port fix for vscode issue 160827 to release/1.40 (#21466)

* port fix for vscode issue 160827 (#21457)

* Update build version

Co-authored-by: Hai Cao <hacao@microsoft.com>

.devcontainer/README.md

@@ -1,14 +1,18 @@
 # Code - OSS Development Container
 
+[![Open in Remote - Containers](https://img.shields.io/static/v1?label=Remote%20-%20Containers&message=Open&color=blue&logo=visualstudiocode)](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/microsoft/vscode)
+
 This repository includes configuration for a development container for working with Code - OSS in a local container or using [GitHub Codespaces](https://github.com/features/codespaces).
 
 > **Tip:** The default VNC password is `vscode`. The VNC server runs on port `5901` and a web client is available on port `6080`.
 
 ## Quick start - local
 
+If you already have VS Code and Docker installed, you can click the badge above or [here](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/microsoft/vscode) to get started. Clicking these links will cause VS Code to automatically install the Remote - Containers extension if needed, clone the source code into a container volume, and spin up a dev container for use.
+
 1. Install Docker Desktop or Docker for Linux on your local machine. (See [docs](https://aka.ms/vscode-remote/containers/getting-started) for additional details.)
 
-2. **Important**: Docker needs at least **4 Cores and 6 GB of RAM (8 GB recommended)** to run a full build. If you are on macOS, or are using the old Hyper-V engine for Windows, update these values for Docker Desktop by right-clicking on the Docker status bar item and going to **Preferences/Settings > Resources > Advanced**.
+2. **Important**: Docker needs at least **4 Cores and 8 GB of RAM** to run a full build. If you are on macOS, or are using the old Hyper-V engine for Windows, update these values for Docker Desktop by right-clicking on the Docker status bar item and going to **Preferences/Settings > Resources > Advanced**.
 
     > **Note:** The [Resource Monitor](https://marketplace.visualstudio.com/items?itemName=mutantdino.resourcemonitor) extension is included in the container so you can keep an eye on CPU/Memory in the status bar.
 
@@ -58,12 +62,12 @@ You may see improved VNC responsiveness when accessing a codespace from VS Code
 
 2. After the VS Code is up and running, press <kbd>Ctrl/Cmd</kbd> + <kbd>Shift</kbd> + <kbd>P</kbd> or <kbd>F1</kbd>, choose **Codespaces: Create New Codespace**, and use the following settings:
     - `microsoft/vscode` for the repository.
-	- Select any branch (e.g. **main**) - you select a different one later.
+	- Select any branch (e.g. **main**) - you can select a different one later.
 	- Choose **Standard** (4-core, 8GB) as the size.
 
 4. After you have connected to the codespace, you can use a [VNC Viewer](https://www.realvnc.com/en/connect/download/viewer/) to connect to `localhost:5901` and enter `vscode` as the password.
 
-    > **Tip:** You may also need change your VNC client's **Picture Quaility** setting to **High** to get a full color desktop.
+    > **Tip:** You may also need change your VNC client's **Picture Quality** setting to **High** to get a full color desktop.
 
 5. Anything you start in VS Code, or the integrated terminal, will appear here.
 

.devcontainer/cache/.gitignore

@@ -1 +0,0 @@
-*.manifest

.devcontainer/cache/before-cache.sh

@@ -4,12 +4,12 @@
 # are run. Its just a find command that filters out a few things we don't need to watch.
 
 set -e
-
-SCRIPT_PATH="$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)"
 SOURCE_FOLDER="${1:-"."}"
+CACHE_FOLDER="${2:-"$HOME/.devcontainer-cache"}"
 
 cd "${SOURCE_FOLDER}"
 echo "[$(date)] Generating ""before"" manifest..."
-find -L . -not -path "*/.git/*" -and -not -path "${SCRIPT_PATH}/*.manifest" -type f >  "${SCRIPT_PATH}/before.manifest"
+mkdir -p "${CACHE_FOLDER}"
+find -L . -not -path "*/.git/*" -and -not -path "${CACHE_FOLDER}/*.manifest" -type f >  "${CACHE_FOLDER}/before.manifest"
 echo "[$(date)] Done!"
 

.devcontainer/cache/build-cache-image.sh

@@ -19,10 +19,10 @@ TAG="branch-${BRANCH//\//-}"
 echo "[$(date)] ${BRANCH} => ${TAG}"
 cd "${SCRIPT_PATH}/../.."
 
-echo "[$(date)] Starting image build..."
-docker build -t ${CONTAINER_IMAGE_REPOSITORY}:"${TAG}" -f "${SCRIPT_PATH}/cache.Dockerfile" .
-echo "[$(date)] Image build complete."
+echo "[$(date)] Starting image build and push..."
+export DOCKER_BUILDKIT=1
+docker buildx create --use --name vscode-dev-containers
+docker run --privileged --rm tonistiigi/binfmt --install all
+docker buildx build --push --platform linux/amd64,linux/arm64 -t ${CONTAINER_IMAGE_REPOSITORY}:"${TAG}" -f "${SCRIPT_PATH}/cache.Dockerfile" .
 
-echo "[$(date)] Pushing image..."
-docker push ${CONTAINER_IMAGE_REPOSITORY}:"${TAG}"
 echo "[$(date)] Done!"

.devcontainer/cache/cache-diff.sh

@@ -5,16 +5,19 @@
 
 set -e
 
-SCRIPT_PATH="$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)"
 SOURCE_FOLDER="${1:-"."}"
-CACHE_FOLDER="${2:-"/usr/local/etc/devcontainer-cache"}"
+CACHE_FOLDER="${2:-"$HOME/.devcontainer-cache"}"
+
+if [ ! -d "${CACHE_FOLDER}" ]; then
+	echo "No cache folder found. Be sure to run before-cache.sh to set one up."
+	exit 1
+fi
 
 echo "[$(date)] Starting cache operation..."
 cd "${SOURCE_FOLDER}"
 echo "[$(date)] Determining diffs..."
-find -L . -not -path "*/.git/*" -and -not -path "${SCRIPT_PATH}/*.manifest" -type f > "${SCRIPT_PATH}/after.manifest"
-grep -Fxvf  "${SCRIPT_PATH}/before.manifest" "${SCRIPT_PATH}/after.manifest" > "${SCRIPT_PATH}/cache.manifest"
+find -L . -not -path "*/.git/*" -and -not -path "${CACHE_FOLDER}/*.manifest" -type f > "${CACHE_FOLDER}/after.manifest"
+grep -Fxvf  "${CACHE_FOLDER}/before.manifest" "${CACHE_FOLDER}/after.manifest" > "${CACHE_FOLDER}/cache.manifest"
 echo "[$(date)] Archiving diffs..."
-mkdir -p "${CACHE_FOLDER}"
-tar -cf "${CACHE_FOLDER}/cache.tar" --totals --files-from "${SCRIPT_PATH}/cache.manifest"
+tar -cf "${CACHE_FOLDER}/cache.tar" --totals --files-from "${CACHE_FOLDER}/cache.manifest"
 echo "[$(date)] Done! $(du -h "${CACHE_FOLDER}/cache.tar")"

.devcontainer/cache/cache.Dockerfile

@@ -4,19 +4,21 @@
 # This first stage generates cache.tar
 FROM mcr.microsoft.com/vscode/devcontainers/repos/microsoft/vscode:dev as cache
 ARG USERNAME=node
+ARG CACHE_FOLDER="/home/${USERNAME}/.devcontainer-cache"
 COPY --chown=${USERNAME}:${USERNAME} . /repo-source-tmp/
-RUN mkdir /usr/local/etc/devcontainer-cache \
-	&& chown ${USERNAME} /usr/local/etc/devcontainer-cache /repo-source-tmp \
+RUN mkdir -p ${CACHE_FOLDER} && chown ${USERNAME} ${CACHE_FOLDER} /repo-source-tmp \
 	&& su ${USERNAME} -c "\
 		cd /repo-source-tmp \
-		&& .devcontainer/cache/before-cache.sh \
-		&& .devcontainer/prepare.sh \
-		&& .devcontainer/cache/cache-diff.sh"
+		&& .devcontainer/cache/before-cache.sh . ${CACHE_FOLDER} \
+		&& .devcontainer/prepare.sh . ${CACHE_FOLDER} \
+		&& .devcontainer/cache/cache-diff.sh . ${CACHE_FOLDER}"
 
 # This second stage starts fresh and just copies in cache.tar from the previous stage. The related
 # devcontainer.json file is then setup to have postCreateCommand fire restore-diff.sh to expand it.
 FROM mcr.microsoft.com/vscode/devcontainers/repos/microsoft/vscode:dev as dev-container
 ARG USERNAME=node
-ARG CACHE_FOLDER="/usr/local/etc/devcontainer-cache"
-RUN mkdir -p "${CACHE_FOLDER}" && chown "${USERNAME}:${USERNAME}" "${CACHE_FOLDER}"
+ARG CACHE_FOLDER="/home/${USERNAME}/.devcontainer-cache"
+RUN mkdir -p "${CACHE_FOLDER}" \
+	&& chown "${USERNAME}:${USERNAME}" "${CACHE_FOLDER}" \
+	&& su ${USERNAME} -c "git config --global codespaces-theme.hide-status 1"
 COPY --from=cache ${CACHE_FOLDER}/cache.tar ${CACHE_FOLDER}/

.devcontainer/cache/restore-diff.sh

@@ -5,9 +5,8 @@
 # is already up where you would typically run a command like "yarn install".
 
 set -e
-
 SOURCE_FOLDER="$(cd "${1:-"."}" && pwd)"
-CACHE_FOLDER="${2:-"/usr/local/etc/devcontainer-cache"}"
+CACHE_FOLDER="${2:-"$HOME/.devcontainer-cache"}"
 
 if [ ! -d "${CACHE_FOLDER}" ]; then
 	echo "No cache folder found."
@@ -16,7 +15,15 @@ fi
 
 echo "[$(date)] Expanding $(du -h "${CACHE_FOLDER}/cache.tar") file to ${SOURCE_FOLDER}..."
 cd "${SOURCE_FOLDER}"
-tar -xf "${CACHE_FOLDER}/cache.tar"
-rm -f "${CACHE_FOLDER}/cache.tar"
+# Ensure user/group is correct if the UID/GID was changed for some reason
+echo "+1000 +$(id -u)" > "${CACHE_FOLDER}/cache-owner-map"
+echo "+1000 +$(id -g)" > "${CACHE_FOLDER}/cache-group-map"
+# Untar to workspace folder, preserving permissions and order, but mapping GID/UID if required
+tar --owner-map="${CACHE_FOLDER}/cache-owner-map" --group-map="${CACHE_FOLDER}/cache-group-map" -xpsf "${CACHE_FOLDER}/cache.tar"
+rm -rf "${CACHE_FOLDER}"
 echo "[$(date)] Done!"
 
+# Change ownership of chrome-sandbox
+sudo chown root .build/electron/chrome-sandbox
+sudo chmod 4755 .build/electron/chrome-sandbox
+

.devcontainer/devcontainer.json

@@ -4,7 +4,7 @@
 	// Image contents: https://github.com/microsoft/vscode-dev-containers/blob/master/repository-containers/images/github.com/microsoft/vscode/.devcontainer/base.Dockerfile
 	"image": "mcr.microsoft.com/vscode/devcontainers/repos/microsoft/vscode:branch-main",
 	"overrideCommand": false,
-	"runArgs": [ "--init", "--security-opt", "seccomp=unconfined"],
+	"runArgs": [ "--init", "--security-opt", "seccomp=unconfined", "--shm-size=1g"],
 
 	"settings": {
 		"resmon.show.battery": false,
@@ -30,11 +30,11 @@
 	],
 
 	// Optionally loads a cached yarn install for the repo
-	"postCreateCommand": ".devcontainer/cache/restore-diff.sh && sudo chown node:node /workspaces",
+	"postCreateCommand": ".devcontainer/cache/restore-diff.sh",
 
 	"remoteUser": "node",
 
 	"hostRequirements": {
-		"memory": "6gb"
+		"memory": "8gb"
 	}
 }

.eslintignore

@@ -1,3 +1,17 @@
+**/build/*/**/*.js
+**/dist/**/*.js
+**/extensions/**/*.d.ts
+**/extensions/**/build/**
+**/extensions/**/colorize-fixtures/**
+**/extensions/css-language-features/server/test/pathCompletionFixtures/**
+**/extensions/html-language-features/server/lib/jquery.d.ts
+**/extensions/html-language-features/server/src/test/pathCompletionFixtures/**
+**/extensions/markdown-language-features/media/**
+**/extensions/markdown-language-features/notebook-out/**
+**/extensions/markdown-math/notebook-out/**
+**/extensions/notebook-renderers/renderer-out/index.js
+**/extensions/simple-browser/media/index.js
+**/extensions/typescript-language-features/test-workspace/**
 **/vs/nls.build.js
 **/vs/nls.js
 **/vs/css.build.js
@@ -8,18 +22,38 @@
 **/semver/**
 **/test/**/*.js
 **/node_modules/**
-/extensions/**/out/**
-/extensions/**/build/**
+**/extensions/**/out/**
+**/extensions/**/build/**
 /extensions/big-data-cluster/src/bigDataCluster/controller/apiGenerated.ts
 /extensions/big-data-cluster/src/bigDataCluster/controller/clusterApiGenerated2.ts
+**/extensions/**/colorize-fixtures/**
+**/extensions/html-language-features/server/lib/jquery.d.ts
 /extensions/markdown-language-features/media/**
 /extensions/markdown-language-features/notebook-out/**
-/extensions/typescript-basics/test/colorize-fixtures/**
-/extensions/**/dist/**
+**/extensions/markdown-math/notebook-out/**
+**/extensions/typescript-basics/test/colorize-fixtures/**
+**/extensions/**/dist/**
 /extensions/types
 /extensions/typescript-language-features/test-workspace/**
 /test/automation/out
-
-# These files are not linted by `yarn eslint`, so we exclude them from being linted in the editor.
-# This ensures that if we add new rules and they pass CI, there are also no errors in the editor.
 /resources/web/code-web.js
+**/extensions/vscode-api-tests/testWorkspace/**
+**/extensions/vscode-api-tests/testWorkspace2/**
+**/fixtures/**
+**/node_modules/**
+**/out-*/**/*.js
+**/out-editor-*/**
+**/out/**/*.js
+**/src/**/dompurify.js
+**/src/**/marked.js
+**/src/**/semver.js
+**/src/typings/**/*.d.ts
+**/src/vs/*/**/*.d.ts
+**/src/vs/base/test/common/filters.perf.data.js
+**/src/vs/css.build.js
+**/src/vs/css.js
+**/src/vs/loader.js
+**/src/vs/nls.build.js
+**/src/vs/nls.js
+**/test/unit/assert.js
+**/typings/**

.eslintrc.json

@@ -11,21 +11,23 @@
 		"header"
 	],
 	"rules": {
+		"no-undef": "off",
+		"no-unused-vars": "off",
 		"constructor-super": "warn",
-		"curly": "warn",
+		"curly": "off",
 		"eqeqeq": "warn",
 		"no-buffer-constructor": "warn",
 		"no-caller": "warn",
 		"no-debugger": "warn",
 		"no-duplicate-case": "warn",
-		"no-duplicate-imports": "warn",
+		"no-duplicate-imports": "off",
 		"no-eval": "warn",
 		"no-async-promise-executor": "off",
 		"no-extra-semi": "warn",
 		"no-new-wrappers": "warn",
 		"no-redeclare": "off",
 		"no-sparse-arrays": "warn",
-		"no-throw-literal": "warn",
+		"no-throw-literal": "off",
 		"no-unsafe-finally": "warn",
 		"no-unused-labels": "warn",
 		"no-restricted-globals": [
@@ -40,10 +42,10 @@
 			"orientation",
 			"context"
 		], // non-complete list of globals that are easy to access unintentionally
-		"no-var": "warn",
+		"no-var": "off",
 		"jsdoc/no-types": "warn",
 		"semi": "off",
-		"@typescript-eslint/semi": "warn",
+		"@typescript-eslint/semi": "off",
 		"@typescript-eslint/naming-convention": [
 			"warn",
 			{
@@ -54,15 +56,15 @@
 			}
 		],
 		"code-no-unused-expressions": [
-			"warn",
+			"off",
 			{
 				"allowTernary": true
 			}
 		],
-		"code-translation-remind": "warn",
+		"code-translation-remind": "off",
 		"code-no-nls-in-standalone-editor": "warn",
 		"code-no-standalone-editor": "warn",
-		"code-no-unexternalized-strings": "warn",
+		"code-no-unexternalized-strings": "off",
 		"code-layering": [
 			"warn",
 			{
@@ -90,7 +92,7 @@
 			}
 		],
 		"code-import-patterns": [
-			"warn",
+			"off",
 			// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 			// !!! Do not relax these rules !!!
 			// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
@@ -217,7 +219,9 @@
 					"azurecore",
 					"**/{vs,sql}/base/common/**",
 					"**/{vs,sql}/base/parts/*/common/**",
-					"**/{vs,sql}/platform/*/common/**"
+					"**/{vs,sql}/platform/*/common/**",
+					"@microsoft/1ds-post-js",
+					"@microsoft/1ds-core-js"
 				]
 			},
 			{
@@ -255,7 +259,9 @@
 					"**/{vs,sql}/base/{common,node}/**",
 					"**/{vs,sql}/base/parts/*/{common,node}/**",
 					"**/{vs,sql}/platform/*/{common,node}/**",
-					"@vscode/*", "@parcel/*", "*" // node modules
+					"@vscode/*", "@parcel/*", "*", // node modules
+					"@microsoft/1ds-post-js",
+					"@microsoft/1ds-core-js"
 				]
 			},
 			{
@@ -304,7 +310,9 @@
 					"**/{vs,sql}/base/test/{common,browser}/**",
 					"**/{vs,sql}/base/parts/*/common/**", // {{SQL CARBON EDIT}}
 					"**/{vs,sql}/platform/*/{common,browser}/**",
-					"**/{vs,sql}/platform/*/test/{common,browser}/**"
+					"**/{vs,sql}/platform/*/test/{common,browser}/**",
+					"@microsoft/1ds-post-js",
+					"@microsoft/1ds-core-js"
 				]
 			},
 			{

.git-blame-ignore

@@ -18,4 +18,8 @@ ae1452eea678f5266ef513f22dacebb90955d6c9
 # mjbvz: organize imports
 494cbbd02d67e87727ec885f98d19551aa33aad1
 a3cb14be7f2cceadb17adf843675b1a59537dbbd
-ee1655a82ebdfd38bf8792088a6602c69f7bbd94
+ee1655a82ebdfd38bf8792088a6602c69f7bbd94
+
+
+# jrieken: new eslint-rule
+4a130c40ed876644ed8af2943809d08221375408

.github/CODEOWNERS

@@ -5,6 +5,7 @@
 /extensions/admin-tool-ext-win @Charles-Gagnon
 /extensions/arc/ @Charles-Gagnon @swells @candiceye
 /extensions/azcli/ @Charles-Gagnon @swells @candiceye
+/extensions/azurecore/ @cssuh @cheenamalhotra
 /extensions/big-data-cluster/ @Charles-Gagnon
 /extensions/dacpac/ @kisantia
 /extensions/notebook @azure-data-studio-notebook-devs

.github/subscribers.json

@@ -1,11 +1,2 @@
 {
-	"notebook": [
-		"claudiaregio",
-		"rchiodo",
-		"greazer",
-		"donjayamanne",
-		"jilljac",
-		"IanMatthewHuff",
-		"dynamicwebpaige"
-	]
 }

.github/workflows/ci.yml

@@ -71,13 +71,14 @@ jobs:
       - name: Compile and Download
         run: yarn npm-run-all --max_old_space_size=4095 -lp compile "electron x64" # {{SQL CARBON EDIT}} Remove unused options playwright-install download-builtin-extensions
 
-      - name: Run Unit Tests (Electron)
+      - name: Run Core Unit Tests # {{SQL CARBON EDIT}} Rename to core for clarity
         run: .\scripts\test.bat
 
       # - name: Run Unit Tests (Browser) {{SQL CARBON EDIT}} disable for now
       #   run: yarn test-browser --browser chromium
 
-      # - name: Run Integration Tests (Electron) {{SQL CARBON EDIT}} disable for now
+      # {{SQL CARBON EDIT}} Rename to core for clarity
+      # - name: Run Core Integration Tests {{SQL CARBON EDIT}} disable for now
       #   run: .\scripts\test-integration.bat
 
   linux:
@@ -137,13 +138,20 @@ jobs:
         env:
           SQL_NO_INLINE_SOURCEMAP: 1
 
-      - name: Run Unit Tests (Electron)
+      - name: Run Core Unit Tests # {{SQL CARBON EDIT}} Rename to core for clarity
         id: electron-unit-tests
         run: DISPLAY=:10 ./scripts/test.sh --runGlob "**/sql/**/*.test.js" --coverage
 
-      - name: Run Extension Unit Tests (Electron)
-        id: electron-extension-unit-tests
+      - name: Run Extension Unit Tests (Continue on Error) # {{SQL CARBON EDIT}} Run extension unit tests (continue on error)
+        id: electron-extension-unit-tests-continue-on-error
         run: DISPLAY=:10 ./scripts/test-extensions-unit.sh
+        continueOnError: true
+        condition: and(succeeded(), eq(variables['EXTENSION_UNIT_TESTS_FAIL_ON_ERROR'], 'false'))
+
+      - name: Run Extension Unit Tests (Fail on Error) # {{SQL CARBON EDIT}} Run extension unit tests (fail on error)
+        id: electron-extension-unit-tests-fail-on-error
+        run: DISPLAY=:10 ./scripts/test-extensions-unit.sh
+        condition: and(succeeded(), ne(variables['EXTENSION_UNIT_TESTS_FAIL_ON_ERROR'], 'false'))
 
       # {{SQL CARBON EDIT}} Add coveralls. We merge first to get around issue where parallel builds weren't being combined correctly
       - name: Combine code coverage files
@@ -158,7 +166,8 @@ jobs:
       #   id: browser-unit-tests
       #   run: DISPLAY=:10 yarn test-browser --browser chromium
 
-      # - name: Run Integration Tests (Electron) {{SQL CARBON EDIT}} Skip for now
+      # {{SQL CARBON EDIT}} Rename to core for clarity
+      # - name: Run Core Integration Tests {{SQL CARBON EDIT}} Skip for now
       #   id: electron-integration-tests
       #   run: DISPLAY=:10 ./scripts/test-integration.sh
 
@@ -215,13 +224,14 @@ jobs:
           security default-keychain -s $RUNNER_TEMP/buildagent.keychain
           security unlock-keychain -p pwd $RUNNER_TEMP/buildagent.keychain
 
-      - name: Run Unit Tests (Electron)
+      - name: Run Core Unit Tests # {{SQL CARBON EDIT}} Rename to core for clarity
         run: DISPLAY=:10 ./scripts/test.sh
 
       # - name: Run Unit Tests (Browser) {{SQL CARBON EDIT}} Skip for now
       #   run: DISPLAY=:10 yarn test-browser --browser chromium
 
-      # - name: Run Integration Tests (Electron) {{SQL CARBON EDIT}} Skip for now
+      # {{SQL CARBON EDIT}} Rename to core for clarity
+      # - name: Run Core Integration Tests {{SQL CARBON EDIT}} Skip for now
       #   run: DISPLAY=:10 ./scripts/test-integration.sh
 
   hygiene:

.vscode/cgmanifest.schema.json

@@ -1,142 +0,0 @@
-{
-	"type": "object",
-	"properties": {
-		"registrations": {
-			"type": "array",
-			"items": {
-				"type": "object",
-				"properties": {
-					"component": {
-						"oneOf": [
-							{
-								"type": "object",
-								"required": [
-									"type",
-									"git"
-								],
-								"properties": {
-									"type": {
-										"type": "string",
-										"enum": [
-											"git"
-										]
-									},
-									"git": {
-										"type": "object",
-										"required": [
-											"name",
-											"repositoryUrl",
-											"commitHash"
-										],
-										"properties": {
-											"name": {
-												"type": "string"
-											},
-											"repositoryUrl": {
-												"type": "string"
-											},
-											"commitHash": {
-												"type": "string"
-											}
-										}
-									}
-								}
-							},
-							{
-								"type": "object",
-								"required": [
-									"type",
-									"npm"
-								],
-								"properties": {
-									"type": {
-										"type": "string",
-										"enum": [
-											"npm"
-										]
-									},
-									"npm": {
-										"type": "object",
-										"required": [
-											"name",
-											"version"
-										],
-										"properties": {
-											"name": {
-												"type": "string"
-											},
-											"version": {
-												"type": "string"
-											}
-										}
-									}
-								}
-							},
-							{
-								"type": "object",
-								"required": [
-									"type",
-									"other"
-								],
-								"properties": {
-									"type": {
-										"type": "string",
-										"enum": [
-											"other"
-										]
-									},
-									"other": {
-										"type": "object",
-										"required": [
-											"name",
-											"downloadUrl",
-											"version"
-										],
-										"properties": {
-											"name": {
-												"type": "string"
-											},
-											"downloadUrl": {
-												"type": "string"
-											},
-											"version": {
-												"type": "string"
-											}
-										}
-									}
-								}
-							}
-						]
-					},
-					"repositoryUrl": {
-						"type": "string",
-						"description": "The git url of the component"
-					},
-					"version": {
-						"type": "string",
-						"description": "The version of the component"
-					},
-					"license": {
-						"type": "string",
-						"description": "The name of the license"
-					},
-					"developmentDependency": {
-						"type": "boolean",
-						"description": "This component is inlined in the vscode repo and **is not shipped**."
-					},
-					"isOnlyProductionDependency": {
-						"type": "boolean",
-						"description": "This component is shipped and **is not inlined in the vscode repo**."
-					},
-					"licenseDetail": {
-						"type": "array",
-						"items": {
-							"type": "string"
-						},
-						"description": "The license text"
-					}
-				}
-			}
-		}
-	}
-}

.vscode/launch.json

@@ -1,6 +1,16 @@
 {
 	"version": "0.1.0",
 	"configurations": [
+		{
+			"type": "node",
+			"request": "launch",
+			"name": "Gulp Build",
+			"program": "${workspaceFolder}/node_modules/gulp/bin/gulp.js",
+			"stopOnEntry": true,
+			"args": [
+				"hygiene"
+			]
+		},	
 		{
 			"type": "node",
 			"request": "launch",

.vscode/notebooks/api.github-issues

@@ -7,7 +7,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$repo=repo:microsoft/vscode\n$milestone=milestone:\"October 2021\""
+    "value": "$repo=repo:microsoft/vscode\n$milestone=milestone:\"May 2022\""
   },
   {
     "kind": 1,

.vscode/notebooks/endgame.github-issues

@@ -7,7 +7,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$REPOS=repo:microsoft/vscode repo:microsoft/vscode-internalbacklog repo:microsoft/vscode-dev repo:microsoft/vscode-js-debug repo:microsoft/vscode-remote-release repo:microsoft/vscode-pull-request-github repo:microsoft/vscode-settings-sync-server repo:microsoft/vscode-emmet-helper repo:microsoft/vscode-remotehub repo:microsoft/vscode-remote-repositories-github repo:microsoft/vscode-livepreview repo:microsoft/vscode-python repo:microsoft/vscode-jupyter repo:microsoft/vscode-jupyter-internal repo:microsoft/vscode-unpkg\n\n$MILESTONE=milestone:\"October 2021\""
+    "value": "$REPOS=repo:microsoft/vscode repo:microsoft/vscode-internalbacklog repo:microsoft/vscode-dev repo:microsoft/vscode-js-debug repo:microsoft/vscode-remote-release repo:microsoft/vscode-pull-request-github repo:microsoft/vscode-settings-sync-server repo:microsoft/vscode-emmet-helper repo:microsoft/vscode-remotehub repo:microsoft/vscode-remote-repositories-github repo:microsoft/vscode-livepreview repo:microsoft/vscode-python repo:microsoft/vscode-jupyter repo:microsoft/vscode-jupyter-internal repo:microsoft/vscode-unpkg\n\n$MILESTONE=milestone:\"April 2022\""
   },
   {
     "kind": 1,
@@ -64,6 +64,16 @@
     "language": "github-issues",
     "value": "$REPOS $MILESTONE is:issue is:closed label:feature-request -label:verification-needed -label:on-testplan -label:verified -label:*duplicate"
   },
+  {
+    "kind": 1,
+    "language": "markdown",
+    "value": "## Open Test Plan Items without milestone"
+  },
+  {
+    "kind": 2,
+    "language": "github-issues",
+    "value": "$REPOS $MILESTONE is:issue is:open label:testplan-item no:milestone"
+  },
   {
     "kind": 1,
     "language": "markdown",

.vscode/notebooks/inbox.github-issues

@@ -7,7 +7,12 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$inbox -label:\"needs more info\" sort:created-asc"
+    "value": "$inbox -label:\"needs more info\" sort:created-desc"
+  },
+  {
+    "kind": 2,
+    "language": "github-issues",
+    "value": "repo:microsoft/vscode label:triage-needed is:open"
   },
   {
     "kind": 1,

.vscode/notebooks/my-endgame.github-issues

@@ -7,7 +7,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$REPOS=repo:microsoft/vscode repo:microsoft/vscode-internalbacklog repo:microsoft/vscode-dev repo:microsoft/vscode-js-debug repo:microsoft/vscode-remote-release repo:microsoft/vscode-pull-request-github repo:microsoft/vscode-settings-sync-server repo:microsoft/vscode-remotehub repo:microsoft/vscode-remote-repositories-github repo:microsoft/vscode-emmet-helper repo:microsoft/vscode-livepreview repo:microsoft/vscode-python repo:microsoft/vscode-jupyter repo:microsoft/vscode-jupyter-internal\n\n$MILESTONE=milestone:\"October 2021\"\n\n$MINE=assignee:@me"
+    "value": "$REPOS=repo:microsoft/vscode repo:microsoft/vscode-internalbacklog repo:microsoft/vscode-dev repo:microsoft/vscode-js-debug repo:microsoft/vscode-remote-release repo:microsoft/vscode-pull-request-github repo:microsoft/vscode-settings-sync-server repo:microsoft/vscode-remotehub repo:microsoft/vscode-remote-repositories-github repo:microsoft/vscode-emmet-helper repo:microsoft/vscode-livepreview repo:microsoft/vscode-python repo:microsoft/vscode-jupyter repo:microsoft/vscode-jupyter-internal\n\n$MILESTONE=milestone:\"April 2022\"\n\n$MINE=assignee:@me"
   },
   {
     "kind": 1,
@@ -147,7 +147,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$REPOS $MILESTONE -$MINE is:issue is:closed author:@me sort:updated-asc label:bug -label:verified -label:z-author-verified -label:on-testplan -label:*duplicate -label:duplicate -label:invalid -label:*as-designed -label:error-telemetry -label:verification-steps-needed -label:needs-triage -label:verification-found"
+    "value": "$REPOS $MILESTONE -$MINE is:issue is:closed author:@me sort:updated-asc label:bug -label:unreleased -label:verified -label:z-author-verified -label:on-testplan -label:*duplicate -label:duplicate -label:invalid -label:*as-designed -label:error-telemetry -label:verification-steps-needed -label:needs-triage -label:verification-found"
   },
   {
     "kind": 1,
@@ -157,7 +157,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$REPOS $MILESTONE -$MINE is:issue is:closed sort:updated-asc label:bug -label:verified -label:z-author-verified -label:on-testplan -label:*duplicate -label:duplicate -label:invalid -label:*as-designed -label:error-telemetry -label:verification-steps-needed -label:verification-found -author:aeschli -author:alexdima -author:alexr00 -author:AmandaSilver -author:bamurtaugh -author:bpasero -author:btholt -author:chrisdias -author:chrmarti -author:Chuxel -author:claudiaregio -author:connor4312 -author:dbaeumer -author:deepak1556 -author:devinvalenciano -author:digitarald -author:DonJayamanne -author:dynamicwebpaige -author:eamodio -author:egamma -author:fiveisprime -author:greazer -author:gregvanl -author:hediet -author:IanMatthewHuff -author:isidorn -author:ItalyPaleAle -author:JacksonKearl -author:joaomoreno -author:joyceerhl -author:jrieken -author:karrtikr-author:kieferrm -author:lramos15 -author:lszomoru -author:meganrogge -author:misolori -author:mjbvz -author:ornellaalt -author:orta -author:rchiodo -author:rebornix -author:RMacfarlane -author:roblourens -author:rzhao271 -author:sana-ajani -author:sandy081 -author:sbatten -author:stevencl -author:TylerLeonhardt -author:Tyriar -author:weinand "
+    "value": "$REPOS $MILESTONE -$MINE is:issue is:closed sort:updated-asc label:bug -label:unreleased -label:verified -label:z-author-verified -label:on-testplan -label:*duplicate -label:duplicate -label:invalid -label:*as-designed -label:error-telemetry -label:verification-steps-needed -label:verification-found -author:aeschli -author:alexdima -author:alexr00 -author:AmandaSilver -author:bamurtaugh -author:bpasero -author:chrisdias -author:chrmarti -author:Chuxel -author:claudiaregio -author:connor4312 -author:dbaeumer -author:deepak1556 -author:devinvalenciano -author:digitarald -author:DonJayamanne -author:dynamicwebpaige -author:eamodio -author:egamma -author:fiveisprime -author:greazer -author:gregvanl -author:hediet -author:IanMatthewHuff -author:isidorn -author:ItalyPaleAle -author:JacksonKearl -author:joaomoreno -author:joyceerhl -author:jrieken -author:karrtikr-author:kieferrm -author:lramos15 -author:lszomoru -author:meganrogge -author:misolori -author:mjbvz -author:ornellaalt -author:orta -author:rchiodo -author:rebornix -author:roblourens -author:rzhao271 -author:sana-ajani -author:sandy081 -author:sbatten -author:stevencl -author:tanhakabir -author:TylerLeonhardt -author:Tyriar -author:weinand -author:kimadeline -author:amunger"
   },
   {
     "kind": 1,
@@ -167,7 +167,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$REPOS $MILESTONE -$MINE is:issue is:closed -author:@me sort:updated-asc label:bug -label:verified -label:z-author-verified -label:on-testplan -label:*duplicate -label:duplicate -label:invalid -label:*as-designed -label:error-telemetry -label:verification-steps-needed -label:verification-found"
+    "value": "$REPOS $MILESTONE -$MINE is:issue is:closed -author:@me sort:updated-asc label:bug -label:unreleased -label:verified -label:z-author-verified -label:on-testplan -label:*duplicate -label:duplicate -label:invalid -label:*as-designed -label:error-telemetry -label:verification-steps-needed -label:verification-found"
   },
   {
     "kind": 1,

.vscode/notebooks/verification.github-issues

@@ -12,7 +12,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$repos=repo:microsoft/vscode repo:microsoft/vscode-internalbacklog repo:microsoft/vscode-dev repo:microsoft/vscode-remote-release repo:microsoft/vscode-js-debug repo:microsoft/vscode-pull-request-github repo:microsoft/vscode-github-issue-notebooks repo:microsoft/vscode-emmet-helper repo:microsoft/vscode-jupyter repo:microsoft/vscode-python\n$milestone=milestone:\"August 2021\""
+    "value": "$repos=repo:microsoft/vscode repo:microsoft/vscode-internalbacklog repo:microsoft/vscode-dev repo:microsoft/vscode-remote-release repo:microsoft/vscode-js-debug repo:microsoft/vscode-pull-request-github repo:microsoft/vscode-github-issue-notebooks repo:microsoft/vscode-emmet-helper repo:microsoft/vscode-jupyter repo:microsoft/vscode-python\n$milestone=milestone:\"March 2022\""
   },
   {
     "kind": 1,

.vscode/notebooks/vscode-dev.github-issues

@@ -0,0 +1,42 @@
+[
+  {
+    "kind": 1,
+    "language": "markdown",
+    "value": "# vscode.dev repo"
+  },
+  {
+    "kind": 2,
+    "language": "github-issues",
+    "value": "repo:microsoft/vscode-dev milestone:\"December 2021\" is:open"
+  },
+  {
+    "kind": 2,
+    "language": "github-issues",
+    "value": "repo:microsoft/vscode-dev milestone:\"Backlog\" is:open"
+  },
+  {
+    "kind": 1,
+    "language": "markdown",
+    "value": "# VS Code repo"
+  },
+  {
+    "kind": 2,
+    "language": "github-issues",
+    "value": "repo:microsoft/vscode label:vscode.dev is:open"
+  },
+  {
+    "kind": 1,
+    "language": "markdown",
+    "value": "# GitHub Repositories repos"
+  },
+  {
+    "kind": 2,
+    "language": "github-issues",
+    "value": "repo:microsoft/vscode-remote-repositories-github milestone:\"December 2021\" is:open"
+  },
+  {
+    "kind": 2,
+    "language": "github-issues",
+    "value": "repo:microsoft/vscode-remotehub milestone:\"December 2021\" is:open"
+  }
+]

.vscode/searches/TrustedTypes.code-search

@@ -1,101 +0,0 @@
-# Query: .innerHTML = 
-# Flags: CaseSensitive WordMatch
-# Including: src/vs/**/*.{t,j}s
-# Excluding: *.test.ts, **/test/**
-# ContextLines: 3
-
-12 results - 9 files
-
-src/vs/base/browser/dom.ts:
-  1359  	);
-  1360  
-  1361  	const html = _ttpSafeInnerHtml?.createHTML(value, options) ?? insane(value, options);
-  1362: 	node.innerHTML = html as unknown as string;
-  1363  }
-
-src/vs/base/browser/markdownRenderer.ts:
-  272  	};
-  273  
-  274  	if (_ttpInsane) {
-  275: 		element.innerHTML = _ttpInsane.createHTML(renderedMarkdown, insaneOptions) as unknown as string;
-  276  	} else {
-  277: 		element.innerHTML = insane(renderedMarkdown, insaneOptions);
-  278  	}
-  279  
-  280  	// signal that async code blocks can be now be inserted
-
-src/vs/editor/browser/core/markdownRenderer.ts:
-  88  
-  89  				const element = document.createElement('span');
-  90  
-  91: 				element.innerHTML = MarkdownRenderer._ttpTokenizer
-  92  					? MarkdownRenderer._ttpTokenizer.createHTML(value, tokenization) as unknown as string
-  93  					: tokenizeToString(value, tokenization);
-  94  
-
-src/vs/editor/browser/view/domLineBreaksComputer.ts:
-  107  		allCharOffsets[i] = tmp[0];
-  108  		allVisibleColumns[i] = tmp[1];
-  109  	}
-  110: 	containerDomNode.innerHTML = sb.build();
-  111  
-  112  	containerDomNode.style.position = 'absolute';
-  113  	containerDomNode.style.top = '10000';
-
-src/vs/editor/browser/view/viewLayer.ts:
-  512  		}
-  513  		const lastChild = <HTMLElement>this.domNode.lastChild;
-  514  		if (domNodeIsEmpty || !lastChild) {
-  515: 			this.domNode.innerHTML = newLinesHTML;
-  516  		} else {
-  517  			lastChild.insertAdjacentHTML('afterend', newLinesHTML);
-  518  		}
-
-  533  		if (ViewLayerRenderer._ttPolicy) {
-  534  			invalidLinesHTML = ViewLayerRenderer._ttPolicy.createHTML(invalidLinesHTML) as unknown as string;
-  535  		}
-  536: 		hugeDomNode.innerHTML = invalidLinesHTML;
-  537  
-  538  		for (let i = 0; i < ctx.linesLength; i++) {
-  539  			const line = ctx.lines[i];
-
-src/vs/editor/browser/widget/diffEditorWidget.ts:
-  2157  
-  2158  		let domNode = document.createElement('div');
-  2159  		domNode.className = `view-lines line-delete ${MOUSE_CURSOR_TEXT_CSS_CLASS_NAME}`;
-  2160: 		domNode.innerHTML = sb.build();
-  2161  		Configuration.applyFontInfoSlow(domNode, fontInfo);
-  2162  
-  2163  		let marginDomNode = document.createElement('div');
-  2164  		marginDomNode.className = 'inline-deleted-margin-view-zone';
-  2165: 		marginDomNode.innerHTML = marginHTML.join('');
-  2166  		Configuration.applyFontInfoSlow(marginDomNode, fontInfo);
-  2167  
-  2168  		return {
-
-src/vs/editor/standalone/browser/colorizer.ts:
-  40  		let text = domNode.firstChild ? domNode.firstChild.nodeValue : '';
-  41  		domNode.className += ' ' + theme;
-  42  		let render = (str: string) => {
-  43: 			domNode.innerHTML = str;
-  44  		};
-  45  		return this.colorize(modeService, text || '', mimeType, options).then(render, (err) => console.error(err));
-  46  	}
-
-src/vs/workbench/contrib/notebook/browser/view/renderers/cellRenderer.ts:
-  580  		const element = DOM.$('div', { style });
-  581  
-  582  		const linesHtml = this.getRichTextLinesAsHtml(model, modelRange, colorMap);
-  583: 		element.innerHTML = linesHtml as unknown as string;
-  584  		return element;
-  585  	}
-  586  
-
-src/vs/workbench/contrib/notebook/browser/view/renderers/webviewPreloads.ts:
-  375  					addMouseoverListeners(outputNode, outputId);
-  376  					const content = data.content;
-  377  					if (content.type === RenderOutputType.Html) {
-  378: 						outputNode.innerHTML = content.htmlContent;
-  379  						cellOutputContainer.appendChild(outputNode);
-  380  						domEval(outputNode);
-  381  					} else if (preloadErrs.some(e => !!e)) {

.vscode/settings.json

@@ -26,7 +26,7 @@
 		"test/automation/out/**": true,
 		"test/integration/browser/out/**": true,
 		"src/vs/base/test/node/uri.test.data.txt": true,
-		"src/vs/workbench/test/browser/api/extHostDocumentData.test.perf-data.ts": true
+		"src/vs/workbench/api/test/browser/extHostDocumentData.test.perf-data.ts": true
 	},
 	"lcov.path": [
 		"./.build/coverage/lcov.info",
@@ -57,7 +57,7 @@
 			"fileMatch": [
 				"cgmanifest.json"
 			],
-			"url": "./.vscode/cgmanifest.schema.json"
+			"url": "https://json.schemastore.org/component-detection-manifest.json"
 		},
 		{
 			"fileMatch": [
@@ -73,13 +73,33 @@
 	"gulp.autoDetect": "off",
 	"files.insertFinalNewline": true,
 	"[plaintext]": {
-		"files.insertFinalNewline": false,
+		"files.insertFinalNewline": false
 	},
 	"[typescript]": {
-		"editor.defaultFormatter": "vscode.typescript-language-features"
+		"editor.defaultFormatter": "vscode.typescript-language-features",
+		"editor.formatOnSave": true
+	},
+	"[javascript]": {
+		"editor.defaultFormatter": "vscode.typescript-language-features",
+		"editor.formatOnSave": true
 	},
 	"typescript.tsc.autoDetect": "off",
 	"testing.autoRun.mode": "rerun",
+	"conventionalCommits.scopes": [
+		"tree",
+		"scm",
+		"grid",
+		"splitview",
+		"table",
+		"list",
+		"git",
+		"sash"
+	],
+	"editor.quickSuggestions": {
+		"other": "inline",
+		"comments": "inline",
+		"strings": "inline"
+	},
 	"yaml.schemas": {
 		"https://raw.githubusercontent.com/microsoft/azure-pipelines-vscode/master/service-schema.json": "build/azure-pipelines/**/*.yml"
 	},

.vscode/tasks.json

@@ -8,7 +8,8 @@
 			"isBackground": true,
 			"presentation": {
 				"reveal": "never",
-				"group": "buildWatchers"
+				"group": "buildWatchers",
+				"close": false
 			},
 			"problemMatcher": {
 				"owner": "typescript",
@@ -23,8 +24,8 @@
 					"message": 3
 				},
 				"background": {
-					"beginsPattern": "Starting compilation",
-					"endsPattern": "Finished compilation"
+					"beginsPattern": "Starting compilation...",
+					"endsPattern": "Finished compilation with"
 				}
 			}
 		},
@@ -35,7 +36,8 @@
 			"isBackground": true,
 			"presentation": {
 				"reveal": "never",
-				"group": "buildWatchers"
+				"group": "buildWatchers",
+				"close": false
 			},
 			"problemMatcher": {
 				"owner": "typescript",
@@ -100,6 +102,16 @@
 			"group": "build",
 			"problemMatcher": []
 		},
+		{
+			"label": "Restart VS Code - Build",
+			"dependsOn": [
+				"Kill VS Code - Build",
+				"VS Code - Build"
+			],
+			"group": "build",
+			"dependsOrder": "sequence",
+			"problemMatcher": []
+		},
 		{
 			"type": "npm",
 			"script": "watch-webd",
@@ -171,8 +183,12 @@
 		},
 		{
 			"type": "shell",
-			"command": "yarn web --no-launch",
-			"label": "Run web",
+			"command": "./scripts/code-server.sh",
+			"windows": {
+				"command": ".\\scripts\\code-server.bat"
+			},
+			"args": ["--no-launch", "--connection-token", "dev-token", "--port", "8080"],
+			"label": "Run code server",
 			"isBackground": true,
 			"problemMatcher": {
 				"pattern": {

.yarnrc

@@ -1,4 +1,4 @@
 disturl "https://electronjs.org/headers"
-target "13.6.6"
+target "17.4.11"
 runtime "electron"
 build_from_source "true"

CHANGELOG.md

@@ -1,5 +1,125 @@
 # Change Log
 
+## Version 1.40.1
+* Release date: November 22, 2022
+* Release status: General Availability
+
+### Bug fixes in 1.40.1
+    * Fixed bug that caused folders in the servers tree to display incorrect contents [#21245](https://github.com/microsoft/azuredatastudio/issues/21245)
+
+## Version 1.40.0
+* Release date: November 16, 2022
+* Release status: General Availability
+### What's new in 1.40.0
+| New Item | Details |
+|----------|---------|
+| Connections | Connections for SQL now default to Encrypt = 'True'. |
+| ARM64 Support for macOS | ARM64 build for macOS is now available.  |
+| Table Designer | Announcing the General Availability of the Table Designer. |
+| Table Designer | Period columns now added by default when System-Versioning table option is selected. |
+| Table Designer | Added support for hash indexes for In-Memory tables, and added support for columnstore indexes. |
+| Table Designer | New checkbox added, "Preview Database Updates", when making database changes to ensure that users are aware of potential risks prior to updating the database.|
+| Table Designer | "Move Up" and "Move Down" buttons added to support column reordering for Primary Keys. |
+| Query Plan Viewer | Announcing the General Availability of the Query Plan Viewer in Azure Data Studio. |
+| Query Plan Viewer | Added support for identification of most expensive operator(s) in a plan. |
+| Query Plan Viewer | Updates were made to the properties window to allow for full display of text upon hovering over a cell. Full text can also be copied. |
+| Query Plan Viewer | Implemented filter functionality in the Properties pane for an execution plan. |
+| Query Plan Viewer | Added support for collapsing and expanding all subcategories within the Plan Comparison Properties window. |
+| Query History Extension | Announcing the General Availability of the SQL History Extension. |
+| Query History Extension | Now includes ability to persist history across multiple user sessions. |
+| Query History Extension | Added the ability to limit the number of entries stored in the history. |
+| Schema Compare | Users can now open .scmp files directly from the context menu for existing files in the file explorer. |
+| Query Editor | Now allows full display for text strings larger than 65,535 characters. |
+| Query Editor | Added support for the SHIFT key when making multiple cell selections.  |
+| MySQL Extension | Support for MySQL extension is now available in preview. |
+| Azure SQL Migration Extension | Azure SQL Database Offline Migrations is now available in preview. Customers can use this new capability to save and share reports as needed. |
+| Azure SQL Migration Extension | Addition of elastic Azure recommendations model. |
+| Database Migration Assessment for Oracle | Assessment tooling for Oracle database migrations to Azure Database for PostgreSQL and Azure SQL available in preview. |
+| VS Code merge | VS Code merges to version 1.67. Read [their release notes](https://code.visualstudio.com/updates/v1_67) to learn more. |
+| SQL Database Projects | Adds SQL projects support for syntax introduced in SQL Server 2022.|
+
+### Bug fixes in 1.40.0
+| New Item | Details |
+|----------|---------|
+| Connections | Fixed bug that occurred when trying to connect to the Dedicated Admin Connection (DAC) on SQL Server. |
+| Connections | Fixed issue with wrong tenant showing up while trying to connect to a database with Azure Active Directory login. |
+| Connections | Fixed zoom reset behavior when adding a new connection. |
+| Connections | Fixed loading bug what occurred when attempting to sign in to Azure via proxy. |
+| Connections | Fixed issue encountered while attempting to connect to a "sleeping" Azure SQL Database. |
+| Object Explorer | Fixed the SELECT script generation issue for Synapse Databases. |
+| Schema Compare | Fixed error that caused duplication of comment headers when applying schema changes on stored procedure objects. |
+| Schema Compare | Fixed issue that prevented schema compare issues when creating a new empty schema with a "DOMAIN\User" pattern. |
+| Query Editor | Fixed bug that caused results to be lost upon saving query files. |
+| Table Designer | Fixed a bug that caused creation of a new table when renaming an existing table. |
+| Query Plan Viewer | Fixed missing index recommendation T-SQL syntax. |
+| SQL Projects | Fixed bug in SQL Projects that led to extension not using output path when publishing a project. |
+| SQL Projects | Fixed bug that caused .NET install to not be found when using the SQL Projects extension on Linux platforms. |
+
+## Version 1.39.1
+* Release date: August 30, 2022
+* Release status: General Availability
+## What's new in 1.39.1
+* Bug fixes in 1.39.1
+    * Fixed bug that caused Database Trees in server connections to not expand in the Object Explorer.
+
+## Version 1.39.0
+* Release date: August 24, 2022
+* Release status: General Availability
+## What's new in 1.39.0
+* New Features:
+    * Deployment Wizard - Azure Data Studio now supports SQL Server 2022 (Preview) in the Deployment Wizard for both local and container installation.
+    * Object Explorer - Added Ledger icons and scripting support to Object Explorer for Ledger objects.
+    * Dashboard - Added hexadecimal values to support color detection.
+    * Query Plan Viewer - Added the ability to copy text from cells in the Properties Pane of a query plan.
+    * Query Plan Viewer - Introduced a "find node" option in plan comparison to search for nodes in either the original or added plan.
+    * Table Designer - Now supports the ability to add included columns to a nonclustered index, and the ability to create filtered indexes.
+    * SQL Projects - Publish options were added to the Publish Dialog.
+    * Query History Extension - Added double-click support for query history to either open the query or immediately execute it, based on user configuration.
+
+* Bug Fixes:
+    * Dashboard - Fixed an accessibility issue that prevented users from being able to access tooltip information using the keyboard.
+    * Voiceover - Fixed a bug that caused voiceover errors across the Dashboard, SQL Projects, SQL Import Wizard, and SQL Migration extensions.
+    * Schema Compare - Fixed a bug that caused the UI to jump back to the top of the options list after selecting/deselecting any option.
+    * Schema Compare - Fixed a bug involving Schema Compare (.SCMP) file incompatibility with Database Project information causing errors when reading and using information stored in this file type.
+    * Object Explorer - Fixed a bug that caused menu items in Object Explorer not to show up for non-English languages.
+    * Table Designer - Fixed a bug that caused the History Table name not to be consistent with the current table name when working with System-Versioned Tables.
+    * Table Designer - Fixed a bug in the Primary Key settings that caused the "Allow Nulls" option to be checked, but disabled, preventing users from changing this option.
+    * Query Editor - Fixed a bug that prevented the SQLCMD in T-SQL from working correctly, giving false errors when running scripts in Azure Data Studio.
+    * Query Editor - Fixed a bug that caused user-specified zoom settings to reset to default when selecting JSON values after query that returned JSON dataset was ran.
+    * SQL Projects - Fixed a bug that caused the "Generate Script" command to not work correctly when targeting a new Azure SQL Database.
+    * Notebooks - Fixed a bug that caused pasted images to disappear from editor after going out of edit mode.
+    * Notebooks - Fixed a bug that caused a console error message to appear after opening a markdown file.
+    * Notebooks - Fixed a bug that prevented markdown cell toolbar shortcuts from working after creating a new split view cell.
+    * Notebooks - Fixed a bug that caused text cells to be erroneously created in split view mode when the notebook default text edit mode was set to "Markdown".
+
+## Version 1.38.0
+* Release date: July 27, 2022
+* Release status: General Availability
+## What's new in 1.38.0
+* New Features:
+    * VS Code merges to 1.62 - This release includes updates to VS Code from the three previous VS Code releases. Read [their release notes](https://code.visualstudio.com/updates/v1_62) to learn more.
+    * Table Designer - New column added to Table Designer for easier access to additional actions specific to individual rows.
+    * Query Plan Viewer - The Top Operations pane view now includes clickable links to operations in each of its rows to show the runtime statistics which can be used to evaluate estimated and actual rows when analyzing a plan.
+    * Query Plan Viewer - Improved UI on selected operation node in the Execution Plan.
+    * Query Plan Viewer - The keyboard command **CTRL + M** no longer executes queries. It now just enables or disables the actual execution plan creation when a query is executed.
+    * Query Plan Viewer - Plan labels are now updated in the Properties window when plans are compared and the orientation is toggled from horizontal to vertical, and back.
+    * Query Plan Viewer - Updates were made to the Command Palette. All execution plan commands are prefixed with "Execution Plan", so that they are easier to find and use.
+    * Query Plan Viewer - A collapse/expand functionality is now available at the operator level to allow users to hide or display sections of the plan during analysis.
+    * Query History - The Query History extension was refactored to be fully implemented in an extension. This makes the history view behave like all other extension views and also allows for searching and filtering in the view by selecting the view and typing in your search text.
+
+* Bug Fixes:
+    * Table Designer - Error found in edit data tab when switching back to previously selected column when adding a new row. To fix this, editing the table is now disabled while new rows are being added and only reenabled afterwards.
+    * Query Editor - Fixed coloring issues for new T-SQL functions in the Query Editor.
+    * Query Plan Viewer - Fixed bug that caused custom zoom level spinner to allow values outside valid range.
+    * Dashboard - Fixed issue that caused incorrect displaying of insight widgets on the dashboard.
+    * Notebooks - Fixed issue where keyboard shortcuts and toolbar buttons were not working when first creating a Split View markdown cell.
+    * Notebooks - Fixed issue where cell languages were not being set correctly when opening an ADS .NET Interactive notebook in VS Code.
+    * Notebooks - Fixed issue where notebook was being opened as empty when exporting a SQL query as a notebook.
+    * Notebooks - Disables install and uninstall buttons in Manage Packages dialog while a package is being installed or uninstalled.
+    * Notebooks - Fixed issue where cell toolbar buttons were not refreshing when converting cell type.
+    * Notebooks - Fixed issue where notebook was not opening if a cell contains an unsupported output type.
+    * Schema Compare - Fixed issue where views and stored procedures were not correctly recognized by schema compare after applying changes.
+
 ## Version 1.37.0
 * Release date: June 15, 2022
 * Release status: General Availability
@@ -23,25 +143,6 @@
     *  Notebooks - Fixed inconsistencies with notebook cell behavior and toolbars.
     *  Notebooks - Fixed issues with keyboard navigation.
 
-
-| Platform																|
-| ---------------------------------------	|
-| [Windows User Installer][win-user]			|
-| [Windows System Installer][win-system]	|
-| [Windows ZIP][win-zip]									|
-| [macOS ZIP][osx-zip]										|
-| [Linux TAR.GZ][linux-zip]								|
-| [Linux RPM][linux-rpm]									|
-| [Linux DEB][linux-deb]									|
-
-[win-user]: https://go.microsoft.com/fwlink/?linkid=2198663
-[win-system]: https://go.microsoft.com/fwlink/?linkid=2198878
-[win-zip]: https://go.microsoft.com/fwlink/?linkid=2198664
-[osx-zip]: https://go.microsoft.com/fwlink/?linkid=2198762
-[linux-zip]: https://go.microsoft.com/fwlink/?linkid=2198879
-[linux-rpm]: https://go.microsoft.com/fwlink/?linkid=2198880
-[linux-deb]: https://go.microsoft.com/fwlink/?linkid=2198763
-
 ## Version 1.36.2
 * Release date: May 20, 2022
 * Release status: General Availability

README.md

@@ -1,7 +1,7 @@
 # Azure Data Studio
 
 [![Join the chat at https://gitter.im/Microsoft/sqlopsstudio](https://badges.gitter.im/Microsoft/sqlopsstudio.svg)](https://gitter.im/Microsoft/sqlopsstudio?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![Build Status](https://dev.azure.com/azuredatastudio/azuredatastudio/_apis/build/status/Azure%20Data%20Studio%20CI?branchName=main)](https://dev.azure.com/azuredatastudio/azuredatastudio/_build/latest?definitionId=4&branchName=main)
+[![Build Status](https://dev.azure.com/ms/azuredatastudio/_apis/build/status/AzureDataStudio-Localization-CI?branchName=main)](https://dev.azure.com/ms/azuredatastudio/_build/latest?definitionId=453&branchName=main)
 [![Twitter Follow](https://img.shields.io/twitter/follow/azuredatastudio?style=social)](https://twitter.com/azuredatastudio)
 
 Azure Data Studio is a data management tool that enables you to work with SQL Server, Azure SQL DB and SQL DW from Windows, macOS and Linux.
@@ -25,7 +25,9 @@ Go to our [download page](https://aka.ms/getazuredatastudio) for more specific i
 - [Windows User Installer - **Insiders build**](https://azuredatastudio-update.azurewebsites.net/latest/win32-x64-user/insider)
 - [Windows System Installer - **Insiders build**](https://azuredatastudio-update.azurewebsites.net/latest/win32-x64/insider)
 - [Windows ZIP - **Insiders build**](https://azuredatastudio-update.azurewebsites.net/latest/win32-x64-archive/insider)
-- [macOS ZIP - **Insiders build**](https://azuredatastudio-update.azurewebsites.net/latest/darwin/insider)
+- [macOS ZIP (Universal) - **Insiders build**](https://azuredatastudio-update.azurewebsites.net/latest/darwin-universal/insider)
+- [macOS ZIP (Intel Chip) - **Insiders build**](https://azuredatastudio-update.azurewebsites.net/latest/darwin/insider)
+- [macOS ZIP (Apple Silicon) - **Insiders build**](https://azuredatastudio-update.azurewebsites.net/latest/darwin-arm64/insider)
 - [Linux TAR.GZ - **Insiders build**](https://azuredatastudio-update.azurewebsites.net/latest/linux-x64/insider)
 
 See the [change log](https://github.com/Microsoft/azuredatastudio/blob/main/CHANGELOG.md) for additional details of what's in this release.
@@ -131,10 +133,10 @@ Copyright (c) Microsoft Corporation. All rights reserved.
 
 Licensed under the [Source EULA](LICENSE.txt).
 
-[win-user]: https://go.microsoft.com/fwlink/?linkid=2198663
-[win-system]: https://go.microsoft.com/fwlink/?linkid=2198878
-[win-zip]: https://go.microsoft.com/fwlink/?linkid=2198664
-[osx-zip]: https://go.microsoft.com/fwlink/?linkid=2198762
-[linux-zip]: https://go.microsoft.com/fwlink/?linkid=2198879
-[linux-rpm]: https://go.microsoft.com/fwlink/?linkid=2198880
-[linux-deb]: https://go.microsoft.com/fwlink/?linkid=2198763
+[win-user]: https://go.microsoft.com/fwlink/?linkid=2204567
+[win-system]: https://go.microsoft.com/fwlink/?linkid=2204568
+[win-zip]: https://go.microsoft.com/fwlink/?linkid=2204772
+[osx-zip]: https://go.microsoft.com/fwlink/?linkid=2204569
+[linux-zip]: https://go.microsoft.com/fwlink/?linkid=2204773
+[linux-rpm]: https://go.microsoft.com/fwlink/?linkid=2204774
+[linux-deb]: https://go.microsoft.com/fwlink/?linkid=2204570

build/.cachesalt

@@ -1 +1 @@
-2021-11-19T02:27:18.022Z
+2022-10-06T02:27:18.022Z

build/actions/yarn.lock

@@ -3,9 +3,12 @@
 
 
 "@actions/core@^1.2.6":
-  version "1.2.6"
-  resolved "https://registry.yarnpkg.com/@actions/core/-/core-1.2.6.tgz#a78d49f41a4def18e88ce47c2cac615d5694bf09"
-  integrity sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA==
+  version "1.9.1"
+  resolved "https://registry.yarnpkg.com/@actions/core/-/core-1.9.1.tgz#97c0201b1f9856df4f7c3a375cdcdb0c2a2f750b"
+  integrity sha512-5ad+U2YGrmmiw6du20AQW5XuWo7UKN2052FjSV7MX+Wfjf8sCqcsZe62NfgHys4QI4/Y+vQvLKYL8jWtA1ZBTA==
+  dependencies:
+    "@actions/http-client" "^2.0.1"
+    uuid "^8.3.2"
 
 "@actions/github@^2.1.1":
   version "2.1.1"
@@ -23,6 +26,13 @@
   dependencies:
     tunnel "0.0.6"
 
+"@actions/http-client@^2.0.1":
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/@actions/http-client/-/http-client-2.0.1.tgz#873f4ca98fe32f6839462a6f046332677322f99c"
+  integrity sha512-PIXiMVtz6VvyaRsGY268qvj57hXQEpsYogYOu2nrQhlf+XCGmZstmuZBbAybUl1nQGnvS1k1eEsQ69ZoD7xlSw==
+  dependencies:
+    tunnel "^0.0.6"
+
 "@octokit/auth-token@^2.4.0":
   version "2.4.0"
   resolved "https://registry.yarnpkg.com/@octokit/auth-token/-/auth-token-2.4.0.tgz#b64178975218b99e4dfe948253f0673cbbb59d9f"
@@ -372,7 +382,7 @@ ts-node@^8.6.2:
     source-map-support "^0.5.17"
     yn "3.1.1"
 
-tunnel@0.0.6:
+tunnel@0.0.6, tunnel@^0.0.6:
   version "0.0.6"
   resolved "https://registry.yarnpkg.com/tunnel/-/tunnel-0.0.6.tgz#72f1314b34a5b192db012324df2cc587ca47f92c"
   integrity sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==
@@ -396,6 +406,11 @@ universal-user-agent@^5.0.0:
   dependencies:
     os-name "^3.1.0"
 
+uuid@^8.3.2:
+  version "8.3.2"
+  resolved "https://registry.yarnpkg.com/uuid/-/uuid-8.3.2.tgz#80d5b5ced271bb9af6c445f21a1a04c606cefbe2"
+  integrity sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==
+
 which@^1.2.9:
   version "1.3.1"
   resolved "https://registry.yarnpkg.com/which/-/which-1.3.1.tgz#a45043d54f5805316da8d62f9f50918d3da70b0a"

build/azure-pipelines/.gdntsa

@@ -10,7 +10,7 @@
     ],
     "instanceUrl": "https://msazure.visualstudio.com/defaultcollection",
     "projectName": "One",
-    "areaPath": "One\\VSCode\\Client",
+    "areaPath": "One\\VSCode\\Visual Studio Code Client",
     "iterationPath": "One",
     "notifyAlways": true,
     "tools": [

build/azure-pipelines/common/createAsset.js

@@ -5,11 +5,11 @@
 'use strict';
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = require("fs");
-const url = require("url");
 const crypto = require("crypto");
-const azure = require("azure-storage");
+const storage_blob_1 = require("@azure/storage-blob");
 const mime = require("mime");
 const cosmos_1 = require("@azure/cosmos");
+const identity_1 = require("@azure/identity");
 const retry_1 = require("./retry");
 if (process.argv.length !== 8) {
     console.error('Usage: node createAsset.js PRODUCT OS ARCH TYPE NAME FILE');
@@ -20,7 +20,7 @@ function getPlatform(product, os, arch, type) {
     switch (os) {
         case 'win32':
             switch (product) {
-                case 'client':
+                case 'client': {
                     const asset = arch === 'ia32' ? 'win32' : `win32-${arch}`;
                     switch (type) {
                         case 'archive':
@@ -32,6 +32,7 @@ function getPlatform(product, os, arch, type) {
                         default:
                             throw new Error(`Unrecognized: ${product} ${os} ${arch} ${type}`);
                     }
+                }
                 case 'server':
                     if (arch === 'arm64') {
                         throw new Error(`Unrecognized: ${product} ${os} ${arch} ${type}`);
@@ -84,12 +85,15 @@ function getPlatform(product, os, arch, type) {
                     }
                     return `darwin-${arch}`;
                 case 'server':
-                    return 'server-darwin';
-                case 'web':
-                    if (arch !== 'x64') {
-                        throw new Error(`What should the platform be?: ${product} ${os} ${arch} ${type}`);
+                    if (arch === 'x64') {
+                        return 'server-darwin';
                     }
-                    return 'server-darwin-web';
+                    return `server-darwin-${arch}`;
+                case 'web':
+                    if (arch === 'x64') {
+                        return 'server-darwin-web';
+                    }
+                    return `server-darwin-${arch}-web`;
                 default:
                     throw new Error(`Unrecognized: ${product} ${os} ${arch} ${type}`);
             }
@@ -118,20 +122,6 @@ function hashStream(hashName, stream) {
             .on('close', () => c(shasum.digest('hex')));
     });
 }
-async function doesAssetExist(blobService, quality, blobName) {
-    const existsResult = await new Promise((c, e) => blobService.doesBlobExist(quality, blobName, (err, r) => err ? e(err) : c(r)));
-    return existsResult.exists;
-}
-async function uploadBlob(blobService, quality, blobName, filePath, fileName) {
-    const blobOptions = {
-        contentSettings: {
-            contentType: mime.lookup(filePath),
-            contentDisposition: `attachment; filename="${fileName}"`,
-            cacheControl: 'max-age=31536000, public'
-        }
-    };
-    await new Promise((c, e) => blobService.createBlockBlobFromLocalFile(quality, blobName, filePath, blobOptions, err => err ? e(err) : c()));
-}
 function getEnv(name) {
     const result = process.env[name];
     if (typeof result === 'undefined') {
@@ -140,12 +130,13 @@ function getEnv(name) {
     return result;
 }
 async function main() {
+    var _a;
     const [, , product, os, arch, unprocessedType, fileName, filePath] = process.argv;
     // getPlatform needs the unprocessedType
     const platform = getPlatform(product, os, arch, unprocessedType);
     const type = getRealType(unprocessedType);
     const quality = getEnv('VSCODE_QUALITY');
-    const commit = getEnv('BUILD_SOURCEVERSION');
+    const commit = process.env['VSCODE_DISTRO_COMMIT'] || getEnv('BUILD_SOURCEVERSION');
     console.log('Creating asset...');
     const stat = await new Promise((c, e) => fs.stat(filePath, (err, stat) => err ? e(err) : c(stat)));
     const size = stat.size;
@@ -155,28 +146,48 @@ async function main() {
     console.log('SHA1:', sha1hash);
     console.log('SHA256:', sha256hash);
     const blobName = commit + '/' + fileName;
-    const storageAccount = process.env['AZURE_STORAGE_ACCOUNT_2'];
-    const blobService = azure.createBlobService(storageAccount, process.env['AZURE_STORAGE_ACCESS_KEY_2'])
-        .withFilter(new azure.ExponentialRetryPolicyFilter(20));
-    const blobExists = await doesAssetExist(blobService, quality, blobName);
+    const storagePipelineOptions = { retryOptions: { retryPolicyType: storage_blob_1.StorageRetryPolicyType.EXPONENTIAL, maxTries: 6, tryTimeoutInMs: 10 * 60 * 1000 } };
+    const credential = new identity_1.ClientSecretCredential(process.env['AZURE_TENANT_ID'], process.env['AZURE_CLIENT_ID'], process.env['AZURE_CLIENT_SECRET']);
+    const blobServiceClient = new storage_blob_1.BlobServiceClient(`https://vscode.blob.core.windows.net`, credential, storagePipelineOptions);
+    const containerClient = blobServiceClient.getContainerClient(quality);
+    const blobClient = containerClient.getBlockBlobClient(blobName);
+    const blobExists = await blobClient.exists();
     if (blobExists) {
         console.log(`Blob ${quality}, ${blobName} already exists, not publishing again.`);
         return;
     }
-    const mooncakeBlobService = azure.createBlobService(storageAccount, process.env['MOONCAKE_STORAGE_ACCESS_KEY'], `${storageAccount}.blob.core.chinacloudapi.cn`)
-        .withFilter(new azure.ExponentialRetryPolicyFilter(20));
-    // mooncake is fussy and far away, this is needed!
-    blobService.defaultClientRequestTimeoutInMs = 10 * 60 * 1000;
-    mooncakeBlobService.defaultClientRequestTimeoutInMs = 10 * 60 * 1000;
-    console.log('Uploading blobs to Azure storage and Mooncake Azure storage...');
-    await (0, retry_1.retry)(() => Promise.all([
-        uploadBlob(blobService, quality, blobName, filePath, fileName),
-        uploadBlob(mooncakeBlobService, quality, blobName, filePath, fileName)
-    ]));
-    console.log('Blobs successfully uploaded.');
-    // TODO: Understand if blobName and blobPath are the same and replace blobPath with blobName if so.
+    const blobOptions = {
+        blobHTTPHeaders: {
+            blobContentType: mime.lookup(filePath),
+            blobContentDisposition: `attachment; filename="${fileName}"`,
+            blobCacheControl: 'max-age=31536000, public'
+        }
+    };
+    const uploadPromises = [
+        (0, retry_1.retry)(async () => {
+            await blobClient.uploadFile(filePath, blobOptions);
+            console.log('Blob successfully uploaded to Azure storage.');
+        })
+    ];
+    const shouldUploadToMooncake = /true/i.test((_a = process.env['VSCODE_PUBLISH_TO_MOONCAKE']) !== null && _a !== void 0 ? _a : 'true');
+    if (shouldUploadToMooncake) {
+        const mooncakeCredential = new identity_1.ClientSecretCredential(process.env['AZURE_MOONCAKE_TENANT_ID'], process.env['AZURE_MOONCAKE_CLIENT_ID'], process.env['AZURE_MOONCAKE_CLIENT_SECRET']);
+        const mooncakeBlobServiceClient = new storage_blob_1.BlobServiceClient(`https://vscode.blob.core.chinacloudapi.cn`, mooncakeCredential, storagePipelineOptions);
+        const mooncakeContainerClient = mooncakeBlobServiceClient.getContainerClient(quality);
+        const mooncakeBlobClient = mooncakeContainerClient.getBlockBlobClient(blobName);
+        uploadPromises.push((0, retry_1.retry)(async () => {
+            await mooncakeBlobClient.uploadFile(filePath, blobOptions);
+            console.log('Blob successfully uploaded to Mooncake Azure storage.');
+        }));
+        console.log('Uploading blobs to Azure storage and Mooncake Azure storage...');
+    }
+    else {
+        console.log('Uploading blobs to Azure storage...');
+    }
+    await Promise.all(uploadPromises);
+    console.log('All blobs successfully uploaded.');
     const assetUrl = `${process.env['AZURE_CDN_URL']}/${quality}/${blobName}`;
-    const blobPath = url.parse(assetUrl).path;
+    const blobPath = new URL(assetUrl).pathname;
     const mooncakeUrl = `${process.env['MOONCAKE_CDN_URL']}${blobPath}`;
     const asset = {
         platform,
@@ -192,7 +203,7 @@ async function main() {
         asset.supportsFastUpdate = true;
     }
     console.log('Asset:', JSON.stringify(asset, null, '  '));
-    const client = new cosmos_1.CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT'], key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+    const client = new cosmos_1.CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT'], aadCredentials: credential });
     const scripts = client.database('builds').container(quality).scripts;
     await (0, retry_1.retry)(() => scripts.storedProcedure('createAsset').execute('', [commit, asset, true]));
     console.log(`  Done ✔️`);

build/azure-pipelines/common/createAsset.ts

@@ -6,12 +6,12 @@
 'use strict';
 
 import * as fs from 'fs';
-import * as url from 'url';
 import { Readable } from 'stream';
 import * as crypto from 'crypto';
-import * as azure from 'azure-storage';
+import { BlobServiceClient, BlockBlobParallelUploadOptions, StoragePipelineOptions, StorageRetryPolicyType } from '@azure/storage-blob';
 import * as mime from 'mime';
 import { CosmosClient } from '@azure/cosmos';
+import { ClientSecretCredential } from '@azure/identity';
 import { retry } from './retry';
 
 interface Asset {
@@ -35,7 +35,7 @@ function getPlatform(product: string, os: string, arch: string, type: string): s
 	switch (os) {
 		case 'win32':
 			switch (product) {
-				case 'client':
+				case 'client': {
 					const asset = arch === 'ia32' ? 'win32' : `win32-${arch}`;
 					switch (type) {
 						case 'archive':
@@ -47,6 +47,7 @@ function getPlatform(product: string, os: string, arch: string, type: string): s
 						default:
 							throw new Error(`Unrecognized: ${product} ${os} ${arch} ${type}`);
 					}
+				}
 				case 'server':
 					if (arch === 'arm64') {
 						throw new Error(`Unrecognized: ${product} ${os} ${arch} ${type}`);
@@ -99,12 +100,15 @@ function getPlatform(product: string, os: string, arch: string, type: string): s
 					}
 					return `darwin-${arch}`;
 				case 'server':
-					return 'server-darwin';
-				case 'web':
-					if (arch !== 'x64') {
-						throw new Error(`What should the platform be?: ${product} ${os} ${arch} ${type}`);
+					if (arch === 'x64') {
+						return 'server-darwin';
 					}
-					return 'server-darwin-web';
+					return `server-darwin-${arch}`;
+				case 'web':
+					if (arch === 'x64') {
+						return 'server-darwin-web';
+					}
+					return `server-darwin-${arch}-web`;
 				default:
 					throw new Error(`Unrecognized: ${product} ${os} ${arch} ${type}`);
 			}
@@ -137,23 +141,6 @@ function hashStream(hashName: string, stream: Readable): Promise<string> {
 	});
 }
 
-async function doesAssetExist(blobService: azure.BlobService, quality: string, blobName: string): Promise<boolean | undefined> {
-	const existsResult = await new Promise<azure.BlobService.BlobResult>((c, e) => blobService.doesBlobExist(quality, blobName, (err, r) => err ? e(err) : c(r)));
-	return existsResult.exists;
-}
-
-async function uploadBlob(blobService: azure.BlobService, quality: string, blobName: string, filePath: string, fileName: string): Promise<void> {
-	const blobOptions: azure.BlobService.CreateBlockBlobRequestOptions = {
-		contentSettings: {
-			contentType: mime.lookup(filePath),
-			contentDisposition: `attachment; filename="${fileName}"`,
-			cacheControl: 'max-age=31536000, public'
-		}
-	};
-
-	await new Promise<void>((c, e) => blobService.createBlockBlobFromLocalFile(quality, blobName, filePath, blobOptions, err => err ? e(err) : c()));
-}
-
 function getEnv(name: string): string {
 	const result = process.env[name];
 
@@ -170,7 +157,7 @@ async function main(): Promise<void> {
 	const platform = getPlatform(product, os, arch, unprocessedType);
 	const type = getRealType(unprocessedType);
 	const quality = getEnv('VSCODE_QUALITY');
-	const commit = getEnv('BUILD_SOURCEVERSION');
+	const commit = process.env['VSCODE_DISTRO_COMMIT'] || getEnv('BUILD_SOURCEVERSION');
 
 	console.log('Creating asset...');
 
@@ -186,37 +173,58 @@ async function main(): Promise<void> {
 	console.log('SHA256:', sha256hash);
 
 	const blobName = commit + '/' + fileName;
-	const storageAccount = process.env['AZURE_STORAGE_ACCOUNT_2']!;
 
-	const blobService = azure.createBlobService(storageAccount, process.env['AZURE_STORAGE_ACCESS_KEY_2']!)
-		.withFilter(new azure.ExponentialRetryPolicyFilter(20));
+	const storagePipelineOptions: StoragePipelineOptions = { retryOptions: { retryPolicyType: StorageRetryPolicyType.EXPONENTIAL, maxTries: 6, tryTimeoutInMs: 10 * 60 * 1000 } };
 
-	const blobExists = await doesAssetExist(blobService, quality, blobName);
+	const credential = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+	const blobServiceClient = new BlobServiceClient(`https://vscode.blob.core.windows.net`, credential, storagePipelineOptions);
+	const containerClient = blobServiceClient.getContainerClient(quality);
+	const blobClient = containerClient.getBlockBlobClient(blobName);
+	const blobExists = await blobClient.exists();
 
 	if (blobExists) {
 		console.log(`Blob ${quality}, ${blobName} already exists, not publishing again.`);
 		return;
 	}
 
-	const mooncakeBlobService = azure.createBlobService(storageAccount, process.env['MOONCAKE_STORAGE_ACCESS_KEY']!, `${storageAccount}.blob.core.chinacloudapi.cn`)
-		.withFilter(new azure.ExponentialRetryPolicyFilter(20));
+	const blobOptions: BlockBlobParallelUploadOptions = {
+		blobHTTPHeaders: {
+			blobContentType: mime.lookup(filePath),
+			blobContentDisposition: `attachment; filename="${fileName}"`,
+			blobCacheControl: 'max-age=31536000, public'
+		}
+	};
 
-	// mooncake is fussy and far away, this is needed!
-	blobService.defaultClientRequestTimeoutInMs = 10 * 60 * 1000;
-	mooncakeBlobService.defaultClientRequestTimeoutInMs = 10 * 60 * 1000;
+	const uploadPromises: Promise<void>[] = [
+		retry(async () => {
+			await blobClient.uploadFile(filePath, blobOptions);
+			console.log('Blob successfully uploaded to Azure storage.');
+		})
+	];
 
-	console.log('Uploading blobs to Azure storage and Mooncake Azure storage...');
+	const shouldUploadToMooncake = /true/i.test(process.env['VSCODE_PUBLISH_TO_MOONCAKE'] ?? 'true');
 
-	await retry(() => Promise.all([
-		uploadBlob(blobService, quality, blobName, filePath, fileName),
-		uploadBlob(mooncakeBlobService, quality, blobName, filePath, fileName)
-	]));
+	if (shouldUploadToMooncake) {
+		const mooncakeCredential = new ClientSecretCredential(process.env['AZURE_MOONCAKE_TENANT_ID']!, process.env['AZURE_MOONCAKE_CLIENT_ID']!, process.env['AZURE_MOONCAKE_CLIENT_SECRET']!);
+		const mooncakeBlobServiceClient = new BlobServiceClient(`https://vscode.blob.core.chinacloudapi.cn`, mooncakeCredential, storagePipelineOptions);
+		const mooncakeContainerClient = mooncakeBlobServiceClient.getContainerClient(quality);
+		const mooncakeBlobClient = mooncakeContainerClient.getBlockBlobClient(blobName);
 
-	console.log('Blobs successfully uploaded.');
+		uploadPromises.push(retry(async () => {
+			await mooncakeBlobClient.uploadFile(filePath, blobOptions);
+			console.log('Blob successfully uploaded to Mooncake Azure storage.');
+		}));
+
+		console.log('Uploading blobs to Azure storage and Mooncake Azure storage...');
+	} else {
+		console.log('Uploading blobs to Azure storage...');
+	}
+
+	await Promise.all(uploadPromises);
+	console.log('All blobs successfully uploaded.');
 
-	// TODO: Understand if blobName and blobPath are the same and replace blobPath with blobName if so.
 	const assetUrl = `${process.env['AZURE_CDN_URL']}/${quality}/${blobName}`;
-	const blobPath = url.parse(assetUrl).path;
+	const blobPath = new URL(assetUrl).pathname;
 	const mooncakeUrl = `${process.env['MOONCAKE_CDN_URL']}${blobPath}`;
 
 	const asset: Asset = {
@@ -236,7 +244,7 @@ async function main(): Promise<void> {
 
 	console.log('Asset:', JSON.stringify(asset, null, '  '));
 
-	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, aadCredentials: credential });
 	const scripts = client.database('builds').container(quality).scripts;
 	await retry(() => scripts.storedProcedure('createAsset').execute('', [commit, asset, true]));
 

build/azure-pipelines/common/createBuild.js

@@ -4,6 +4,7 @@
  *--------------------------------------------------------------------------------------------*/
 'use strict';
 Object.defineProperty(exports, "__esModule", { value: true });
+const identity_1 = require("@azure/identity");
 const cosmos_1 = require("@azure/cosmos");
 const retry_1 = require("./retry");
 if (process.argv.length !== 3) {
@@ -18,11 +19,12 @@ function getEnv(name) {
     return result;
 }
 async function main() {
+    var _a, _b, _c;
     const [, , _version] = process.argv;
     const quality = getEnv('VSCODE_QUALITY');
-    const commit = getEnv('BUILD_SOURCEVERSION');
+    const commit = ((_a = process.env['VSCODE_DISTRO_COMMIT']) === null || _a === void 0 ? void 0 : _a.trim()) || getEnv('BUILD_SOURCEVERSION');
     const queuedBy = getEnv('BUILD_QUEUEDBY');
-    const sourceBranch = getEnv('BUILD_SOURCEBRANCH');
+    const sourceBranch = ((_b = process.env['VSCODE_DISTRO_REF']) === null || _b === void 0 ? void 0 : _b.trim()) || getEnv('BUILD_SOURCEBRANCH');
     const version = _version + (quality === 'stable' ? '' : `-${quality}`);
     console.log('Creating build...');
     console.log('Quality:', quality);
@@ -33,12 +35,14 @@ async function main() {
         timestamp: (new Date()).getTime(),
         version,
         isReleased: false,
+        private: Boolean((_c = process.env['VSCODE_DISTRO_REF']) === null || _c === void 0 ? void 0 : _c.trim()),
         sourceBranch,
         queuedBy,
         assets: [],
         updates: {}
     };
-    const client = new cosmos_1.CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT'], key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+    const aadCredentials = new identity_1.ClientSecretCredential(process.env['AZURE_TENANT_ID'], process.env['AZURE_CLIENT_ID'], process.env['AZURE_CLIENT_SECRET']);
+    const client = new cosmos_1.CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT'], aadCredentials });
     const scripts = client.database('builds').container(quality).scripts;
     await (0, retry_1.retry)(() => scripts.storedProcedure('createBuild').execute('', [Object.assign(Object.assign({}, build), { _partitionKey: '' })]));
 }

build/azure-pipelines/common/createBuild.ts

@@ -5,6 +5,7 @@
 
 'use strict';
 
+import { ClientSecretCredential } from '@azure/identity';
 import { CosmosClient } from '@azure/cosmos';
 import { retry } from './retry';
 
@@ -26,9 +27,9 @@ function getEnv(name: string): string {
 async function main(): Promise<void> {
 	const [, , _version] = process.argv;
 	const quality = getEnv('VSCODE_QUALITY');
-	const commit = getEnv('BUILD_SOURCEVERSION');
+	const commit = process.env['VSCODE_DISTRO_COMMIT']?.trim() || getEnv('BUILD_SOURCEVERSION');
 	const queuedBy = getEnv('BUILD_QUEUEDBY');
-	const sourceBranch = getEnv('BUILD_SOURCEBRANCH');
+	const sourceBranch = process.env['VSCODE_DISTRO_REF']?.trim() || getEnv('BUILD_SOURCEBRANCH');
 	const version = _version + (quality === 'stable' ? '' : `-${quality}`);
 
 	console.log('Creating build...');
@@ -41,13 +42,15 @@ async function main(): Promise<void> {
 		timestamp: (new Date()).getTime(),
 		version,
 		isReleased: false,
+		private: Boolean(process.env['VSCODE_DISTRO_REF']?.trim()),
 		sourceBranch,
 		queuedBy,
 		assets: [],
 		updates: {}
 	};
 
-	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const aadCredentials = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, aadCredentials });
 	const scripts = client.database('builds').container(quality).scripts;
 	await retry(() => scripts.storedProcedure('createBuild').execute('', [{ ...build, _partitionKey: '' }]));
 }

build/azure-pipelines/common/installPlaywright.js

@@ -5,7 +5,7 @@
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
 const retry_1 = require("./retry");
-const { installDefaultBrowsersForNpmInstall } = require('playwright/lib/utils/registry');
+const { installDefaultBrowsersForNpmInstall } = require('playwright-core/lib/server');
 async function install() {
     await (0, retry_1.retry)(() => installDefaultBrowsersForNpmInstall());
 }

build/azure-pipelines/common/installPlaywright.ts

@@ -4,7 +4,7 @@
  *--------------------------------------------------------------------------------------------*/
 
 import { retry } from './retry';
-const { installDefaultBrowsersForNpmInstall } = require('playwright/lib/utils/registry');
+const { installDefaultBrowsersForNpmInstall } = require('playwright-core/lib/server');
 
 async function install() {
 	await retry(() => installDefaultBrowsersForNpmInstall());

build/azure-pipelines/common/releaseBuild.js

@@ -4,6 +4,7 @@
  *--------------------------------------------------------------------------------------------*/
 'use strict';
 Object.defineProperty(exports, "__esModule", { value: true });
+const identity_1 = require("@azure/identity");
 const cosmos_1 = require("@azure/cosmos");
 const retry_1 = require("./retry");
 function getEnv(name) {
@@ -28,9 +29,10 @@ async function getConfig(client, quality) {
     return res.resources[0];
 }
 async function main() {
-    const commit = getEnv('BUILD_SOURCEVERSION');
+    const commit = process.env['VSCODE_DISTRO_COMMIT'] || getEnv('BUILD_SOURCEVERSION');
     const quality = getEnv('VSCODE_QUALITY');
-    const client = new cosmos_1.CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT'], key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+    const aadCredentials = new identity_1.ClientSecretCredential(process.env['AZURE_TENANT_ID'], process.env['AZURE_CLIENT_ID'], process.env['AZURE_CLIENT_SECRET']);
+    const client = new cosmos_1.CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT'], aadCredentials });
     const config = await getConfig(client, quality);
     console.log('Quality config:', config);
     if (config.frozen) {

build/azure-pipelines/common/releaseBuild.ts

@@ -5,6 +5,7 @@
 
 'use strict';
 
+import { ClientSecretCredential } from '@azure/identity';
 import { CosmosClient } from '@azure/cosmos';
 import { retry } from './retry';
 
@@ -43,10 +44,11 @@ async function getConfig(client: CosmosClient, quality: string): Promise<Config>
 }
 
 async function main(): Promise<void> {
-	const commit = getEnv('BUILD_SOURCEVERSION');
+	const commit = process.env['VSCODE_DISTRO_COMMIT'] || getEnv('BUILD_SOURCEVERSION');
 	const quality = getEnv('VSCODE_QUALITY');
 
-	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, key: process.env['AZURE_DOCUMENTDB_MASTERKEY'] });
+	const aadCredentials = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, aadCredentials });
 	const config = await getConfig(client, quality);
 
 	console.log('Quality config:', config);

build/azure-pipelines/common/retry.js

@@ -6,20 +6,23 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.retry = void 0;
 async function retry(fn) {
+    let lastError;
     for (let run = 1; run <= 10; run++) {
         try {
             return await fn();
         }
         catch (err) {
-            if (!/ECONNRESET/.test(err.message)) {
+            if (!/ECONNRESET|CredentialUnavailableError|Audience validation failed/i.test(err.message)) {
                 throw err;
             }
+            lastError = err;
             const millis = (Math.random() * 200) + (50 * Math.pow(1.5, run));
-            console.log(`Failed with ECONNRESET, retrying in ${millis}ms...`);
+            console.log(`Request failed, retrying in ${millis}ms...`);
             // maximum delay is 10th retry: ~3 seconds
             await new Promise(c => setTimeout(c, millis));
         }
     }
-    throw new Error('Retried too many times');
+    console.log(`Too many retries, aborting.`);
+    throw lastError;
 }
 exports.retry = retry;

build/azure-pipelines/common/retry.ts

@@ -6,21 +6,25 @@
 'use strict';
 
 export async function retry<T>(fn: () => Promise<T>): Promise<T> {
+	let lastError: Error | undefined;
+
 	for (let run = 1; run <= 10; run++) {
 		try {
 			return await fn();
 		} catch (err) {
-			if (!/ECONNRESET/.test(err.message)) {
+			if (!/ECONNRESET|CredentialUnavailableError|Audience validation failed/i.test(err.message)) {
 				throw err;
 			}
 
+			lastError = err;
 			const millis = (Math.random() * 200) + (50 * Math.pow(1.5, run));
-			console.log(`Failed with ECONNRESET, retrying in ${millis}ms...`);
+			console.log(`Request failed, retrying in ${millis}ms...`);
 
 			// maximum delay is 10th retry: ~3 seconds
 			await new Promise(c => setTimeout(c, millis));
 		}
 	}
 
-	throw new Error('Retried too many times');
+	console.log(`Too many retries, aborting.`);
+	throw lastError;
 }

build/azure-pipelines/common/sign.js

@@ -18,7 +18,7 @@ function getParams(type) {
         case 'darwin-sign':
             return '[{"keyCode":"CP-401337-Apple","operationSetCode":"MacAppDeveloperSign","parameters":[{"parameterName":"Hardening","parameterValue":"--options=runtime"}],"toolName":"sign","toolVersion":"1.0"}]';
         case 'darwin-notarize':
-            return '[{"keyCode":"CP-401337-Apple","operationSetCode":"MacAppNotarize","parameters":[{"parameterName":"BundleId","parameterValue":"$(BundleIdentifier)"}],"toolName":"sign","toolVersion":"1.0"}]';
+            return '[{"keyCode":"CP-401337-Apple","operationSetCode":"MacAppNotarize","parameters":[],"toolName":"sign","toolVersion":"1.0"}]';
         default:
             throw new Error(`Sign type ${type} not found`);
     }

build/azure-pipelines/common/sign.ts

@@ -17,7 +17,7 @@ function getParams(type: string): string {
 		case 'darwin-sign':
 			return '[{"keyCode":"CP-401337-Apple","operationSetCode":"MacAppDeveloperSign","parameters":[{"parameterName":"Hardening","parameterValue":"--options=runtime"}],"toolName":"sign","toolVersion":"1.0"}]';
 		case 'darwin-notarize':
-			return '[{"keyCode":"CP-401337-Apple","operationSetCode":"MacAppNotarize","parameters":[{"parameterName":"BundleId","parameterValue":"$(BundleIdentifier)"}],"toolName":"sign","toolVersion":"1.0"}]';
+			return '[{"keyCode":"CP-401337-Apple","operationSetCode":"MacAppNotarize","parameters":[],"toolName":"sign","toolVersion":"1.0"}]';
 		default:
 			throw new Error(`Sign type ${type} not found`);
 	}

build/azure-pipelines/config/CredScanSuppressions.json

@@ -0,0 +1,11 @@
+{
+	"tool": "Credential Scanner",
+	"suppressions": [
+		{
+			"file": [
+				"src/vs/base/test/common/uri.test.ts"
+			],
+			"_justification": "These are not passwords, they are URIs."
+		}
+	]
+}

build/azure-pipelines/config/tsaoptions.json

@@ -0,0 +1,12 @@
+{
+	"instanceUrl": "https://msazure.visualstudio.com/defaultcollection",
+	"projectName": "One",
+	"areaPath": "One\\VSCode\\Client",
+	"iterationPath": "One",
+	"notificationAliases": [
+		"sbatten@microsoft.com"
+	],
+	"ppe": "false",
+	"template": "TFSMSAzure",
+	"codebaseName": "vscode-client"
+}

build/azure-pipelines/darwin/app-entitlements.plist

@@ -8,6 +8,8 @@
     <true/>
     <key>com.apple.security.cs.allow-dyld-environment-variables</key>
     <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
     <key>com.apple.security.device.audio-input</key>
     <true/>
     <key>com.apple.security.device.camera</key>

build/azure-pipelines/darwin/continuous-build-darwin.yml

@@ -49,7 +49,7 @@ steps:
 
   - script: |
       ./scripts/test.sh --tfs "Unit Tests"
-    displayName: Run Unit Tests (Electron)
+    displayName: Run Core Unit Tests # {{SQL CARBON EDIT}} Rename to core for clarity
 
   # - script: | {{SQL CARBON EDIT}} disable
   #     yarn test-browser --browser chromium --browser webkit --browser firefox --tfs "Browser Unit Tests"
@@ -57,7 +57,7 @@ steps:
 
   # - script: | {{SQL CARBON EDIT}} disable
   #     ./scripts/test-integration.sh --tfs "Integration Tests"
-  #   displayName: Run Integration Tests (Electron)
+  #   displayName: Run Core Integration Tests # {{SQL CARBON EDIT}} Rename to core for clarity
 
   - task: PublishPipelineArtifact@0
     inputs:

build/azure-pipelines/darwin/helper-renderer-entitlements.plist

@@ -4,11 +4,5 @@
 <dict>
     <key>com.apple.security.cs.allow-jit</key>
     <true/>
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true/>
-    <key>com.apple.security.cs.disable-library-validation</key>
-    <true/>
-    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
-    <true/>
 </dict>
 </plist>

build/azure-pipelines/darwin/product-build-darwin-sign.yml

@@ -1,7 +1,7 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
+      versionSpec: "16.x"
 
   - task: AzureKeyVault@1
     displayName: "Azure Key Vault: Get Secrets"
@@ -22,6 +22,14 @@ steps:
       git config user.name "VSCode"
     displayName: Prepare tooling
 
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
   - script: |
       set -e
       git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
@@ -29,9 +37,23 @@ steps:
 
   - script: |
       set -e
-      yarn --cwd build
-      yarn --cwd build compile
-    displayName: Compile build tools
+      npx https://aka.ms/enablesecurefeed standAlone
+    timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
+    condition: and(succeeded(), eq(variables['ENABLE_TERRAPIN'], 'true'))
+    displayName: Switch to Terrapin packages
+
+  - script: |
+      set -e
+      for i in {1..3}; do # try 3 times, for Terrapin
+        yarn --cwd build --frozen-lockfile --check-files && break
+        if [ $i -eq 3 ]; then
+          echo "Yarn failed too many times" >&2
+          exit 1
+        fi
+        echo "Yarn failed $i, trying again..."
+      done
+    displayName: Install build dependencies
 
   - download: current
     artifact: unsigned_vscode_client_darwin_$(VSCODE_ARCH)_archive
@@ -55,13 +77,6 @@ steps:
       node build/azure-pipelines/common/sign "$(esrpclient.toolpath)/$(esrpclient.toolname)" darwin-sign $(ESRP-PKI) $(esrp-aad-username) $(esrp-aad-password) $(agent.builddirectory) VSCode-darwin-$(VSCODE_ARCH).zip
     displayName: Codesign
 
-  - script: |
-      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
-      APP_NAME="`ls $APP_ROOT | head -n 1`"
-      BUNDLE_IDENTIFIER=$(node -p "require(\"$APP_ROOT/$APP_NAME/Contents/Resources/app/product.json\").darwinBundleIdentifier")
-      echo "##vso[task.setvariable variable=BundleIdentifier]$BUNDLE_IDENTIFIER"
-    displayName: Export bundle identifier
-
   - script: |
       set -e
       node build/azure-pipelines/common/sign "$(esrpclient.toolpath)/$(esrpclient.toolname)" darwin-notarize $(ESRP-PKI) $(esrp-aad-username) $(esrp-aad-password) $(agent.builddirectory) VSCode-darwin-$(VSCODE_ARCH).zip

build/azure-pipelines/darwin/product-build-darwin-test.yml

@@ -0,0 +1,274 @@
+steps:
+  - task: NodeTool@0
+    inputs:
+      versionSpec: "16.x"
+
+  - task: AzureKeyVault@1
+    displayName: "Azure Key Vault: Get Secrets"
+    inputs:
+      azureSubscription: "vscode-builds-subscription"
+      KeyVaultName: vscode
+      SecretsFilter: "github-distro-mixin-password,macos-developer-certificate,macos-developer-certificate-key"
+
+  - task: DownloadPipelineArtifact@2
+    inputs:
+      artifact: Compilation
+      path: $(Build.ArtifactStagingDirectory)
+    displayName: Download compilation output
+
+  - script: |
+      set -e
+      tar -xzf $(Build.ArtifactStagingDirectory)/compilation.tar.gz
+    displayName: Extract compilation output
+
+  # Set up the credentials to retrieve distro repo and setup git persona
+  # to create a merge commit for when we merge distro into oss
+  - script: |
+      set -e
+      cat << EOF > ~/.netrc
+      machine github.com
+      login vscode
+      password $(github-distro-mixin-password)
+      EOF
+
+      git config user.email "vscode@microsoft.com"
+      git config user.name "VSCode"
+    displayName: Prepare tooling
+
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
+  - script: |
+      set -e
+      git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
+    displayName: Merge distro
+
+  - script: |
+      mkdir -p .build
+      node build/azure-pipelines/common/computeNodeModulesCacheKey.js $VSCODE_ARCH $ENABLE_TERRAPIN > .build/yarnlockhash
+    displayName: Prepare yarn cache flags
+
+  - task: Cache@2
+    inputs:
+      key: "nodeModules | $(Agent.OS) | .build/yarnlockhash"
+      path: .build/node_modules_cache
+      cacheHitVar: NODE_MODULES_RESTORED
+    displayName: Restore node_modules cache
+
+  - script: |
+      set -e
+      tar -xzf .build/node_modules_cache/cache.tgz
+    condition: and(succeeded(), eq(variables.NODE_MODULES_RESTORED, 'true'))
+    displayName: Extract node_modules cache
+
+  - script: |
+      set -e
+      npm install -g node-gyp@latest
+      node-gyp --version
+    displayName: Update node-gyp
+    condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
+
+  - script: |
+      set -e
+      npx https://aka.ms/enablesecurefeed standAlone
+    timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
+    condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
+    displayName: Switch to Terrapin packages
+
+  - script: |
+      set -e
+      export npm_config_arch=$(VSCODE_ARCH)
+      export npm_config_node_gyp=$(which node-gyp)
+
+      for i in {1..3}; do # try 3 times, for Terrapin
+        yarn --frozen-lockfile --check-files && break
+        if [ $i -eq 3 ]; then
+          echo "Yarn failed too many times" >&2
+          exit 1
+        fi
+        echo "Yarn failed $i, trying again..."
+      done
+    env:
+      ELECTRON_SKIP_BINARY_DOWNLOAD: 1
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+      GITHUB_TOKEN: "$(github-distro-mixin-password)"
+    displayName: Install dependencies
+    condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
+
+  - script: |
+      set -e
+      node build/azure-pipelines/common/listNodeModules.js .build/node_modules_list.txt
+      mkdir -p .build/node_modules_cache
+      tar -czf .build/node_modules_cache/cache.tgz --files-from .build/node_modules_list.txt
+    condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
+    displayName: Create node_modules archive
+
+  # This script brings in the right resources (images, icons, etc) based on the quality (insiders, stable, exploration)
+  - script: |
+      set -e
+      node build/azure-pipelines/mixin
+    displayName: Mix in quality
+
+  - script: |
+      set -e
+      VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+        yarn gulp vscode-darwin-$(VSCODE_ARCH)-min-ci
+    displayName: Build client
+
+  - script: |
+      set -e
+      node build/azure-pipelines/mixin --server
+    displayName: Mix in server quality
+
+  - script: |
+      set -e
+      VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+        yarn gulp vscode-reh-darwin-$(VSCODE_ARCH)-min-ci
+      VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+        yarn gulp vscode-reh-web-darwin-$(VSCODE_ARCH)-min-ci
+    displayName: Build Server
+
+  - script: |
+      set -e
+      VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
+        yarn npm-run-all -lp "electron $(VSCODE_ARCH)" "playwright-install"
+    displayName: Download Electron and Playwright
+    condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+  # Setting hardened entitlements is a requirement for:
+  # * Running tests on Big Sur (because Big Sur has additional security precautions)
+  - script: |
+      set -e
+      security create-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
+      security default-keychain -s $(agent.tempdirectory)/buildagent.keychain
+      security unlock-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
+      echo "$(macos-developer-certificate)" | base64 -D > $(agent.tempdirectory)/cert.p12
+      security import $(agent.tempdirectory)/cert.p12 -k $(agent.tempdirectory)/buildagent.keychain -P "$(macos-developer-certificate-key)" -T /usr/bin/codesign
+      security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd $(agent.tempdirectory)/buildagent.keychain
+      VSCODE_ARCH=$(VSCODE_ARCH) DEBUG=electron-osx-sign* node build/darwin/sign.js
+    displayName: Set Hardened Entitlements
+
+  - script: |
+      set -e
+      ./scripts/test.sh --build --tfs "Unit Tests"
+    displayName: Run unit tests (Electron)
+    timeoutInMinutes: 15
+
+  - script: |
+      set -e
+      yarn test-node --build
+    displayName: Run unit tests (node.js)
+    timeoutInMinutes: 15
+
+  - script: |
+      set -e
+      DEBUG=*browser* yarn test-browser-no-install --sequential --build --browser chromium --browser webkit --tfs "Browser Unit Tests"
+    displayName: Run unit tests (Browser, Chromium & Webkit)
+    timeoutInMinutes: 30
+
+  - script: |
+      # Figure out the full absolute path of the product we just built
+      # including the remote server and configure the integration tests
+      # to run with these builds instead of running out of sources.
+      set -e
+      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
+      APP_NAME="`ls $APP_ROOT | head -n 1`"
+      INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME/Contents/MacOS/Electron" \
+      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-darwin-$(VSCODE_ARCH)" \
+      ./scripts/test-integration.sh --build --tfs "Integration Tests"
+    displayName: Run integration tests (Electron)
+    timeoutInMinutes: 20
+
+  - script: |
+      set -e
+      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-darwin-$(VSCODE_ARCH)" \
+      ./scripts/test-web-integration.sh --browser webkit
+    displayName: Run integration tests (Browser, Webkit)
+    timeoutInMinutes: 20
+
+  - script: |
+      set -e
+      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
+      APP_NAME="`ls $APP_ROOT | head -n 1`"
+      INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME/Contents/MacOS/Electron" \
+      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-darwin-$(VSCODE_ARCH)" \
+      ./scripts/test-remote-integration.sh
+    displayName: Run integration tests (Remote)
+    timeoutInMinutes: 20
+
+  - script: |
+      set -e
+      ps -ef
+    displayName: Diagnostics before smoke test run
+    continueOnError: true
+    condition: succeededOrFailed()
+
+  - script: |
+      set -e
+      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-darwin-$(VSCODE_ARCH)" \
+      yarn smoketest-no-compile --web --tracing --headless
+    timeoutInMinutes: 10
+    displayName: Run smoke tests (Browser, Chromium)
+
+  - script: |
+      set -e
+      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
+      APP_NAME="`ls $APP_ROOT | head -n 1`"
+      yarn smoketest-no-compile --tracing --build "$APP_ROOT/$APP_NAME"
+    timeoutInMinutes: 20
+    displayName: Run smoke tests (Electron)
+
+  - script: |
+      set -e
+      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
+      APP_NAME="`ls $APP_ROOT | head -n 1`"
+      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-darwin-$(VSCODE_ARCH)" \
+      yarn smoketest-no-compile --tracing --remote --build "$APP_ROOT/$APP_NAME"
+    timeoutInMinutes: 20
+    displayName: Run smoke tests (Remote)
+
+  - script: |
+      set -e
+      ps -ef
+    displayName: Diagnostics after smoke test run
+    continueOnError: true
+    condition: succeededOrFailed()
+
+  - task: PublishPipelineArtifact@0
+    inputs:
+      artifactName: crash-dump-macos-$(VSCODE_ARCH)
+      targetPath: .build/crashes
+    displayName: "Publish Crash Reports"
+    continueOnError: true
+    condition: failed()
+
+  # In order to properly symbolify above crash reports
+  # (if any), we need the compiled native modules too
+  - task: PublishPipelineArtifact@0
+    inputs:
+      artifactName: node-modules-macos-$(VSCODE_ARCH)
+      targetPath: node_modules
+    displayName: "Publish Node Modules"
+    continueOnError: true
+    condition: failed()
+
+  - task: PublishPipelineArtifact@0
+    inputs:
+      artifactName: logs-macos-$(VSCODE_ARCH)-$(System.JobAttempt)
+      targetPath: .build/logs
+    displayName: "Publish Log Files"
+    continueOnError: true
+    condition: failed()
+
+  - task: PublishTestResults@2
+    displayName: Publish Tests Results
+    inputs:
+      testResultsFiles: "*-results.xml"
+      searchFolder: "$(Build.ArtifactStagingDirectory)/test-results"
+    condition: succeededOrFailed()

build/azure-pipelines/darwin/product-build-darwin-universal.yml

@@ -0,0 +1,95 @@
+steps:
+  - task: NodeTool@0
+    inputs:
+      versionSpec: "16.x"
+
+  - task: AzureKeyVault@1
+    displayName: "Azure Key Vault: Get Secrets"
+    inputs:
+      azureSubscription: "vscode-builds-subscription"
+      KeyVaultName: vscode
+      SecretsFilter: "github-distro-mixin-password,macos-developer-certificate,macos-developer-certificate-key"
+
+  - script: |
+      set -e
+      cat << EOF > ~/.netrc
+      machine github.com
+      login vscode
+      password $(github-distro-mixin-password)
+      EOF
+
+      git config user.email "vscode@microsoft.com"
+      git config user.name "VSCode"
+    displayName: Prepare tooling
+
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
+  - script: |
+      set -e
+      git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
+    displayName: Merge distro
+
+  - script: |
+      mkdir -p .build
+      node build/azure-pipelines/common/computeNodeModulesCacheKey.js x64 $ENABLE_TERRAPIN > .build/yarnlockhash
+    displayName: Prepare yarn cache flags
+
+  - task: Cache@2
+    inputs:
+      key: "nodeModules | $(Agent.OS) | .build/yarnlockhash"
+      path: .build/node_modules_cache
+      cacheHitVar: NODE_MODULES_RESTORED
+    displayName: Restore node_modules cache
+
+  - script: |
+      set -e
+      tar -xzf .build/node_modules_cache/cache.tgz
+    displayName: Extract node_modules cache
+
+  - script: |
+      set -e
+      node build/azure-pipelines/mixin
+    displayName: Mix in quality
+
+  - download: current
+    artifact: unsigned_vscode_client_darwin_x64_archive
+    displayName: Download x64 artifact
+
+  - download: current
+    artifact: unsigned_vscode_client_darwin_arm64_archive
+    displayName: Download arm64 artifact
+
+  - script: |
+      set -e
+      cp $(Pipeline.Workspace)/unsigned_vscode_client_darwin_x64_archive/VSCode-darwin-x64.zip $(agent.builddirectory)/VSCode-darwin-x64.zip
+      cp $(Pipeline.Workspace)/unsigned_vscode_client_darwin_arm64_archive/VSCode-darwin-arm64.zip $(agent.builddirectory)/VSCode-darwin-arm64.zip
+      unzip $(agent.builddirectory)/VSCode-darwin-x64.zip -d $(agent.builddirectory)/VSCode-darwin-x64
+      unzip $(agent.builddirectory)/VSCode-darwin-arm64.zip -d $(agent.builddirectory)/VSCode-darwin-arm64
+      DEBUG=* node build/darwin/create-universal-app.js
+    displayName: Create Universal App
+
+  - script: |
+      set -e
+      security create-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
+      security default-keychain -s $(agent.tempdirectory)/buildagent.keychain
+      security unlock-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
+      echo "$(macos-developer-certificate)" | base64 -D > $(agent.tempdirectory)/cert.p12
+      security import $(agent.tempdirectory)/cert.p12 -k $(agent.tempdirectory)/buildagent.keychain -P "$(macos-developer-certificate-key)" -T /usr/bin/codesign
+      security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd $(agent.tempdirectory)/buildagent.keychain
+      VSCODE_ARCH=$(VSCODE_ARCH) DEBUG=electron-osx-sign* node build/darwin/sign.js
+    displayName: Set Hardened Entitlements
+
+  - script: |
+      set -e
+      pushd $(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH) && zip -r -X -y $(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH).zip * && popd
+    displayName: Archive build
+
+  - publish: $(Agent.BuildDirectory)/VSCode-darwin-$(VSCODE_ARCH).zip
+    artifact: unsigned_vscode_client_darwin_$(VSCODE_ARCH)_archive
+    displayName: Publish client archive

build/azure-pipelines/darwin/product-build-darwin.yml

@@ -1,30 +1,26 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
+      versionSpec: "16.x"
 
   - task: AzureKeyVault@1
     displayName: "Azure Key Vault: Get Secrets"
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: 'github-distro-mixin-password,macos-developer-certificate,macos-developer-certificate-key,ticino-storage-key'
+      SecretsFilter: "github-distro-mixin-password,macos-developer-certificate,macos-developer-certificate-key"
 
   - task: DownloadPipelineArtifact@2
     inputs:
       artifact: Compilation
       path: $(Build.ArtifactStagingDirectory)
     displayName: Download compilation output
-    condition: and(succeeded(), ne(variables['VSCODE_ARCH'], 'universal'))
 
   - script: |
       set -e
       tar -xzf $(Build.ArtifactStagingDirectory)/compilation.tar.gz
     displayName: Extract compilation output
-    condition: and(succeeded(), ne(variables['VSCODE_ARCH'], 'universal'))
 
-  # Set up the credentials to retrieve distro repo and setup git persona
-  # to create a merge commit for when we merge distro into oss
   - script: |
       set -e
       cat << EOF > ~/.netrc
@@ -39,9 +35,11 @@ steps:
 
   - script: |
       set -e
-      sudo xcode-select -s /Applications/Xcode_12.2.app
-    displayName: Switch to Xcode 12
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'arm64'))
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
 
   - script: |
       set -e
@@ -77,6 +75,7 @@ steps:
       set -e
       npx https://aka.ms/enablesecurefeed standAlone
     timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
     displayName: Switch to Terrapin packages
 
@@ -84,10 +83,9 @@ steps:
       set -e
       export npm_config_arch=$(VSCODE_ARCH)
       export npm_config_node_gyp=$(which node-gyp)
-      export SDKROOT=/Applications/Xcode_12.2.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.0.sdk
 
       for i in {1..3}; do # try 3 times, for Terrapin
-        yarn --frozen-lockfile && break
+        yarn --frozen-lockfile --check-files && break
         if [ $i -eq 3 ]; then
           echo "Yarn failed too many times" >&2
           exit 1
@@ -120,43 +118,19 @@ steps:
       VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
         yarn gulp vscode-darwin-$(VSCODE_ARCH)-min-ci
     displayName: Build client
-    condition: and(succeeded(), ne(variables['VSCODE_ARCH'], 'universal'))
+
+  - script: |
+      set -e
+      node build/azure-pipelines/mixin --server
+    displayName: Mix in server quality
 
   - script: |
       set -e
       VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
-        yarn gulp vscode-reh-darwin-min-ci
+        yarn gulp vscode-reh-darwin-$(VSCODE_ARCH)-min-ci
       VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
-        yarn gulp vscode-reh-web-darwin-min-ci
+        yarn gulp vscode-reh-web-darwin-$(VSCODE_ARCH)-min-ci
     displayName: Build Server
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'))
-
-  - script: |
-      set -e
-      VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
-        yarn npm-run-all -lp "electron $(VSCODE_ARCH)" "playwright-install"
-    displayName: Download Electron and Playwright
-    condition: and(succeeded(), ne(variables['VSCODE_ARCH'], 'universal'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - download: current
-    artifact: unsigned_vscode_client_darwin_x64_archive
-    displayName: Download x64 artifact
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'universal'))
-
-  - download: current
-    artifact: unsigned_vscode_client_darwin_arm64_archive
-    displayName: Download arm64 artifact
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'universal'))
-
-  - script: |
-      set -e
-      cp $(Pipeline.Workspace)/unsigned_vscode_client_darwin_x64_archive/VSCode-darwin-x64.zip $(agent.builddirectory)/VSCode-darwin-x64.zip
-      cp $(Pipeline.Workspace)/unsigned_vscode_client_darwin_arm64_archive/VSCode-darwin-arm64.zip $(agent.builddirectory)/VSCode-darwin-arm64.zip
-      unzip $(agent.builddirectory)/VSCode-darwin-x64.zip -d $(agent.builddirectory)/VSCode-darwin-x64
-      unzip $(agent.builddirectory)/VSCode-darwin-arm64.zip -d $(agent.builddirectory)/VSCode-darwin-arm64
-      DEBUG=* node build/darwin/create-universal-app.js
-    displayName: Create Universal App
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'universal'))
 
   # Setting hardened entitlements is a requirement for:
   # * Apple notarization
@@ -172,139 +146,76 @@ steps:
       VSCODE_ARCH=$(VSCODE_ARCH) DEBUG=electron-osx-sign* node build/darwin/sign.js
     displayName: Set Hardened Entitlements
 
-  - script: |
-      set -e
-      ./scripts/test.sh --build --tfs "Unit Tests"
-    displayName: Run unit tests (Electron)
-    timeoutInMinutes: 7
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - script: |
-      set -e
-      yarn test-browser --build --browser chromium --browser webkit --browser firefox --tfs "Browser Unit Tests"
-    displayName: Run unit tests (Browser)
-    timeoutInMinutes: 7
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - script: |
-      # Figure out the full absolute path of the product we just built
-      # including the remote server and configure the integration tests
-      # to run with these builds instead of running out of sources.
-      set -e
-      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
-      APP_NAME="`ls $APP_ROOT | head -n 1`"
-      INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME/Contents/MacOS/Electron" \
-      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-darwin" \
-      ./scripts/test-integration.sh --build --tfs "Integration Tests"
-    displayName: Run integration tests (Electron)
-    timeoutInMinutes: 10
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - script: |
-      set -e
-      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-darwin" \
-      ./resources/server/test/test-web-integration.sh --browser webkit
-    displayName: Run integration tests (Browser)
-    timeoutInMinutes: 10
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - script: |
-      set -e
-      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
-      APP_NAME="`ls $APP_ROOT | head -n 1`"
-      INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME/Contents/MacOS/Electron" \
-      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-darwin" \
-      ./resources/server/test/test-remote-integration.sh
-    displayName: Run remote integration tests (Electron)
-    timeoutInMinutes: 7
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - script: |
-      set -e
-      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
-      APP_NAME="`ls $APP_ROOT | head -n 1`"
-      yarn smoketest-no-compile --build "$APP_ROOT/$APP_NAME" --screenshots $(Build.SourcesDirectory)/.build/logs/smoke-tests
-    timeoutInMinutes: 5
-    displayName: Run smoke tests (Electron)
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - script: |
-      set -e
-      APP_ROOT=$(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
-      APP_NAME="`ls $APP_ROOT | head -n 1`"
-      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-darwin" \
-      yarn smoketest-no-compile --build "$APP_ROOT/$APP_NAME" --remote --screenshots $(Build.SourcesDirectory)/.build/logs/smoke-tests
-    timeoutInMinutes: 5
-    displayName: Run smoke tests (Remote)
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - script: |
-      set -e
-      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-darwin" \
-      yarn smoketest-no-compile --web --headless
-    timeoutInMinutes: 5
-    displayName: Run smoke tests (Browser)
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - task: PublishPipelineArtifact@0
-    inputs:
-      artifactName: crash-dump-macos-$(VSCODE_ARCH)
-      targetPath: .build/crashes
-    displayName: "Publish Crash Reports"
-    continueOnError: true
-    condition: failed()
-
-  - task: PublishPipelineArtifact@0
-    inputs:
-      artifactName: logs-macos-$(VSCODE_ARCH)-$(System.JobAttempt)
-      targetPath: .build/logs
-    displayName: "Publish Log Files"
-    continueOnError: true
-    condition: and(succeededOrFailed(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
-  - task: PublishTestResults@2
-    displayName: Publish Tests Results
-    inputs:
-      testResultsFiles: "*-results.xml"
-      searchFolder: "$(Build.ArtifactStagingDirectory)/test-results"
-    condition: and(succeededOrFailed(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
-
   - script: |
       set -e
       pushd $(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH) && zip -r -X -y $(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH).zip * && popd
     displayName: Archive build
-    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
 
   - script: |
       set -e
 
       # package Remote Extension Host
-      pushd .. && mv vscode-reh-darwin vscode-server-darwin && zip -Xry vscode-server-darwin.zip vscode-server-darwin && popd
+      pushd .. && mv vscode-reh-darwin-$(VSCODE_ARCH) vscode-server-darwin-$(VSCODE_ARCH) && zip -Xry vscode-server-darwin-$(VSCODE_ARCH).zip vscode-server-darwin-$(VSCODE_ARCH) && popd
 
       # package Remote Extension Host (Web)
-      pushd .. && mv vscode-reh-web-darwin vscode-server-darwin-web && zip -Xry vscode-server-darwin-web.zip vscode-server-darwin-web && popd
+      pushd .. && mv vscode-reh-web-darwin-$(VSCODE_ARCH) vscode-server-darwin-$(VSCODE_ARCH)-web && zip -Xry vscode-server-darwin-$(VSCODE_ARCH)-web.zip vscode-server-darwin-$(VSCODE_ARCH)-web && popd
     displayName: Prepare to publish servers
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), ne(variables['VSCODE_PUBLISH'], 'false'))
 
   - publish: $(Agent.BuildDirectory)/VSCode-darwin-$(VSCODE_ARCH).zip
     artifact: unsigned_vscode_client_darwin_$(VSCODE_ARCH)_archive
     displayName: Publish client archive
-    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
 
-  - publish: $(Agent.BuildDirectory)/vscode-server-darwin.zip
+  - publish: $(Agent.BuildDirectory)/vscode-server-darwin-$(VSCODE_ARCH).zip
     artifact: vscode_server_darwin_$(VSCODE_ARCH)_archive-unsigned
     displayName: Publish server archive
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), ne(variables['VSCODE_PUBLISH'], 'false'))
 
-  - publish: $(Agent.BuildDirectory)/vscode-server-darwin-web.zip
+  - publish: $(Agent.BuildDirectory)/vscode-server-darwin-$(VSCODE_ARCH)-web.zip
     artifact: vscode_web_darwin_$(VSCODE_ARCH)_archive-unsigned
     displayName: Publish web server archive
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - task: AzureCLI@2
+    inputs:
+      azureSubscription: "vscode-builds-subscription"
+      scriptType: pscore
+      scriptLocation: inlineScript
+      addSpnToEnvironment: true
+      inlineScript: |
+        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
 
   - script: |
-      AZURE_STORAGE_ACCESS_KEY="$(ticino-storage-key)" \
+      set -e
+      AZURE_STORAGE_ACCOUNT="ticino" \
+      AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
+      AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
+      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
       VSCODE_ARCH="$(VSCODE_ARCH)" \
-      yarn gulp upload-vscode-configuration
+        node build/azure-pipelines/upload-configuration
     displayName: Upload configuration (for Bing settings search)
     condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), ne(variables['VSCODE_PUBLISH'], 'false'))
     continueOnError: true
+
+  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
+    displayName: Generate SBOM (client)
+    inputs:
+      BuildDropPath: $(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)
+      PackageName: Visual Studio Code
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - publish: $(agent.builddirectory)/VSCode-darwin-$(VSCODE_ARCH)/_manifest
+    displayName: Publish SBOM (client)
+    artifact: vscode_client_darwin_$(VSCODE_ARCH)_sbom
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
+    displayName: Generate SBOM (server)
+    inputs:
+      BuildDropPath: $(agent.builddirectory)/vscode-server-darwin-$(VSCODE_ARCH)
+      PackageName: Visual Studio Code Server
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - publish: $(agent.builddirectory)/vscode-server-darwin-$(VSCODE_ARCH)/_manifest
+    displayName: Publish SBOM (server)
+    artifact: vscode_server_darwin_$(VSCODE_ARCH)_sbom
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))

build/azure-pipelines/darwin/sql-product-build-darwin-signing.yml

@@ -9,12 +9,12 @@ steps:
     displayName: 'Download Build Artifacts'
     inputs:
       downloadType: specific
-      itemPattern: 'drop/darwin/archive/azuredatastudio-darwin-unsigned.zip'
+      itemPattern: 'drop/darwin/archive/azuredatastudio-darwin-$(VSCODE_ARCH)-unsigned.zip'
       downloadPath: '$(Build.SourcesDirectory)/.build/'
 
   - script: |
       pushd $(Build.SourcesDirectory)/.build/drop/darwin/archive
-      mv azuredatastudio-darwin-unsigned.zip azuredatastudio-darwin.zip
+      mv azuredatastudio-darwin-$(VSCODE_ARCH)-unsigned.zip azuredatastudio-darwin-$(VSCODE_ARCH).zip
     displayName: 'Rename the file'
 
   - task: UseDotNet@2
@@ -29,7 +29,7 @@ steps:
     inputs:
       ConnectedServiceName: 'Code Signing'
       FolderPath: '$(Build.SourcesDirectory)/.build/drop/darwin/archive'
-      Pattern: 'azuredatastudio-darwin.zip'
+      Pattern: 'azuredatastudio-darwin-$(VSCODE_ARCH).zip'
       signConfigType: inlineSignParams
       inlineOperation: |
         [
@@ -47,7 +47,7 @@ steps:
     condition: and(succeeded(), eq(variables['signed'], true))
 
   - script: |
-      zip -d $(Build.SourcesDirectory)/.build/drop/darwin/archive/azuredatastudio-darwin.zip "*.pkg"
+      zip -d $(Build.SourcesDirectory)/.build/drop/darwin/archive/azuredatastudio-darwin-$(VSCODE_ARCH).zip "*.pkg"
     displayName: Clean Archive
     condition: and(succeeded(), eq(variables['signed'], true))
 
@@ -56,7 +56,7 @@ steps:
     inputs:
       ConnectedServiceName: 'Code Signing'
       FolderPath: '$(Build.SourcesDirectory)/.build/drop/darwin/archive'
-      Pattern: 'azuredatastudio-darwin.zip'
+      Pattern: 'azuredatastudio-darwin-$(VSCODE_ARCH).zip'
       signConfigType: inlineSignParams
       inlineOperation: |
         [

build/azure-pipelines/darwin/sql-product-build-darwin.yml

@@ -52,7 +52,7 @@ steps:
 
   - script: |
       mkdir -p .build
-      node build/azure-pipelines/common/sql-computeNodeModulesCacheKey.js > .build/yarnlockhash
+      node build/azure-pipelines/common/sql-computeNodeModulesCacheKey.js $(NPM_CONFIG_ARCH) > .build/yarnlockhash
     displayName: Prepare yarn cache key
 
   - task: Cache@2
@@ -71,6 +71,7 @@ steps:
 
   - script: |
       set -e
+      export npm_config_arch=$(NPM_CONFIG_ARCH)
       CHILD_CONCURRENCY=1 yarn --frozen-lockfile
     displayName: Install dependencies
     env:
@@ -93,16 +94,17 @@ steps:
 
   - script: |
       set -e
-      node build/azure-pipelines/mixin
+      node build/azure-pipelines/sql-mixin
     displayName: Mix in quality
 
   - script: |
       set -e
       yarn gulp package-rebuild-extensions
-      yarn gulp vscode-darwin-x64-min-ci
+      yarn gulp vscode-darwin-$(VSCODE_ARCH)-min-ci
     displayName: Build
     env:
       VSCODE_MIXIN_PASSWORD: $(github-distro-mixin-password)
+    condition: and(succeeded(), ne(variables['VSCODE_ARCH'], 'universal'))
 
   - script: |
       set -e
@@ -120,32 +122,34 @@ steps:
       INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME/Contents/MacOS/Electron" \
       VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/azuredatastudio-reh-darwin" \
       ./scripts/test-integration.sh --build --tfs "Integration Tests"
-    displayName: Run integration tests (Electron)
+    displayName: Run core integration tests
     condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'))
 
   - script: |
       set -e
       yarn gulp compile-extensions
     displayName: Compile Extensions
+    condition: and(succeeded(), ne(variables['VSCODE_ARCH'], 'universal'))
 
   # Per https://developercommunity.visualstudio.com/t/variablesexpressions-dont-work-with-continueonerro/1187733 we can't use variables
   # in continueOnError directly so instead make two copies of the task and only run one or the other based on the SMOKE_FAIL_ON_ERROR value
-  - script: |
-      set -e
-      APP_ROOT=$(agent.builddirectory)/azuredatastudio-darwin-x64
-      APP_NAME="`ls $APP_ROOT | head -n 1`"
-      yarn smoketest --build "$APP_ROOT/$APP_NAME" --screenshots "$(build.artifactstagingdirectory)/smokeshots" --log "$(build.artifactstagingdirectory)/logs/darwin/smoke.log" --extensionsDir "$(build.sourcesdirectory)/extensions"
-    displayName: Run smoke tests (Electron) (Continue on Error)
-    continueOnError: true
-    condition: and(succeeded(), and(or(eq(variables['RUN_TESTS'], 'true'), eq(variables['RUN_SMOKE_TESTS'], 'true')), ne(variables['SMOKE_FAIL_ON_ERROR'], 'true')))
+  # {{SQL CARBON TODO}} -- reenable
+  # - script: |
+  #     set -e
+  #     APP_ROOT=$(agent.builddirectory)/azuredatastudio-darwin-$(VSCODE_ARCH)
+  #     APP_NAME="`ls $APP_ROOT | head -n 1`"
+  #     yarn smoketest --build "$APP_ROOT/$APP_NAME" --screenshots "$(build.artifactstagingdirectory)/smokeshots" --log "$(build.artifactstagingdirectory)/logs/darwin/smoke.log" --extensionsDir "$(build.sourcesdirectory)/extensions" --extraArgs "--disable-extension Microsoft.kusto --disable-extension Microsoft.azuremonitor"
+  #   displayName: Run core smoke tests (Continue on Error)
+  #   continueOnError: true
+  #   condition: and(succeeded(), and(or(eq(variables['RUN_TESTS'], 'true'), eq(variables['RUN_SMOKE_TESTS'], 'true')), ne(variables['SMOKE_FAIL_ON_ERROR'], 'true')))
 
-  - script: |
-      set -e
-      APP_ROOT=$(agent.builddirectory)/azuredatastudio-darwin-x64
-      APP_NAME="`ls $APP_ROOT | head -n 1`"
-      yarn smoketest --build "$APP_ROOT/$APP_NAME" --screenshots "$(build.artifactstagingdirectory)/smokeshots" --log "$(build.artifactstagingdirectory)/logs/darwin/smoke.log" --extensionsDir "$(build.sourcesdirectory)/extensions"
-    displayName: Run smoke tests (Electron) (Fail on Error)
-    condition: and(succeeded(), and(or(eq(variables['RUN_TESTS'], 'true'), eq(variables['RUN_SMOKE_TESTS'], 'true')), eq(variables['SMOKE_FAIL_ON_ERROR'], 'true')))
+  # - script: |
+  #     set -e
+  #     APP_ROOT=$(agent.builddirectory)/azuredatastudio-darwin-$(VSCODE_ARCH)
+  #     APP_NAME="`ls $APP_ROOT | head -n 1`"
+  #     yarn smoketest --build "$APP_ROOT/$APP_NAME" --screenshots "$(build.artifactstagingdirectory)/smokeshots" --log "$(build.artifactstagingdirectory)/logs/darwin/smoke.log" --extensionsDir "$(build.sourcesdirectory)/extensions"
+  #   displayName: Run core smoke tests (Fail on Error)
+  #   condition: and(succeeded(), and(or(eq(variables['RUN_TESTS'], 'true'), eq(variables['RUN_SMOKE_TESTS'], 'true')), eq(variables['SMOKE_FAIL_ON_ERROR'], 'true')))
 
   # - script: |
   #     set -e
@@ -156,9 +160,25 @@ steps:
   #   continueOnError: true
   #   condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'))
 
+  - task: DownloadBuildArtifacts@0
+    displayName: 'Download arm64 and x64 packages'
+    inputs:
+      downloadType: specific
+      itemPattern: 'drop/darwin/archive/azuredatastudio-darwin-@(arm64|x64)-unsigned.zip'
+      downloadPath: $(agent.builddirectory)
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'universal'))
+
   - script: |
       set -e
-      pushd ../azuredatastudio-darwin-x64
+      unzip $(agent.builddirectory)/drop/darwin/archive/azuredatastudio-darwin-x64-unsigned.zip -d $(agent.builddirectory)/azuredatastudio-darwin-x64
+      unzip $(agent.builddirectory)/drop/darwin/archive/azuredatastudio-darwin-arm64-unsigned.zip -d $(agent.builddirectory)/azuredatastudio-darwin-arm64
+      DEBUG=* node build/darwin/create-universal-app.js
+    displayName: Create Universal App
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'universal'))
+
+  - script: |
+      set -e
+      pushd ../azuredatastudio-darwin-$(VSCODE_ARCH)
       ls
 
       echo "Cleaning the application"
@@ -188,20 +208,10 @@ steps:
   - script: |
       set -e
       mkdir -p .build/darwin/archive
-      pushd ../azuredatastudio-darwin-x64
-      ditto -c -k --keepParent *.app $(Build.SourcesDirectory)/.build/darwin/archive/azuredatastudio-darwin.zip
-      popd
-    displayName: 'Archive (no signing)'
-    condition: and(succeeded(), eq(variables['signed'], false))
-
-  - script: |
-      set -e
-      mkdir -p .build/darwin/archive
-      pushd ../azuredatastudio-darwin-x64
-      ditto -c -k --keepParent *.app $(Build.SourcesDirectory)/.build/darwin/archive/azuredatastudio-darwin-unsigned.zip
+      pushd ../azuredatastudio-darwin-$(VSCODE_ARCH)
+      ditto -c -k --keepParent *.app $(Build.SourcesDirectory)/.build/darwin/archive/azuredatastudio-darwin-$(VSCODE_ARCH)-unsigned.zip
       popd
     displayName: 'Archive'
-    condition: and(succeeded(), eq(variables['signed'], true))
 
   - script: |
       set -e

build/azure-pipelines/darwin/sql-publish.ps1

@@ -13,12 +13,22 @@ $Version = $VersionJson.version
 $Quality = $VersionJson.quality
 $CommitId = $VersionJson.commit
 
-$ZipName = "azuredatastudio-darwin.zip"
-$Zip = "$artifactsDir\darwin\archive\$ZipName"
-$UploadName = "azuredatastudio-macos-$Version"
+$Flavors = "x64","arm64","universal"
+$FlavorSuffixes = "","-arm64","-universal"
 
-If (-NOT ($Quality -eq "stable")) {
-	$UploadName = "$UploadName-$Quality"
+For($i = 0; $i -lt $Flavors.Length; $i++)
+{
+	$Flavor = $Flavors[$i]
+	$FlavorSuffix = $FlavorSuffixes[$i]
+	$ZipName = "azuredatastudio-darwin-$Flavor.zip"
+	$Zip = "$artifactsDir\darwin\archive\$ZipName"
+	$UploadName = "azuredatastudio-macos$FlavorSuffix-$Version"
+
+	If (-NOT ($Quality -eq "stable")) {
+		$UploadName = "$UploadName-$Quality"
+	}
+
+	$Platform = "darwin$FlavorSuffix"
+
+	node $sourcesDir\build\azure-pipelines\common\publish.js $Quality $Platform archive "$UploadName.zip" $Version true $Zip $CommitId
 }
-
-node $sourcesDir\build\azure-pipelines\common\publish.js $Quality darwin archive "$UploadName.zip" $Version true $Zip $CommitId

build/azure-pipelines/distro-build.yml

@@ -1,5 +1,5 @@
 pool:
-  vmImage: 'Ubuntu-18.04'
+  vmImage: 'Ubuntu-20.04'
 
 trigger:
   branches:
@@ -18,7 +18,7 @@ steps:
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: 'github-distro-mixin-password'
+      SecretsFilter: "github-distro-mixin-password"
 
   - script: |
       set -e

build/azure-pipelines/docker/sql-product-build-docker.yml

@@ -64,7 +64,7 @@ steps:
 
   - script: |
       set -e
-      node build/azure-pipelines/mixin
+      node build/azure-pipelines/sql-mixin
     displayName: Mix in quality
 
   - task: DownloadBuildArtifacts@0

build/azure-pipelines/exploration-build.yml

@@ -11,14 +11,14 @@ pr:
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
+      versionSpec: "16.x"
 
   - task: AzureKeyVault@1
     displayName: "Azure Key Vault: Get Secrets"
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: 'github-distro-mixin-password'
+      SecretsFilter: "github-distro-mixin-password"
 
   - script: |
       set -e

build/azure-pipelines/linux/Dockerfile

@@ -1,5 +1,5 @@
-#Download base image ubuntu 18.04
-FROM mcr.microsoft.com/mirror/docker/library/ubuntu:18.04
+#Download base image ubuntu 20.04
+FROM mcr.microsoft.com/mirror/docker/library/ubuntu:20.04
 
 #Adding apt repos for g++-4.9
 RUN echo "deb http://dk.archive.ubuntu.com/ubuntu/ xenial main" >> /etc/apt/sources.list

build/azure-pipelines/linux/alpine/install-dependencies.sh

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-echo "Installing remote dependencies"
-(cd remote && rm -rf node_modules && yarn)

build/azure-pipelines/linux/continuous-build-linux.yml

@@ -67,7 +67,7 @@ steps:
 
   - script: |
       DISPLAY=:10 ./scripts/test.sh --tfs "Unit Tests"
-    displayName: Run Unit Tests (Electron)
+    displayName: Run Core Unit Tests # {{SQL CARBON EDIT}} Rename to core for clarity
 
   # - script: |  {{SQL CARBON EDIT}} disable
   #     DISPLAY=:10 yarn test-browser --browser chromium --tfs "Browser Unit Tests"
@@ -75,7 +75,7 @@ steps:
 
   # - script: |  {{SQL CARBON EDIT}} disable
   #     DISPLAY=:10 ./scripts/test-integration.sh --tfs "Integration Tests"
-  #   displayName: Run Integration Tests (Electron)
+  #   displayName: Run Core Integration Tests # {{SQL CARBON EDIT}} Rename to core for clarity
 
   # - task: PublishPipelineArtifact@0
   #   inputs:

build/azure-pipelines/linux/product-build-alpine.yml

@@ -1,18 +1,14 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
-
-  - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-    inputs:
-      versionSpec: "1.x"
+      versionSpec: "16.x"
 
   - task: AzureKeyVault@1
     displayName: "Azure Key Vault: Get Secrets"
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: 'github-distro-mixin-password'
+      SecretsFilter: "github-distro-mixin-password"
 
   - task: DownloadPipelineArtifact@2
     inputs:
@@ -46,6 +42,14 @@ steps:
       git config user.name "VSCode"
     displayName: Prepare tooling
 
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
   - script: |
       set -e
       git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
@@ -58,7 +62,7 @@ steps:
 
   - task: Cache@2
     inputs:
-      key: 'nodeModules | $(Agent.OS) | .build/yarnlockhash'
+      key: "nodeModules | $(Agent.OS) | .build/yarnlockhash"
       path: .build/node_modules_cache
       cacheHitVar: NODE_MODULES_RESTORED
     displayName: Restore node_modules cache
@@ -73,13 +77,14 @@ steps:
       set -e
       npx https://aka.ms/enablesecurefeed standAlone
     timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
     displayName: Switch to Terrapin packages
 
   - script: |
       set -e
       for i in {1..3}; do # try 3 times, for Terrapin
-        yarn --frozen-lockfile && break
+        yarn --frozen-lockfile --check-files --check-files && break
         if [ $i -eq 3 ]; then
           echo "Yarn failed too many times" >&2
           exit 1
@@ -104,15 +109,16 @@ steps:
   - script: |
       set -e
       node build/azure-pipelines/mixin
+      node build/azure-pipelines/mixin --server
     displayName: Mix in quality
 
   - script: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-    displayName: 'Register Docker QEMU'
+    displayName: "Register Docker QEMU"
     condition: eq(variables['VSCODE_ARCH'], 'arm64')
 
   - script: |
       set -e
-      docker run -e VSCODE_QUALITY -v $(pwd):/root/vscode -v ~/.netrc:/root/.netrc vscodehub.azurecr.io/vscode-linux-build-agent:alpine-$(VSCODE_ARCH) /root/vscode/build/azure-pipelines/linux/alpine/install-dependencies.sh
+      docker run -e VSCODE_QUALITY -v $(pwd):/root/vscode -v ~/.netrc:/root/.netrc vscodehub.azurecr.io/vscode-linux-build-agent:alpine-$(VSCODE_ARCH) /root/vscode/build/azure-pipelines/linux/scripts/install-remote-dependencies.sh
     displayName: Prebuild
 
   - script: |

build/azure-pipelines/linux/product-build-linux-client.yml

@@ -1,18 +1,14 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
-
-  - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-    inputs:
-      versionSpec: "1.x"
+      versionSpec: "16.x"
 
   - task: AzureKeyVault@1
     displayName: "Azure Key Vault: Get Secrets"
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: "github-distro-mixin-password,builds-docdb-key-readwrite,vscode-storage-key,ESRP-PKI,esrp-aad-username,esrp-aad-password"
+      SecretsFilter: "github-distro-mixin-password,ESRP-PKI,esrp-aad-username,esrp-aad-password"
 
   - task: DownloadPipelineArtifact@2
     inputs:
@@ -20,6 +16,23 @@ steps:
       path: $(Build.ArtifactStagingDirectory)
     displayName: Download compilation output
 
+  - task: DownloadPipelineArtifact@2
+    inputs:
+      artifact: reh_node_modules-$(VSCODE_ARCH)
+      path: $(Build.ArtifactStagingDirectory)
+    displayName: Download server build dependencies
+    condition: and(succeeded(), ne(variables['VSCODE_ARCH'], 'armhf'))
+
+  - script: |
+      set -e
+      # Start X server
+      /etc/init.d/xvfb start
+      # Start dbus session
+      DBUS_LAUNCH_RESULT=$(sudo dbus-daemon --config-file=/usr/share/dbus-1/system.conf --print-address)
+      echo "##vso[task.setvariable variable=DBUS_SESSION_BUS_ADDRESS]$DBUS_LAUNCH_RESULT"
+    displayName: Setup system services
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'))
+
   - script: |
       set -e
       tar -xzf $(Build.ArtifactStagingDirectory)/compilation.tar.gz
@@ -37,6 +50,14 @@ steps:
       git config user.name "VSCode"
     displayName: Prepare tooling
 
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
   - script: |
       set -e
       git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
@@ -64,14 +85,21 @@ steps:
       set -e
       npx https://aka.ms/enablesecurefeed standAlone
     timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
     displayName: Switch to Terrapin packages
 
   - script: |
       set -e
-      yarn --cwd build
-      yarn --cwd build compile
-    displayName: Compile build tools
+      for i in {1..3}; do # try 3 times, for Terrapin
+        yarn --cwd build --frozen-lockfile --check-files && break
+        if [ $i -eq 3 ]; then
+          echo "Yarn failed too many times" >&2
+          exit 1
+        fi
+        echo "Yarn failed $i, trying again..."
+      done
+    displayName: Install build dependencies
 
   - script: |
       set -e
@@ -79,7 +107,7 @@ steps:
 
       if [ -z "$CC" ] || [ -z "$CXX" ]; then
         # Download clang based on chromium revision used by vscode
-        curl -s https://raw.githubusercontent.com/chromium/chromium/91.0.4472.164/tools/clang/scripts/update.py | python - --output-dir=$PWD/.build/CR_Clang --host-os=linux
+        curl -s https://raw.githubusercontent.com/chromium/chromium/98.0.4758.109/tools/clang/scripts/update.py | python - --output-dir=$PWD/.build/CR_Clang --host-os=linux
         # Download libcxx headers and objects from upstream electron releases
         DEBUG=libcxx-fetcher \
         VSCODE_LIBCXX_OBJECTS_DIR=$PWD/.build/libcxx-objects \
@@ -88,19 +116,20 @@ steps:
         VSCODE_ARCH="$(NPM_ARCH)" \
         node build/linux/libcxx-fetcher.js
         # Set compiler toolchain
+        # Flags for the client build are based on
+        # https://source.chromium.org/chromium/chromium/src/+/refs/tags/98.0.4758.109:build/config/arm.gni
+        # https://source.chromium.org/chromium/chromium/src/+/refs/tags/98.0.4758.109:build/config/compiler/BUILD.gn
+        # https://source.chromium.org/chromium/chromium/src/+/refs/tags/98.0.4758.109:build/config/c++/BUILD.gn
         export CC=$PWD/.build/CR_Clang/bin/clang
         export CXX=$PWD/.build/CR_Clang/bin/clang++
-        export CXXFLAGS="-nostdinc++ -D_LIBCPP_HAS_NO_VENDOR_AVAILABILITY_ANNOTATIONS -D__NO_INLINE__ -isystem$PWD/.build/libcxx_headers/include -isystem$PWD/.build/libcxxabi_headers/include -fPIC -flto=thin -fsplit-lto-unit"
-        export LDFLAGS="-stdlib=libc++ -fuse-ld=lld -flto=thin -fsplit-lto-unit -L$PWD/.build/libcxx-objects -lc++abi"
-      fi
-
-      if [ "$VSCODE_ARCH" == "x64" ]; then
-        export VSCODE_REMOTE_CC=$(which gcc-4.8)
-        export VSCODE_REMOTE_CXX=$(which g++-4.8)
+        export CXXFLAGS="-nostdinc++ -D__NO_INLINE__ -isystem$PWD/.build/libcxx_headers -isystem$PWD/.build/libcxx_headers/include -isystem$PWD/.build/libcxxabi_headers/include -fPIC -flto=thin -fsplit-lto-unit"
+        export LDFLAGS="-stdlib=libc++ -fuse-ld=lld -flto=thin -L$PWD/.build/libcxx-objects -lc++abi -Wl,--lto-O0"
+        export VSCODE_REMOTE_CC=$(which gcc)
+        export VSCODE_REMOTE_CXX=$(which g++)
       fi
 
       for i in {1..3}; do # try 3 times, for Terrapin
-        yarn --frozen-lockfile && break
+        yarn --frozen-lockfile --check-files && break
         if [ $i -eq 3 ]; then
           echo "Yarn failed too many times" >&2
           exit 1
@@ -114,6 +143,13 @@ steps:
     displayName: Install dependencies
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
 
+  - script: |
+      set -e
+      rm -rf remote/node_modules
+      tar -xzf $(Build.ArtifactStagingDirectory)/reh_node_modules-$(VSCODE_ARCH).tar.gz --directory $(Build.SourcesDirectory)/remote
+    displayName: Extract server node_modules output
+    condition: and(succeeded(), ne(variables['VSCODE_ARCH'], 'armhf'))
+
   - script: |
       set -e
       node build/azure-pipelines/common/listNodeModules.js .build/node_modules_list.txt
@@ -133,6 +169,11 @@ steps:
         yarn gulp vscode-linux-$(VSCODE_ARCH)-min-ci
     displayName: Build
 
+  - script: |
+      set -e
+      node build/azure-pipelines/mixin --server
+    displayName: Mix in server quality
+
   - script: |
       set -e
       VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
@@ -163,14 +204,21 @@ steps:
       set -e
       ./scripts/test.sh --build --tfs "Unit Tests"
     displayName: Run unit tests (Electron)
-    timeoutInMinutes: 7
+    timeoutInMinutes: 15
     condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - script: |
       set -e
-      yarn test-browser --build --browser chromium --tfs "Browser Unit Tests"
-    displayName: Run unit tests (Browser)
-    timeoutInMinutes: 7
+      yarn test-node --build
+    displayName: Run unit tests (node.js)
+    timeoutInMinutes: 15
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+  - script: |
+      set -e
+      DEBUG=*browser* yarn test-browser-no-install --build --browser chromium --tfs "Browser Unit Tests"
+    displayName: Run unit tests (Browser, Chromium)
+    timeoutInMinutes: 15
     condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - script: |
@@ -185,15 +233,15 @@ steps:
       VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-linux-$(VSCODE_ARCH)" \
       ./scripts/test-integration.sh --build --tfs "Integration Tests"
     displayName: Run integration tests (Electron)
-    timeoutInMinutes: 10
+    timeoutInMinutes: 20
     condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - script: |
       set -e
       VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-linux-$(VSCODE_ARCH)" \
-      ./resources/server/test/test-web-integration.sh --browser chromium
-    displayName: Run integration tests (Browser)
-    timeoutInMinutes: 10
+      ./scripts/test-web-integration.sh --browser chromium
+    displayName: Run integration tests (Browser, Chromium)
+    timeoutInMinutes: 20
     condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - script: |
@@ -203,16 +251,33 @@ steps:
       INTEGRATION_TEST_APP_NAME="$APP_NAME" \
       INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME" \
       VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-linux-$(VSCODE_ARCH)" \
-      ./resources/server/test/test-remote-integration.sh
-    displayName: Run remote integration tests (Electron)
-    timeoutInMinutes: 7
+      ./scripts/test-remote-integration.sh
+    displayName: Run integration tests (Remote)
+    timeoutInMinutes: 20
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+  - script: |
+      set -e
+      ps -ef
+      cat /proc/sys/fs/inotify/max_user_watches
+      lsof | wc -l
+    displayName: Diagnostics before smoke test run (processes, max_user_watches, number of opened file handles)
+    continueOnError: true
+    condition: and(succeededOrFailed(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
+  - script: |
+      set -e
+      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-linux-$(VSCODE_ARCH)" \
+      yarn smoketest-no-compile --web --tracing --headless --electronArgs="--disable-dev-shm-usage"
+    timeoutInMinutes: 10
+    displayName: Run smoke tests (Browser, Chromium)
     condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - script: |
       set -e
       APP_PATH=$(agent.builddirectory)/VSCode-linux-$(VSCODE_ARCH)
-      yarn smoketest-no-compile --build "$APP_PATH" --electronArgs="--disable-dev-shm-usage --use-gl=swiftshader" --screenshots $(Build.SourcesDirectory)/.build/logs/smoke-tests
-    timeoutInMinutes: 5
+      yarn smoketest-no-compile --tracing --build "$APP_PATH"
+    timeoutInMinutes: 20
     displayName: Run smoke tests (Electron)
     condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
@@ -220,18 +285,19 @@ steps:
       set -e
       APP_PATH=$(agent.builddirectory)/VSCode-linux-$(VSCODE_ARCH)
       VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-linux-$(VSCODE_ARCH)" \
-      yarn smoketest-no-compile --build "$APP_PATH" --remote --electronArgs="--disable-dev-shm-usage --use-gl=swiftshader" --screenshots $(Build.SourcesDirectory)/.build/logs/smoke-tests
-    timeoutInMinutes: 5
+      yarn smoketest-no-compile --tracing --remote --build "$APP_PATH"
+    timeoutInMinutes: 20
     displayName: Run smoke tests (Remote)
     condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - script: |
       set -e
-      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/vscode-reh-web-linux-$(VSCODE_ARCH)" \
-      yarn smoketest-no-compile --web --headless --electronArgs="--disable-dev-shm-usage --use-gl=swiftshader"
-    timeoutInMinutes: 5
-    displayName: Run smoke tests (Browser)
-    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+      ps -ef
+      cat /proc/sys/fs/inotify/max_user_watches
+      lsof | wc -l
+    displayName: Diagnostics after smoke test run (processes, max_user_watches, number of opened file handles)
+    continueOnError: true
+    condition: and(succeededOrFailed(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - task: PublishPipelineArtifact@0
     inputs:
@@ -241,13 +307,23 @@ steps:
     continueOnError: true
     condition: failed()
 
+  # In order to properly symbolify above crash reports
+  # (if any), we need the compiled native modules too
+  - task: PublishPipelineArtifact@0
+    inputs:
+      artifactName: node-modules-linux-$(VSCODE_ARCH)
+      targetPath: node_modules
+    displayName: "Publish Node Modules"
+    continueOnError: true
+    condition: failed()
+
   - task: PublishPipelineArtifact@0
     inputs:
       artifactName: logs-linux-$(VSCODE_ARCH)-$(System.JobAttempt)
       targetPath: .build/logs
     displayName: "Publish Log Files"
     continueOnError: true
-    condition: and(succeededOrFailed(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+    condition: and(failed(), eq(variables['VSCODE_ARCH'], 'x64'), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - task: PublishTestResults@2
     displayName: Publish Tests Results
@@ -278,13 +354,6 @@ steps:
     displayName: Download ESRPClient
     condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
 
-  - script: |
-      set -e
-      yarn --cwd build
-      yarn --cwd build compile
-    displayName: Compile build tools
-    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
-
   - script: |
       set -e
       node build/azure-pipelines/common/sign "$(esrpclient.toolpath)/$(esrpclient.toolname)" rpm $(ESRP-PKI) $(esrp-aad-username) $(esrp-aad-password) .build/linux/rpm '*.rpm'
@@ -293,9 +362,6 @@ steps:
 
   - script: |
       set -e
-      AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
-      AZURE_STORAGE_ACCESS_KEY_2="$(vscode-storage-key)" \
-      VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)" \
       VSCODE_ARCH="$(VSCODE_ARCH)" \
       ./build/azure-pipelines/linux/prepare-publish.sh
     displayName: Prepare for Publish
@@ -332,3 +398,27 @@ steps:
       artifactName: "snap-$(VSCODE_ARCH)"
       targetPath: .build/linux/snap-tarball
     condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
+    displayName: Generate SBOM (client)
+    inputs:
+      BuildDropPath: $(agent.builddirectory)/VSCode-linux-$(VSCODE_ARCH)
+      PackageName: Visual Studio Code
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - publish: $(agent.builddirectory)/VSCode-linux-$(VSCODE_ARCH)/_manifest
+    displayName: Publish SBOM (client)
+    artifact: vscode_client_linux_$(VSCODE_ARCH)_sbom
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
+    displayName: Generate SBOM (server)
+    inputs:
+      BuildDropPath: $(agent.builddirectory)/vscode-server-linux-$(VSCODE_ARCH)
+      PackageName: Visual Studio Code Server
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - publish: $(agent.builddirectory)/vscode-server-linux-$(VSCODE_ARCH)/_manifest
+    displayName: Publish SBOM (server)
+    artifact: vscode_server_linux_$(VSCODE_ARCH)_sbom
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))

build/azure-pipelines/linux/product-build-linux-server.yml

@@ -0,0 +1,85 @@
+steps:
+  - task: NodeTool@0
+    inputs:
+      versionSpec: "16.x"
+
+  - task: AzureKeyVault@1
+    displayName: "Azure Key Vault: Get Secrets"
+    inputs:
+      azureSubscription: "vscode-builds-subscription"
+      KeyVaultName: vscode
+      SecretsFilter: "github-distro-mixin-password,ESRP-PKI,esrp-aad-username,esrp-aad-password"
+
+  - task: Docker@1
+    displayName: "Pull Docker image"
+    inputs:
+      azureSubscriptionEndpoint: "vscode-builds-subscription"
+      azureContainerRegistry: vscodehub.azurecr.io
+      command: "Run an image"
+      imageName: "vscode-linux-build-agent:centos7-devtoolset8-arm64"
+      containerCommand: uname
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'arm64'))
+
+  - script: |
+      set -e
+      cat << EOF > ~/.netrc
+      machine github.com
+      login vscode
+      password $(github-distro-mixin-password)
+      EOF
+
+      git config user.email "vscode@microsoft.com"
+      git config user.name "VSCode"
+    displayName: Prepare tooling
+
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
+  - script: |
+      set -e
+      git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
+    displayName: Merge distro
+
+  - script: |
+      set -e
+      npx https://aka.ms/enablesecurefeed standAlone
+    timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
+    condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
+    displayName: Switch to Terrapin packages
+
+  - script: |
+      set -e
+      $(pwd)/build/azure-pipelines/linux/scripts/install-remote-dependencies.sh
+    displayName: Install dependencies
+    env:
+      GITHUB_TOKEN: "$(github-distro-mixin-password)"
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'x64'))
+
+  - script: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+    displayName: Register Docker QEMU
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'arm64'))
+
+  - script: |
+      set -e
+      docker run -e VSCODE_QUALITY -e GITHUB_TOKEN -v $(pwd):/root/vscode -v ~/.netrc:/root/.netrc vscodehub.azurecr.io/vscode-linux-build-agent:centos7-devtoolset8-arm64 /root/vscode/build/azure-pipelines/linux/scripts/install-remote-dependencies.sh
+    displayName: Install dependencies via qemu
+    env:
+      GITHUB_TOKEN: "$(github-distro-mixin-password)"
+    condition: and(succeeded(), eq(variables['VSCODE_ARCH'], 'arm64'))
+
+  - script: |
+      set -e
+      tar -cz --ignore-failed-read -f $(Build.ArtifactStagingDirectory)/reh_node_modules-$(VSCODE_ARCH).tar.gz -C $(Build.SourcesDirectory)/remote node_modules
+    displayName: Compress node_modules output
+
+  - task: PublishPipelineArtifact@0
+    displayName: "Publish remote node_modules"
+    inputs:
+      artifactName: "reh_node_modules-$(VSCODE_ARCH)"
+      targetPath: $(Build.ArtifactStagingDirectory)/reh_node_modules-$(VSCODE_ARCH).tar.gz

build/azure-pipelines/linux/scripts/install-remote-dependencies.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -e
+
+echo "Installing remote dependencies"
+(cd remote && rm -rf node_modules)
+
+for i in {1..3}; do # try 3 times, for Terrapin
+  yarn --cwd remote --frozen-lockfile --check-files && break
+  if [ $i -eq 3 ]; then
+    echo "Yarn failed too many times" >&2
+    exit 1
+  fi
+  echo "Yarn failed $i, trying again..."
+done

build/azure-pipelines/linux/snap-build-linux.yml

@@ -1,11 +1,7 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
-
-  - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-    inputs:
-      versionSpec: "1.x"
+      versionSpec: "16.x"
 
   - task: DownloadPipelineArtifact@0
     displayName: "Download Pipeline Artifact"
@@ -22,6 +18,13 @@ steps:
       # Make sure we get latest packages
       sudo apt-get update
       sudo apt-get upgrade -y
+      sudo apt-get install -y curl apt-transport-https ca-certificates
+
+      # Yarn
+      curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
+      echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
+      sudo apt-get update
+      sudo apt-get install -y yarn
 
       # Define variables
       REPO="$(pwd)"

build/azure-pipelines/linux/sql-product-build-linux.yml

@@ -89,7 +89,7 @@ steps:
 
   - script: |
       set -e
-      node build/azure-pipelines/mixin
+      node build/azure-pipelines/sql-mixin
     displayName: Mix in quality
 
   - script: |
@@ -120,8 +120,8 @@ steps:
   - script: |
       set -e
       DISPLAY=:10 ./scripts/test.sh --build --tfs "Unit Tests" --coverage
-    displayName: Run unit tests (Electron)
-    condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'))
+    displayName: Run core unit tests
+    condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'), ne(variables['EXTENSIONS_ONLY'], 'true'))
 
   - script: |
       # Figure out the full absolute path of the product we just built
@@ -133,8 +133,8 @@ steps:
       INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME" \
       VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/azuredatastudio-reh-linux-x64" \
       DISPLAY=:10 ./scripts/test-integration.sh --build --tfs "Integration Tests"
-    displayName: Run integration tests (Electron)
-    condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'))
+    displayName: Run core integration tests
+    condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'), ne(variables['EXTENSIONS_ONLY'], 'true'))
 
   - script: |
       # Figure out the full absolute path of the product we just built
@@ -147,18 +147,23 @@ steps:
       NO_CLEANUP=1 \
       VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/azuredatastudio-reh-linux-x64" \
       DISPLAY=:10 ./scripts/test-extensions-unit.sh --build --tfs "Extension Unit Tests"
-    displayName: 'Run Stable Extension Unit Tests'
-    condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'))
+    displayName: Run Extension Unit Tests (Continue on Error)
+    continueOnError: true
+    condition: and(succeeded(), and(eq(variables['RUN_TESTS'], 'true'), eq(variables['EXTENSION_UNIT_TESTS_FAIL_ON_ERROR'], 'false')))
 
   - script: |
+      # Figure out the full absolute path of the product we just built
+      # including the remote server and configure the unit tests
+      # to run with these builds instead of running out of sources.
       set -e
       APP_ROOT=$(agent.builddirectory)/azuredatastudio-linux-x64
       APP_NAME=$(node -p "require(\"$APP_ROOT/resources/app/product.json\").applicationName")
       INTEGRATION_TEST_ELECTRON_PATH="$APP_ROOT/$APP_NAME" \
-      DISPLAY=:10 ./scripts/test-extensions-unit-unstable.sh
-    displayName: 'Run Unstable Extension Unit Tests'
-    continueOnError: true
-    condition: and(succeeded(), eq(variables['RUN_UNSTABLE_TESTS'], 'true'))
+      NO_CLEANUP=1 \
+      VSCODE_REMOTE_SERVER_PATH="$(agent.builddirectory)/azuredatastudio-reh-linux-x64" \
+      DISPLAY=:10 ./scripts/test-extensions-unit.sh --build --tfs "Extension Unit Tests"
+    displayName: Run Extension Unit Tests (Fail on Error)
+    condition: and(succeeded(), and(eq(variables['RUN_TESTS'], 'true'), ne(variables['EXTENSION_UNIT_TESTS_FAIL_ON_ERROR'], 'false')))
 
   - bash: |
       set -e
@@ -178,11 +183,13 @@ steps:
       set -e
       yarn gulp vscode-linux-x64-build-deb
     displayName: Build Deb
+    condition: and(succeeded(), ne(variables['EXTENSIONS_ONLY'], 'true'))
 
   - script: |
       set -e
       yarn gulp vscode-linux-x64-build-rpm
     displayName: Build Rpm
+    condition: and(succeeded(), ne(variables['EXTENSIONS_ONLY'], 'true'))
 
   - task: UseDotNet@2
     displayName: 'Install .NET Core sdk for signing'

build/azure-pipelines/mixin.js

@@ -2,67 +2,85 @@
  *  Copyright (c) Microsoft Corporation. All rights reserved.
  *  Licensed under the Source EULA. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
-
 'use strict';
-
-const json = require('gulp-json-editor');
+Object.defineProperty(exports, "__esModule", { value: true });
+const json = require("gulp-json-editor");
 const buffer = require('gulp-buffer');
-const filter = require('gulp-filter');
-const es = require('event-stream');
-const vfs = require('vinyl-fs');
-const fancyLog = require('fancy-log');
-const ansiColors = require('ansi-colors');
-const fs = require('fs');
-const path = require('path');
-
-function main() {
-	const quality = process.env['VSCODE_QUALITY'];
-
-	if (!quality) {
-		console.log('Missing VSCODE_QUALITY, skipping mixin');
-		return;
-	}
-
-	const productJsonFilter = filter(f => f.relative === 'product.json', { restore: true });
-
-	fancyLog(ansiColors.blue('[mixin]'), `Mixing in sources:`);
-	return vfs
-		.src(`quality/${quality}/**`, { base: `quality/${quality}` })
-		.pipe(filter(f => !f.isDirectory()))
-		.pipe(productJsonFilter)
-		.pipe(buffer())
-		.pipe(json(o => {
-			const ossProduct = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'product.json'), 'utf8'));
-			let builtInExtensions = ossProduct.builtInExtensions;
-
-			if (Array.isArray(o.builtInExtensions)) {
-				fancyLog(ansiColors.blue('[mixin]'), 'Overwriting built-in extensions:', o.builtInExtensions.map(e => e.name));
-
-				builtInExtensions = o.builtInExtensions;
-			} else if (o.builtInExtensions) {
-				const include = o.builtInExtensions['include'] || [];
-				const exclude = o.builtInExtensions['exclude'] || [];
-
-				fancyLog(ansiColors.blue('[mixin]'), 'OSS built-in extensions:', builtInExtensions.map(e => e.name));
-				fancyLog(ansiColors.blue('[mixin]'), 'Including built-in extensions:', include.map(e => e.name));
-				fancyLog(ansiColors.blue('[mixin]'), 'Excluding built-in extensions:', exclude);
-
-				builtInExtensions = builtInExtensions.filter(ext => !include.find(e => e.name === ext.name) && !exclude.find(name => name === ext.name));
-				builtInExtensions = [...builtInExtensions, ...include];
-
-				fancyLog(ansiColors.blue('[mixin]'), 'Final built-in extensions:', builtInExtensions.map(e => e.name));
-			} else {
-				fancyLog(ansiColors.blue('[mixin]'), 'Inheriting OSS built-in extensions', builtInExtensions.map(e => e.name));
-			}
-
-			return { ...ossProduct, ...o, builtInExtensions };
-		}))
-		.pipe(productJsonFilter.restore)
-		.pipe(es.mapSync(function (f) {
-			fancyLog(ansiColors.blue('[mixin]'), f.relative, ansiColors.green('✔︎'));
-			return f;
-		}))
-		.pipe(vfs.dest('.'));
+const filter = require("gulp-filter");
+const es = require("event-stream");
+const vfs = require("vinyl-fs");
+const fancyLog = require("fancy-log");
+const ansiColors = require("ansi-colors");
+const fs = require("fs");
+const path = require("path");
+async function mixinClient(quality) {
+    const productJsonFilter = filter(f => f.relative === 'product.json', { restore: true });
+    fancyLog(ansiColors.blue('[mixin]'), `Mixing in client:`);
+    return new Promise((c, e) => {
+        vfs
+            .src(`quality/${quality}/**`, { base: `quality/${quality}` })
+            .pipe(filter(f => !f.isDirectory()))
+            .pipe(filter(f => f.relative !== 'product.server.json'))
+            .pipe(productJsonFilter)
+            .pipe(buffer())
+            .pipe(json((o) => {
+            const originalProduct = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'product.json'), 'utf8'));
+            let builtInExtensions = originalProduct.builtInExtensions;
+            if (Array.isArray(o.builtInExtensions)) {
+                fancyLog(ansiColors.blue('[mixin]'), 'Overwriting built-in extensions:', o.builtInExtensions.map(e => e.name));
+                builtInExtensions = o.builtInExtensions;
+            }
+            else if (o.builtInExtensions) {
+                const include = o.builtInExtensions['include'] || [];
+                const exclude = o.builtInExtensions['exclude'] || [];
+                fancyLog(ansiColors.blue('[mixin]'), 'OSS built-in extensions:', builtInExtensions.map(e => e.name));
+                fancyLog(ansiColors.blue('[mixin]'), 'Including built-in extensions:', include.map(e => e.name));
+                fancyLog(ansiColors.blue('[mixin]'), 'Excluding built-in extensions:', exclude);
+                builtInExtensions = builtInExtensions.filter(ext => !include.find(e => e.name === ext.name) && !exclude.find(name => name === ext.name));
+                builtInExtensions = [...builtInExtensions, ...include];
+                fancyLog(ansiColors.blue('[mixin]'), 'Final built-in extensions:', builtInExtensions.map(e => e.name));
+            }
+            else {
+                fancyLog(ansiColors.blue('[mixin]'), 'Inheriting OSS built-in extensions', builtInExtensions.map(e => e.name));
+            }
+            return Object.assign(Object.assign({ webBuiltInExtensions: originalProduct.webBuiltInExtensions }, o), { builtInExtensions });
+        }))
+            .pipe(productJsonFilter.restore)
+            .pipe(es.mapSync((f) => {
+            fancyLog(ansiColors.blue('[mixin]'), f.relative, ansiColors.green('✔︎'));
+            return f;
+        }))
+            .pipe(vfs.dest('.'))
+            .on('end', () => c())
+            .on('error', (err) => e(err));
+    });
+}
+function mixinServer(quality) {
+    const serverProductJsonPath = `quality/${quality}/product.server.json`;
+    if (!fs.existsSync(serverProductJsonPath)) {
+        fancyLog(ansiColors.blue('[mixin]'), `Server product not found`, serverProductJsonPath);
+        return;
+    }
+    fancyLog(ansiColors.blue('[mixin]'), `Mixing in server:`);
+    const originalProduct = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'product.json'), 'utf8'));
+    const serverProductJson = JSON.parse(fs.readFileSync(serverProductJsonPath, 'utf8'));
+    fs.writeFileSync('product.json', JSON.stringify(Object.assign(Object.assign({}, originalProduct), serverProductJson), undefined, '\t'));
+    fancyLog(ansiColors.blue('[mixin]'), 'product.json', ansiColors.green('✔︎'));
+}
+function main() {
+    const quality = process.env['VSCODE_QUALITY'];
+    if (!quality) {
+        console.log('Missing VSCODE_QUALITY, skipping mixin');
+        return;
+    }
+    if (process.argv[2] === '--server') {
+        mixinServer(quality);
+    }
+    else {
+        mixinClient(quality).catch(err => {
+            console.error(err);
+            process.exit(1);
+        });
+    }
 }
-
 main();

build/azure-pipelines/mixin.ts

@@ -0,0 +1,119 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as json from 'gulp-json-editor';
+const buffer = require('gulp-buffer');
+import * as filter from 'gulp-filter';
+import * as es from 'event-stream';
+import * as Vinyl from 'vinyl';
+import * as vfs from 'vinyl-fs';
+import * as fancyLog from 'fancy-log';
+import * as ansiColors from 'ansi-colors';
+import * as fs from 'fs';
+import * as path from 'path';
+
+interface IBuiltInExtension {
+	readonly name: string;
+	readonly version: string;
+	readonly repo: string;
+	readonly metadata: any;
+}
+
+interface OSSProduct {
+	readonly builtInExtensions: IBuiltInExtension[];
+	readonly webBuiltInExtensions?: IBuiltInExtension[];
+}
+
+interface Product {
+	readonly builtInExtensions?: IBuiltInExtension[] | { 'include'?: IBuiltInExtension[]; 'exclude'?: string[] };
+	readonly webBuiltInExtensions?: IBuiltInExtension[];
+}
+
+async function mixinClient(quality: string): Promise<void> {
+	const productJsonFilter = filter(f => f.relative === 'product.json', { restore: true });
+
+	fancyLog(ansiColors.blue('[mixin]'), `Mixing in client:`);
+
+	return new Promise((c, e) => {
+		vfs
+			.src(`quality/${quality}/**`, { base: `quality/${quality}` })
+			.pipe(filter(f => !f.isDirectory()))
+			.pipe(filter(f => f.relative !== 'product.server.json'))
+			.pipe(productJsonFilter)
+			.pipe(buffer())
+			.pipe(json((o: Product) => {
+				const originalProduct = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'product.json'), 'utf8')) as OSSProduct;
+				let builtInExtensions = originalProduct.builtInExtensions;
+
+				if (Array.isArray(o.builtInExtensions)) {
+					fancyLog(ansiColors.blue('[mixin]'), 'Overwriting built-in extensions:', o.builtInExtensions.map(e => e.name));
+
+					builtInExtensions = o.builtInExtensions;
+				} else if (o.builtInExtensions) {
+					const include = o.builtInExtensions['include'] || [];
+					const exclude = o.builtInExtensions['exclude'] || [];
+
+					fancyLog(ansiColors.blue('[mixin]'), 'OSS built-in extensions:', builtInExtensions.map(e => e.name));
+					fancyLog(ansiColors.blue('[mixin]'), 'Including built-in extensions:', include.map(e => e.name));
+					fancyLog(ansiColors.blue('[mixin]'), 'Excluding built-in extensions:', exclude);
+
+					builtInExtensions = builtInExtensions.filter(ext => !include.find(e => e.name === ext.name) && !exclude.find(name => name === ext.name));
+					builtInExtensions = [...builtInExtensions, ...include];
+
+					fancyLog(ansiColors.blue('[mixin]'), 'Final built-in extensions:', builtInExtensions.map(e => e.name));
+				} else {
+					fancyLog(ansiColors.blue('[mixin]'), 'Inheriting OSS built-in extensions', builtInExtensions.map(e => e.name));
+				}
+
+				return { webBuiltInExtensions: originalProduct.webBuiltInExtensions, ...o, builtInExtensions };
+			}))
+			.pipe(productJsonFilter.restore)
+			.pipe(es.mapSync((f: Vinyl) => {
+				fancyLog(ansiColors.blue('[mixin]'), f.relative, ansiColors.green('✔︎'));
+				return f;
+			}))
+			.pipe(vfs.dest('.'))
+			.on('end', () => c())
+			.on('error', (err: any) => e(err));
+	});
+}
+
+function mixinServer(quality: string) {
+	const serverProductJsonPath = `quality/${quality}/product.server.json`;
+
+	if (!fs.existsSync(serverProductJsonPath)) {
+		fancyLog(ansiColors.blue('[mixin]'), `Server product not found`, serverProductJsonPath);
+		return;
+	}
+
+	fancyLog(ansiColors.blue('[mixin]'), `Mixing in server:`);
+
+	const originalProduct = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'product.json'), 'utf8')) as OSSProduct;
+	const serverProductJson = JSON.parse(fs.readFileSync(serverProductJsonPath, 'utf8'));
+	fs.writeFileSync('product.json', JSON.stringify({ ...originalProduct, ...serverProductJson }, undefined, '\t'));
+	fancyLog(ansiColors.blue('[mixin]'), 'product.json', ansiColors.green('✔︎'));
+}
+
+function main() {
+	const quality = process.env['VSCODE_QUALITY'];
+
+	if (!quality) {
+		console.log('Missing VSCODE_QUALITY, skipping mixin');
+		return;
+	}
+
+	if (process.argv[2] === '--server') {
+		mixinServer(quality);
+	} else {
+		mixinClient(quality).catch(err => {
+			console.error(err);
+			process.exit(1);
+		});
+	}
+}
+
+main();

build/azure-pipelines/product-build.yml

@@ -9,6 +9,10 @@ schedules:
         - joao/web
 
 parameters:
+  - name: VSCODE_DISTRO_REF
+    displayName: Distro Ref (Private build)
+    type: string
+    default: " "
   - name: VSCODE_QUALITY
     displayName: Quality
     type: string
@@ -73,6 +77,10 @@ parameters:
     displayName: "Publish to builds.code.visualstudio.com"
     type: boolean
     default: true
+  - name: VSCODE_PUBLISH_TO_MOONCAKE
+    displayName: "Publish to Azure China"
+    type: boolean
+    default: true
   - name: VSCODE_RELEASE
     displayName: "Release build if successful"
     type: boolean
@@ -87,12 +95,12 @@ parameters:
     default: false
 
 variables:
+  - name: VSCODE_DISTRO_REF
+    value: ${{ parameters.VSCODE_DISTRO_REF }}
   - name: ENABLE_TERRAPIN
     value: ${{ eq(parameters.ENABLE_TERRAPIN, true) }}
   - name: VSCODE_QUALITY
     value: ${{ parameters.VSCODE_QUALITY }}
-  - name: VSCODE_RELEASE
-    value: ${{ parameters.VSCODE_RELEASE }}
   - name: VSCODE_BUILD_STAGE_WINDOWS
     value: ${{ or(eq(parameters.VSCODE_BUILD_WIN32, true), eq(parameters.VSCODE_BUILD_WIN32_32BIT, true), eq(parameters.VSCODE_BUILD_WIN32_ARM64, true)) }}
   - name: VSCODE_BUILD_STAGE_LINUX
@@ -103,30 +111,30 @@ variables:
     value: ${{ in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI') }}
   - name: VSCODE_PUBLISH
     value: ${{ and(eq(parameters.VSCODE_PUBLISH, true), eq(variables.VSCODE_CIBUILD, false)) }}
+  - name: VSCODE_PUBLISH_TO_MOONCAKE
+    value: ${{ eq(parameters.VSCODE_PUBLISH_TO_MOONCAKE, true) }}
   - name: VSCODE_SCHEDULEDBUILD
     value: ${{ eq(variables['Build.Reason'], 'Schedule') }}
   - name: VSCODE_STEP_ON_IT
     value: ${{ eq(parameters.VSCODE_STEP_ON_IT, true) }}
   - name: VSCODE_BUILD_MACOS_UNIVERSAL
-    value: ${{ and(eq(variables['VSCODE_PUBLISH'], true), eq(parameters.VSCODE_BUILD_MACOS, true), eq(parameters.VSCODE_BUILD_MACOS_ARM64, true), eq(parameters.VSCODE_BUILD_MACOS_UNIVERSAL, true)) }}
+    value: ${{ and(eq(parameters.VSCODE_BUILD_MACOS, true), eq(parameters.VSCODE_BUILD_MACOS_ARM64, true), eq(parameters.VSCODE_BUILD_MACOS_UNIVERSAL, true)) }}
   - name: AZURE_CDN_URL
     value: https://az764295.vo.msecnd.net
   - name: AZURE_DOCUMENTDB_ENDPOINT
     value: https://vscode.documents.azure.com:443/
-  - name: AZURE_STORAGE_ACCOUNT
-    value: ticino
-  - name: AZURE_STORAGE_ACCOUNT_2
-    value: vscode
   - name: MOONCAKE_CDN_URL
     value: https://vscode.cdn.azure.cn
   - name: VSCODE_MIXIN_REPO
     value: microsoft/vscode-distro
   - name: skipComponentGovernanceDetection
     value: true
+  - name: Codeql.SkipTaskAutoInjection
+    value: true
 
 resources:
   containers:
-    - container: vscode-x64
+    - container: vscode-bionic-x64
       image: vscodehub.azurecr.io/vscode-linux-build-agent:bionic-x64
       endpoint: VSCodeHub
       options: --user 0:0 --cap-add SYS_ADMIN
@@ -138,6 +146,10 @@ resources:
       image: vscodehub.azurecr.io/vscode-linux-build-agent:stretch-armhf
       endpoint: VSCodeHub
       options: --user 0:0 --cap-add SYS_ADMIN
+    - container: centos7-devtoolset8-x64
+      image: vscodehub.azurecr.io/vscode-linux-build-agent:centos7-devtoolset8-x64
+      endpoint: VSCodeHub
+      options: --user 0:0 --cap-add SYS_ADMIN
     - container: snapcraft
       image: snapcore/snapcraft:stable
 
@@ -145,219 +157,243 @@ stages:
   - stage: Compile
     jobs:
       - job: Compile
-        pool: vscode-1es
+        pool: vscode-1es-linux
         variables:
           VSCODE_ARCH: x64
         steps:
           - template: product-compile.yml
 
   - ${{ if and(eq(parameters.VSCODE_COMPILE_ONLY, false), eq(variables['VSCODE_BUILD_STAGE_WINDOWS'], true)) }}:
-    - stage: Windows
-      dependsOn:
-        - Compile
-      pool:
-        vmImage: VS2017-Win2016
-      jobs:
+      - stage: Windows
+        dependsOn:
+          - Compile
+        pool: vscode-1es-windows
+        jobs:
+          - ${{ if eq(parameters.VSCODE_BUILD_WIN32, true) }}:
+              - job: Windows
+                timeoutInMinutes: 120
+                variables:
+                  VSCODE_ARCH: x64
+                steps:
+                  - template: win32/product-build-win32.yml
 
-        - ${{ if eq(parameters.VSCODE_BUILD_WIN32, true) }}:
-          - job: Windows
-            timeoutInMinutes: 90
-            variables:
-              VSCODE_ARCH: x64
-            steps:
-              - template: win32/product-build-win32.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_WIN32_32BIT, true)) }}:
+              - job: Windows32
+                timeoutInMinutes: 120
+                variables:
+                  VSCODE_ARCH: ia32
+                steps:
+                  - template: win32/product-build-win32.yml
 
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_WIN32_32BIT, true)) }}:
-          - job: Windows32
-            timeoutInMinutes: 90
-            variables:
-              VSCODE_ARCH: ia32
-            steps:
-              - template: win32/product-build-win32.yml
-
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_WIN32_ARM64, true)) }}:
-          - job: WindowsARM64
-            timeoutInMinutes: 90
-            variables:
-              VSCODE_ARCH: arm64
-            steps:
-              - template: win32/product-build-win32.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_WIN32_ARM64, true)) }}:
+              - job: WindowsARM64
+                timeoutInMinutes: 90
+                variables:
+                  VSCODE_ARCH: arm64
+                steps:
+                  - template: win32/product-build-win32.yml
 
   - ${{ if and(eq(parameters.VSCODE_COMPILE_ONLY, false), eq(variables['VSCODE_BUILD_STAGE_LINUX'], true)) }}:
-    - stage: Linux
-      dependsOn:
-        - Compile
-      pool:
-        vmImage: "Ubuntu-18.04"
-      jobs:
+      - stage: LinuxServerDependencies
+        dependsOn: [] # run in parallel to compile stage
+        pool: vscode-1es-linux
+        jobs:
+          - ${{ if eq(parameters.VSCODE_BUILD_LINUX, true) }}:
+              - job: x64
+                container: centos7-devtoolset8-x64
+                variables:
+                  VSCODE_ARCH: x64
+                  NPM_ARCH: x64
+                steps:
+                  - template: linux/product-build-linux-server.yml
 
-        - ${{ if eq(parameters.VSCODE_BUILD_LINUX, true) }}:
-          - job: Linux
-            container: vscode-x64
-            variables:
-              VSCODE_ARCH: x64
-              NPM_ARCH: x64
-              DISPLAY: ":10"
-            steps:
-              - template: linux/product-build-linux.yml
+          - ${{ if eq(parameters.VSCODE_BUILD_LINUX, true) }}:
+              - job: arm64
+                variables:
+                  VSCODE_ARCH: arm64
+                steps:
+                  - template: linux/product-build-linux-server.yml
 
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX, true), ne(variables['VSCODE_PUBLISH'], 'false')) }}:
-          - job: LinuxSnap
-            dependsOn:
-              - Linux
-            container: snapcraft
-            variables:
-              VSCODE_ARCH: x64
-            steps:
-              - template: linux/snap-build-linux.yml
+  - ${{ if and(eq(parameters.VSCODE_COMPILE_ONLY, false), eq(variables['VSCODE_BUILD_STAGE_LINUX'], true)) }}:
+      - stage: Linux
+        dependsOn:
+          - Compile
+          - LinuxServerDependencies
+        pool: vscode-1es-linux
+        jobs:
+          - ${{ if eq(parameters.VSCODE_BUILD_LINUX, true) }}:
+              - job: Linuxx64
+                container: vscode-bionic-x64
+                variables:
+                  VSCODE_ARCH: x64
+                  NPM_ARCH: x64
+                  DISPLAY: ":10"
+                steps:
+                  - template: linux/product-build-linux-client.yml
 
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ARMHF, true)) }}:
-          - job: LinuxArmhf
-            container: vscode-armhf
-            variables:
-              VSCODE_ARCH: armhf
-              NPM_ARCH: armv7l
-            steps:
-              - template: linux/product-build-linux.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX, true), ne(variables['VSCODE_PUBLISH'], 'false')) }}:
+              - job: LinuxSnap
+                dependsOn:
+                  - Linuxx64
+                container: snapcraft
+                variables:
+                  VSCODE_ARCH: x64
+                steps:
+                  - template: linux/snap-build-linux.yml
 
-        # TODO@joaomoreno: We don't ship ARM snaps for now
-        - ${{ if and(false, eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ARMHF, true)) }}:
-          - job: LinuxSnapArmhf
-            dependsOn:
-              - LinuxArmhf
-            container: snapcraft
-            variables:
-              VSCODE_ARCH: armhf
-            steps:
-              - template: linux/snap-build-linux.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ARMHF, true)) }}:
+              - job: LinuxArmhf
+                container: vscode-armhf
+                variables:
+                  VSCODE_ARCH: armhf
+                  NPM_ARCH: armv7l
+                steps:
+                  - template: linux/product-build-linux-client.yml
 
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ARM64, true)) }}:
-          - job: LinuxArm64
-            container: vscode-arm64
-            variables:
-              VSCODE_ARCH: arm64
-              NPM_ARCH: arm64
-            steps:
-              - template: linux/product-build-linux.yml
+          # TODO@joaomoreno: We don't ship ARM snaps for now
+          - ${{ if and(false, eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ARMHF, true)) }}:
+              - job: LinuxSnapArmhf
+                dependsOn:
+                  - LinuxArmhf
+                container: snapcraft
+                variables:
+                  VSCODE_ARCH: armhf
+                steps:
+                  - template: linux/snap-build-linux.yml
 
-        # TODO@joaomoreno: We don't ship ARM snaps for now
-        - ${{ if and(false, eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ARM64, true)) }}:
-          - job: LinuxSnapArm64
-            dependsOn:
-              - LinuxArm64
-            container: snapcraft
-            variables:
-              VSCODE_ARCH: arm64
-            steps:
-              - template: linux/snap-build-linux.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ARM64, true)) }}:
+              - job: LinuxArm64
+                container: vscode-arm64
+                variables:
+                  VSCODE_ARCH: arm64
+                  NPM_ARCH: arm64
+                steps:
+                  - template: linux/product-build-linux-client.yml
 
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ALPINE, true)) }}:
-          - job: LinuxAlpine
-            variables:
-              VSCODE_ARCH: x64
-            steps:
-              - template: linux/product-build-alpine.yml
+          # TODO@joaomoreno: We don't ship ARM snaps for now
+          - ${{ if and(false, eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ARM64, true)) }}:
+              - job: LinuxSnapArm64
+                dependsOn:
+                  - LinuxArm64
+                container: snapcraft
+                variables:
+                  VSCODE_ARCH: arm64
+                steps:
+                  - template: linux/snap-build-linux.yml
 
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ALPINE_ARM64, true)) }}:
-          - job: LinuxAlpineArm64
-            variables:
-              VSCODE_ARCH: arm64
-            steps:
-              - template: linux/product-build-alpine.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ALPINE, true)) }}:
+              - job: LinuxAlpine
+                variables:
+                  VSCODE_ARCH: x64
+                steps:
+                  - template: linux/product-build-alpine.yml
 
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_WEB, true)) }}:
-          - job: LinuxWeb
-            variables:
-              VSCODE_ARCH: x64
-            steps:
-              - template: web/product-build-web.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_LINUX_ALPINE_ARM64, true)) }}:
+              - job: LinuxAlpineArm64
+                timeoutInMinutes: 120
+                variables:
+                  VSCODE_ARCH: arm64
+                steps:
+                  - template: linux/product-build-alpine.yml
+
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_WEB, true)) }}:
+              - job: LinuxWeb
+                variables:
+                  VSCODE_ARCH: x64
+                steps:
+                  - template: web/product-build-web.yml
 
   - ${{ if and(eq(parameters.VSCODE_COMPILE_ONLY, false), eq(variables['VSCODE_BUILD_STAGE_MACOS'], true)) }}:
-    - stage: macOS
-      dependsOn:
-        - Compile
-      pool:
-        vmImage: macOS-latest
-      jobs:
+      - stage: macOS
+        dependsOn:
+          - Compile
+        pool:
+          vmImage: macOS-latest
+        variables:
+          BUILDSECMON_OPT_IN: true
+        jobs:
+          - ${{ if eq(parameters.VSCODE_BUILD_MACOS, true) }}:
+              - job: macOSTest
+                timeoutInMinutes: 90
+                variables:
+                  VSCODE_ARCH: x64
+                steps:
+                  - template: darwin/product-build-darwin-test.yml
+              - ${{ if eq(variables['VSCODE_CIBUILD'], false) }}:
+                  - job: macOS
+                    timeoutInMinutes: 90
+                    variables:
+                      VSCODE_ARCH: x64
+                    steps:
+                      - template: darwin/product-build-darwin.yml
+                  - job: macOSSign
+                    dependsOn:
+                      - macOS
+                    timeoutInMinutes: 90
+                    variables:
+                      VSCODE_ARCH: x64
+                    steps:
+                      - template: darwin/product-build-darwin-sign.yml
 
-        - ${{ if eq(parameters.VSCODE_BUILD_MACOS, true) }}:
-          - job: macOS
-            timeoutInMinutes: 90
-            variables:
-              VSCODE_ARCH: x64
-            steps:
-              - template: darwin/product-build-darwin.yml
-          - ${{ if ne(variables['VSCODE_PUBLISH'], 'false') }}:
-            - job: macOSSign
-              dependsOn:
-                - macOS
-              timeoutInMinutes: 90
-              variables:
-                VSCODE_ARCH: x64
-              steps:
-                - template: darwin/product-build-darwin-sign.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_MACOS_ARM64, true)) }}:
+              - job: macOSARM64
+                timeoutInMinutes: 90
+                variables:
+                  VSCODE_ARCH: arm64
+                steps:
+                  - template: darwin/product-build-darwin.yml
+              - ${{ if eq(variables['VSCODE_CIBUILD'], false) }}:
+                  - job: macOSARM64Sign
+                    dependsOn:
+                      - macOSARM64
+                    timeoutInMinutes: 90
+                    variables:
+                      VSCODE_ARCH: arm64
+                    steps:
+                      - template: darwin/product-build-darwin-sign.yml
 
-        - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(parameters.VSCODE_BUILD_MACOS_ARM64, true)) }}:
-          - job: macOSARM64
-            timeoutInMinutes: 90
-            variables:
-              VSCODE_ARCH: arm64
-            steps:
-              - template: darwin/product-build-darwin.yml
-          - ${{ if ne(variables['VSCODE_PUBLISH'], 'false') }}:
-            - job: macOSARM64Sign
-              dependsOn:
-                - macOSARM64
-              timeoutInMinutes: 90
-              variables:
-                VSCODE_ARCH: arm64
-              steps:
-                - template: darwin/product-build-darwin-sign.yml
-
-        - ${{ if eq(variables['VSCODE_BUILD_MACOS_UNIVERSAL'], true) }}:
-          - job: macOSUniversal
-            dependsOn:
-              - macOS
-              - macOSARM64
-            timeoutInMinutes: 90
-            variables:
-              VSCODE_ARCH: universal
-            steps:
-              - template: darwin/product-build-darwin.yml
-          - ${{ if ne(variables['VSCODE_PUBLISH'], 'false') }}:
-            - job: macOSUniversalSign
-              dependsOn:
-                - macOSUniversal
-              timeoutInMinutes: 90
-              variables:
-                VSCODE_ARCH: universal
-              steps:
-                - template: darwin/product-build-darwin-sign.yml
+          - ${{ if and(eq(variables['VSCODE_CIBUILD'], false), eq(variables['VSCODE_BUILD_MACOS_UNIVERSAL'], true)) }}:
+              - job: macOSUniversal
+                dependsOn:
+                  - macOS
+                  - macOSARM64
+                timeoutInMinutes: 90
+                variables:
+                  VSCODE_ARCH: universal
+                steps:
+                  - template: darwin/product-build-darwin-universal.yml
+              - ${{ if eq(variables['VSCODE_CIBUILD'], false) }}:
+                  - job: macOSUniversalSign
+                    dependsOn:
+                      - macOSUniversal
+                    timeoutInMinutes: 90
+                    variables:
+                      VSCODE_ARCH: universal
+                    steps:
+                      - template: darwin/product-build-darwin-sign.yml
 
   - ${{ if and(eq(parameters.VSCODE_COMPILE_ONLY, false), ne(variables['VSCODE_PUBLISH'], 'false')) }}:
-    - stage: Publish
-      dependsOn:
-        - Compile
-      pool:
-        vmImage: "Ubuntu-18.04"
-      variables:
-        - name: BUILDS_API_URL
-          value: $(System.CollectionUri)$(System.TeamProject)/_apis/build/builds/$(Build.BuildId)/
-      jobs:
-        - job: PublishBuild
-          timeoutInMinutes: 180
-          displayName: Publish Build
-          steps:
-            - template: product-publish.yml
-
-    - ${{ if or(eq(parameters.VSCODE_RELEASE, true), and(in(parameters.VSCODE_QUALITY, 'insider', 'exploration'), eq(variables['VSCODE_SCHEDULEDBUILD'], true))) }}:
-      - stage: Release
+      - stage: Publish
         dependsOn:
-          - Publish
-        pool:
-          vmImage: "Ubuntu-18.04"
+          - Compile
+        pool: vscode-1es-linux
+        variables:
+          - name: BUILDS_API_URL
+            value: $(System.CollectionUri)$(System.TeamProject)/_apis/build/builds/$(Build.BuildId)/
         jobs:
-          - job: ReleaseBuild
-            displayName: Release Build
+          - job: PublishBuild
+            timeoutInMinutes: 180
+            displayName: Publish Build
             steps:
-              - template: product-release.yml
+              - template: product-publish.yml
+
+      - ${{ if or(and(parameters.VSCODE_RELEASE, eq(parameters.VSCODE_DISTRO_REF, ' ')), and(in(parameters.VSCODE_QUALITY, 'insider', 'exploration'), eq(variables['VSCODE_SCHEDULEDBUILD'], true))) }}:
+          - stage: Release
+            dependsOn:
+              - Publish
+            pool: vscode-1es-linux
+            jobs:
+              - job: ReleaseBuild
+                displayName: Release Build
+                steps:
+                  - template: product-release.yml

build/azure-pipelines/product-compile.yml

@@ -1,18 +1,14 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
-
-  - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-    inputs:
-      versionSpec: "1.x"
+      versionSpec: "16.x"
 
   - task: AzureKeyVault@1
     displayName: "Azure Key Vault: Get Secrets"
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: 'github-distro-mixin-password,ticino-storage-key'
+      SecretsFilter: "github-distro-mixin-password"
 
   - script: |
       set -e
@@ -26,6 +22,14 @@ steps:
       git config user.name "VSCode"
     displayName: Prepare tooling
 
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
   - script: |
       set -e
       git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
@@ -54,6 +58,7 @@ steps:
       set -e
       npx https://aka.ms/enablesecurefeed standAlone
     timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
     displayName: Switch to Terrapin packages
 
@@ -67,7 +72,7 @@ steps:
   - script: |
       set -e
       for i in {1..3}; do # try 3 times, for Terrapin
-        yarn --frozen-lockfile && break
+        yarn --frozen-lockfile --check-files && break
         if [ $i -eq 3 ]; then
           echo "Yarn failed too many times" >&2
           exit 1
@@ -98,6 +103,8 @@ steps:
   - script: |
       set -e
       yarn npm-run-all -lp core-ci extensions-ci hygiene eslint valid-layers-check
+    env:
+      GITHUB_TOKEN: "$(github-distro-mixin-password)"
     displayName: Compile & Hygiene
 
   - script: |
@@ -107,9 +114,23 @@ steps:
     displayName: Compile test suites
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
+  - task: AzureCLI@2
+    inputs:
+      azureSubscription: "vscode-builds-subscription"
+      scriptType: pscore
+      scriptLocation: inlineScript
+      addSpnToEnvironment: true
+      inlineScript: |
+        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
+
   - script: |
       set -e
-      AZURE_STORAGE_ACCESS_KEY="$(ticino-storage-key)" \
+      AZURE_STORAGE_ACCOUNT="ticino" \
+      AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
+      AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
+      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
         node build/azure-pipelines/upload-sourcemaps
     displayName: Upload sourcemaps
     condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))

build/azure-pipelines/product-onebranch.yml

@@ -0,0 +1,46 @@
+trigger: none
+pr: none
+
+variables:
+  LinuxContainerImage: "onebranch.azurecr.io/linux/ubuntu-2004:latest"
+
+resources:
+  repositories:
+    - repository: templates
+      type: git
+      name: OneBranch.Pipelines/GovernedTemplates
+      ref: refs/heads/main
+
+    - repository: distro
+      type: github
+      name: microsoft/vscode-distro
+      ref: refs/heads/distro
+      endpoint: Monaco
+
+extends:
+  template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates
+  parameters:
+    git:
+      fetchDepth: 1
+      lfs: true
+      retryCount: 3
+
+    globalSdl:
+      policheck:
+        break: true
+      credscan:
+        suppressionsFile: $(Build.SourcesDirectory)\build\azure-pipelines\config\CredScanSuppressions.json
+
+    stages:
+    - stage: Compile
+
+      jobs:
+      - job: Compile
+        pool:
+          type: linux
+
+        variables:
+          ob_outputDirectory: '$(Build.SourcesDirectory)'
+
+        steps:
+        - checkout: distro

build/azure-pipelines/product-publish.ps1

@@ -15,7 +15,7 @@ function Get-PipelineArtifact {
 			return
 		}
 
-		$res.value | Where-Object { $_.name -Like $Name }
+		$res.value | Where-Object { $_.name -Like $Name -and $_.name -NotLike "*sbom" }
 	} catch {
 		Write-Warning $_
 	}
@@ -29,8 +29,8 @@ if (Test-Path $ARTIFACT_PROCESSED_WILDCARD_PATH) {
 	# This means that the latest artifact_processed_*.txt file has all of the contents of the previous ones.
 	# Note: The kusto-like syntax only works in PS7+ and only in scripts, not at the REPL.
 	Get-ChildItem $ARTIFACT_PROCESSED_WILDCARD_PATH
-		| Sort-Object
-		| Select-Object -Last 1
+		# Sort by file name length first and then Name to make sure we sort numerically. Ex. 12 comes after 9.
+		| Sort-Object { $_.Name.Length },Name -Bottom 1
 		| Get-Content
 		| ForEach-Object {
 			$set.Add($_) | Out-Null

build/azure-pipelines/product-publish.yml

@@ -1,29 +1,72 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "12.x"
-
-  - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-    inputs:
-      versionSpec: "1.x"
+      versionSpec: "16.x"
 
   - task: AzureKeyVault@1
     displayName: "Azure Key Vault: Get Secrets"
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: 'builds-docdb-key-readwrite,github-distro-mixin-password,ticino-storage-key,vscode-storage-key,vscode-mooncake-storage-key'
+      SecretsFilter: "github-distro-mixin-password"
+
+  - script: |
+      set -e
+      cat << EOF > ~/.netrc
+      machine github.com
+      login vscode
+      password $(github-distro-mixin-password)
+      EOF
+
+      git config user.email "vscode@microsoft.com"
+      git config user.name "VSCode"
+    displayName: Prepare tooling
+
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
+  - script: |
+      set -e
+      git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
+    displayName: Merge distro
 
   - pwsh: |
       . build/azure-pipelines/win32/exec.ps1
       cd build
       exec { yarn }
-    displayName: Install dependencies
+    displayName: Install build dependencies
 
   - download: current
-    patterns: '**/artifacts_processed_*.txt'
+    patterns: "**/artifacts_processed_*.txt"
     displayName: Download all artifacts_processed text files
 
+  - task: AzureCLI@2
+    inputs:
+      azureSubscription: "vscode-builds-subscription"
+      scriptType: pscore
+      scriptLocation: inlineScript
+      addSpnToEnvironment: true
+      inlineScript: |
+        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
+
+  - task: AzureCLI@2
+    inputs:
+      azureSubscription: "vscode-builds-mooncake-subscription"
+      scriptType: pscore
+      scriptLocation: inlineScript
+      addSpnToEnvironment: true
+      inlineScript: |
+        Write-Host "##vso[task.setvariable variable=AZURE_MOONCAKE_TENANT_ID]$env:tenantId"
+        Write-Host "##vso[task.setvariable variable=AZURE_MOONCAKE_CLIENT_ID]$env:servicePrincipalId"
+        Write-Host "##vso[task.setvariable variable=AZURE_MOONCAKE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
+
   - pwsh: |
       . build/azure-pipelines/win32/exec.ps1
 
@@ -32,7 +75,9 @@ steps:
         return
       }
 
-      $env:AZURE_DOCUMENTDB_MASTERKEY = "$(builds-docdb-key-readwrite)"
+      $env:AZURE_TENANT_ID = "$(AZURE_TENANT_ID)"
+      $env:AZURE_CLIENT_ID = "$(AZURE_CLIENT_ID)"
+      $env:AZURE_CLIENT_SECRET = "$(AZURE_CLIENT_SECRET)"
       $VERSION = node -p "require('./package.json').version"
       Write-Host "Creating build with version: $VERSION"
       exec { node build/azure-pipelines/common/createBuild.js $VERSION }
@@ -40,10 +85,12 @@ steps:
 
   - pwsh: |
       $env:VSCODE_MIXIN_PASSWORD = "$(github-distro-mixin-password)"
-      $env:AZURE_DOCUMENTDB_MASTERKEY = "$(builds-docdb-key-readwrite)"
-      $env:AZURE_STORAGE_ACCESS_KEY = "$(ticino-storage-key)"
-      $env:AZURE_STORAGE_ACCESS_KEY_2 = "$(vscode-storage-key)"
-      $env:MOONCAKE_STORAGE_ACCESS_KEY = "$(vscode-mooncake-storage-key)"
+      $env:AZURE_TENANT_ID = "$(AZURE_TENANT_ID)"
+      $env:AZURE_CLIENT_ID = "$(AZURE_CLIENT_ID)"
+      $env:AZURE_CLIENT_SECRET = "$(AZURE_CLIENT_SECRET)"
+      $env:AZURE_MOONCAKE_TENANT_ID = "$(AZURE_MOONCAKE_TENANT_ID)"
+      $env:AZURE_MOONCAKE_CLIENT_ID = "$(AZURE_MOONCAKE_CLIENT_ID)"
+      $env:AZURE_MOONCAKE_CLIENT_SECRET = "$(AZURE_MOONCAKE_CLIENT_SECRET)"
       build/azure-pipelines/product-publish.ps1
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)

build/azure-pipelines/product-release.yml

@@ -1,23 +1,23 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
+      versionSpec: "16.x"
 
-  - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-    inputs:
-      versionSpec: "1.x"
-
-  - task: AzureKeyVault@1
-    displayName: "Azure Key Vault: Get Secrets"
+  - task: AzureCLI@2
     inputs:
       azureSubscription: "vscode-builds-subscription"
-      KeyVaultName: vscode
-      SecretsFilter: 'builds-docdb-key-readwrite'
+      scriptType: pscore
+      scriptLocation: inlineScript
+      addSpnToEnvironment: true
+      inlineScript: |
+        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
 
   - script: |
       set -e
-
       (cd build ; yarn)
-
-      AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \
+      AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
+      AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
+      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
       node build/azure-pipelines/common/releaseBuild.js

build/azure-pipelines/publish-types/publish-types.yml

@@ -2,7 +2,7 @@
 
 trigger:
   branches:
-    include: ["refs/tags/*"]
+    include: ["refs/tags/*.0"] # {{SQL CARBON EDIT}} Only run on major version releases
 
 pr: none
 
@@ -12,7 +12,7 @@ pool:
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
+      versionSpec: "16.x"
 
   - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@3
     inputs:
@@ -20,7 +20,7 @@ steps:
 
   # - bash: |
   #     TAG_VERSION=$(git describe --tags `git rev-list --tags --max-count=1`)
-  #     CHANNEL="G1C14HJ2F"
+  #    CHANNEL="G1C14HJ2F"
 
   #     if [ "$TAG_VERSION" == "1.999.0" ]; then
   #       MESSAGE="<!here>. Someone pushed 1.999.0 tag. Please delete it ASAP from remote and local."

build/azure-pipelines/sdl-scan.yml

@@ -32,209 +32,223 @@ variables:
     value: x64
 
 stages:
-- stage: Windows
-  condition: eq(variables.SCAN_WINDOWS, 'true')
-  pool:
-    vmImage: VS2017-Win2016
-  jobs:
-    - job: WindowsJob
-      timeoutInMinutes: 0
-      steps:
-      - task: CredScan@3
-        continueOnError: true
-        inputs:
-          scanFolder: '$(Build.SourcesDirectory)'
-          outputFormat: 'pre'
-      - task: NodeTool@0
-        inputs:
-          versionSpec: "14.x"
+  - stage: Windows
+    condition: eq(variables.SCAN_WINDOWS, 'true')
+    pool:
+      vmImage: windows-latest
+    jobs:
+      - job: WindowsJob
+        timeoutInMinutes: 0
+        steps:
+          - task: CredScan@3
+            continueOnError: true
+            inputs:
+              scanFolder: "$(Build.SourcesDirectory)"
+              outputFormat: "pre"
+          - task: NodeTool@0
+            inputs:
+              versionSpec: "16.x"
 
-      - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-        inputs:
-          versionSpec: "1.x"
+          - task: AzureKeyVault@1
+            displayName: "Azure Key Vault: Get Secrets"
+            inputs:
+              azureSubscription: "vscode-builds-subscription"
+              KeyVaultName: vscode
+              SecretsFilter: "github-distro-mixin-password"
 
-      - task: AzureKeyVault@1
-        displayName: "Azure Key Vault: Get Secrets"
-        inputs:
-          azureSubscription: "vscode-builds-subscription"
-          KeyVaultName: vscode
-          SecretsFilter: "github-distro-mixin-password"
+          - powershell: |
+              . build/azure-pipelines/win32/exec.ps1
+              $ErrorActionPreference = "Stop"
+              "machine github.com`nlogin vscode`npassword $(github-distro-mixin-password)" | Out-File "$env:USERPROFILE\_netrc" -Encoding ASCII
 
-      - powershell: |
-          . build/azure-pipelines/win32/exec.ps1
-          $ErrorActionPreference = "Stop"
-          "machine github.com`nlogin vscode`npassword $(github-distro-mixin-password)" | Out-File "$env:USERPROFILE\_netrc" -Encoding ASCII
+              exec { git config user.email "vscode@microsoft.com" }
+              exec { git config user.name "VSCode" }
+            displayName: Prepare tooling
 
-          exec { git config user.email "vscode@microsoft.com" }
-          exec { git config user.name "VSCode" }
-        displayName: Prepare tooling
+          # - powershell: |
+          #     . build/azure-pipelines/win32/exec.ps1
+          #     $ErrorActionPreference = "Stop"
 
-      - powershell: |
-          . build/azure-pipelines/win32/exec.ps1
-          $ErrorActionPreference = "Stop"
-          exec { git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro") }
-        displayName: Merge distro
+          #     exec { git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $(VSCODE_DISTRO_REF) }
+          #     exec { git checkout FETCH_HEAD }
+          #   condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+          #   displayName: Checkout override commit
 
-      - powershell: |
-          . build/azure-pipelines/win32/exec.ps1
-          $ErrorActionPreference = "Stop"
-          exec { npx https://aka.ms/enablesecurefeed standAlone }
-        timeoutInMinutes: 5
-        condition: and(succeeded(), eq(variables['ENABLE_TERRAPIN'], 'true'))
-        displayName: Switch to Terrapin packages
+          - powershell: |
+              . build/azure-pipelines/win32/exec.ps1
+              $ErrorActionPreference = "Stop"
+              exec { git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro") }
+            displayName: Merge distro
 
-      - task: Semmle@1
-        inputs:
-          sourceCodeDirectory: '$(Build.SourcesDirectory)'
-          language: 'cpp'
-          buildCommandsString: 'yarn --frozen-lockfile'
-          querySuite: 'Required'
-          timeout: '1800'
-          ram: '16384'
-          addProjectDirToScanningExclusionList: true
-        env:
-          npm_config_arch: "$(NPM_ARCH)"
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          GITHUB_TOKEN: "$(github-distro-mixin-password)"
-        displayName: CodeQL
+          - powershell: |
+              . build/azure-pipelines/win32/exec.ps1
+              $ErrorActionPreference = "Stop"
+              exec { npx https://aka.ms/enablesecurefeed standAlone }
+            timeoutInMinutes: 5
+            retryCountOnTaskFailure: 3
+            condition: and(succeeded(), eq(variables['ENABLE_TERRAPIN'], 'true'))
+            displayName: Switch to Terrapin packages
 
-      - powershell: |
-          . build/azure-pipelines/win32/exec.ps1
-          . build/azure-pipelines/win32/retry.ps1
-          $ErrorActionPreference = "Stop"
-          retry { exec { yarn --frozen-lockfile } }
-        env:
-          npm_config_arch: "$(NPM_ARCH)"
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          GITHUB_TOKEN: "$(github-distro-mixin-password)"
-          CHILD_CONCURRENCY: 1
-        displayName: Install dependencies
+          - task: Semmle@1
+            inputs:
+              sourceCodeDirectory: "$(Build.SourcesDirectory)"
+              language: "cpp"
+              buildCommandsString: "yarn --frozen-lockfile --check-files"
+              querySuite: "Required"
+              timeout: "1800"
+              ram: "16384"
+              addProjectDirToScanningExclusionList: true
+            env:
+              npm_config_arch: "$(NPM_ARCH)"
+              PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+              GITHUB_TOKEN: "$(github-distro-mixin-password)"
+            displayName: CodeQL
 
-      - powershell: |
-          . build/azure-pipelines/win32/exec.ps1
-          $ErrorActionPreference = "Stop"
-          exec { yarn gulp "vscode-symbols-win32-$(VSCODE_ARCH)" }
-        displayName: Download Symbols
+          - powershell: |
+              . build/azure-pipelines/win32/exec.ps1
+              . build/azure-pipelines/win32/retry.ps1
+              $ErrorActionPreference = "Stop"
+              retry { exec { yarn --frozen-lockfile --check-files } }
+            env:
+              npm_config_arch: "$(NPM_ARCH)"
+              PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+              GITHUB_TOKEN: "$(github-distro-mixin-password)"
+              CHILD_CONCURRENCY: 1
+            displayName: Install dependencies
 
-      - task: BinSkim@4
-        inputs:
-          InputType: 'Basic'
-          Function: 'analyze'
-          TargetPattern: 'guardianGlob'
-          AnalyzeTargetGlob: '$(agent.builddirectory)\scanbin\**.dll;$(agent.builddirectory)\scanbin\**.exe;$(agent.builddirectory)\scanbin\**.node'
-          AnalyzeLocalSymbolDirectories: '$(agent.builddirectory)\scanbin\VSCode-win32-$(VSCODE_ARCH)\pdb'
+          - powershell: |
+              . build/azure-pipelines/win32/exec.ps1
+              $ErrorActionPreference = "Stop"
+              exec { yarn gulp "vscode-symbols-win32-$(VSCODE_ARCH)" }
+            displayName: Download Symbols
 
-      - task: TSAUpload@2
-        inputs:
-          GdnPublishTsaOnboard: true
-          GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)\build\azure-pipelines\.gdntsa'
+          - task: BinSkim@4
+            inputs:
+              InputType: "Basic"
+              Function: "analyze"
+              TargetPattern: "guardianGlob"
+              AnalyzeTargetGlob: '$(agent.builddirectory)\scanbin\**.dll;$(agent.builddirectory)\scanbin\**.exe;$(agent.builddirectory)\scanbin\**.node'
+              AnalyzeLocalSymbolDirectories: '$(agent.builddirectory)\scanbin\VSCode-win32-$(VSCODE_ARCH)\pdb'
 
-- stage: Linux
-  dependsOn: []
-  condition: eq(variables.SCAN_LINUX, 'true')
-  pool:
-    vmImage: "Ubuntu-18.04"
-  jobs:
-    - job: LinuxJob
-      steps:
-      - task: CredScan@2
-        inputs:
-          toolMajorVersion: 'V2'
-      - task: NodeTool@0
-        inputs:
-          versionSpec: "14.x"
+          - task: TSAUpload@2
+            inputs:
+              GdnPublishTsaOnboard: true
+              GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)\build\azure-pipelines\.gdntsa'
 
-      - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-        inputs:
-          versionSpec: "1.x"
+  - stage: Linux
+    dependsOn: []
+    condition: eq(variables.SCAN_LINUX, 'true')
+    pool:
+      vmImage: "Ubuntu-18.04"
+    jobs:
+      - job: LinuxJob
+        steps:
+          - task: CredScan@2
+            inputs:
+              toolMajorVersion: "V2"
+          - task: NodeTool@0
+            inputs:
+              versionSpec: "16.x"
 
-      - task: AzureKeyVault@1
-        displayName: "Azure Key Vault: Get Secrets"
-        inputs:
-          azureSubscription: "vscode-builds-subscription"
-          KeyVaultName: vscode
-          SecretsFilter: "github-distro-mixin-password"
+          - task: AzureKeyVault@1
+            displayName: "Azure Key Vault: Get Secrets"
+            inputs:
+              azureSubscription: "vscode-builds-subscription"
+              KeyVaultName: vscode
+              SecretsFilter: "github-distro-mixin-password"
 
-      - script: |
-          set -e
-          cat << EOF > ~/.netrc
-          machine github.com
-          login vscode
-          password $(github-distro-mixin-password)
-          EOF
+          - script: |
+              set -e
+              cat << EOF > ~/.netrc
+              machine github.com
+              login vscode
+              password $(github-distro-mixin-password)
+              EOF
 
-          git config user.email "vscode@microsoft.com"
-          git config user.name "VSCode"
-        displayName: Prepare tooling
+              git config user.email "vscode@microsoft.com"
+              git config user.name "VSCode"
+            displayName: Prepare tooling
 
-      - script: |
-          set -e
-          git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
-        displayName: Merge distro
+          # - script: |
+          #     set -e
+          #     git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+          #     echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+          #     git checkout FETCH_HEAD
+          #   condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+          #   displayName: Checkout override commit
 
-      - script: |
-          set -e
-          npx https://aka.ms/enablesecurefeed standAlone
-        timeoutInMinutes: 5
-        condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
-        displayName: Switch to Terrapin packages
+          - script: |
+              set -e
+              git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
+            displayName: Merge distro
 
-      - script: |
-          set -e
-          yarn --cwd build
-          yarn --cwd build compile
-        displayName: Compile build tools
+          - script: |
+              set -e
+              npx https://aka.ms/enablesecurefeed standAlone
+            timeoutInMinutes: 5
+            retryCountOnTaskFailure: 3
+            condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
+            displayName: Switch to Terrapin packages
 
-      - script: |
-          set -e
-          export npm_config_arch=$(NPM_ARCH)
+          - script: |
+              set -e
+              for i in {1..3}; do # try 3 times, for Terrapin
+                yarn --cwd build --frozen-lockfile --check-files && break
+                if [ $i -eq 3 ]; then
+                  echo "Yarn failed too many times" >&2
+                  exit 1
+                fi
+                echo "Yarn failed $i, trying again..."
+              done
+            displayName: Install build dependencies
 
-          if [ -z "$CC" ] || [ -z "$CXX" ]; then
-            # Download clang based on chromium revision used by vscode
-            curl -s https://raw.githubusercontent.com/chromium/chromium/91.0.4472.164/tools/clang/scripts/update.py | python - --output-dir=$PWD/.build/CR_Clang --host-os=linux
-            # Download libcxx headers and objects from upstream electron releases
-            DEBUG=libcxx-fetcher \
-            VSCODE_LIBCXX_OBJECTS_DIR=$PWD/.build/libcxx-objects \
-            VSCODE_LIBCXX_HEADERS_DIR=$PWD/.build/libcxx_headers  \
-            VSCODE_LIBCXXABI_HEADERS_DIR=$PWD/.build/libcxxabi_headers \
-            VSCODE_ARCH="$(NPM_ARCH)" \
-            node build/linux/libcxx-fetcher.js
-            # Set compiler toolchain
-            export CC=$PWD/.build/CR_Clang/bin/clang
-            export CXX=$PWD/.build/CR_Clang/bin/clang++
-            export CXXFLAGS="-nostdinc++ -D_LIBCPP_HAS_NO_VENDOR_AVAILABILITY_ANNOTATIONS -isystem$PWD/.build/libcxx_headers/include -isystem$PWD/.build/libcxxabi_headers/include -fPIC -flto=thin -fsplit-lto-unit"
-            export LDFLAGS="-stdlib=libc++ -fuse-ld=lld -flto=thin -fsplit-lto-unit -L$PWD/.build/libcxx-objects -lc++abi"
-          fi
+          - script: |
+              set -e
+              export npm_config_arch=$(NPM_ARCH)
 
-          if [ "$VSCODE_ARCH" == "x64" ]; then
-            export VSCODE_REMOTE_CC=$(which gcc-4.8)
-            export VSCODE_REMOTE_CXX=$(which g++-4.8)
-          fi
+              if [ -z "$CC" ] || [ -z "$CXX" ]; then
+                # Download clang based on chromium revision used by vscode
+                curl -s https://raw.githubusercontent.com/chromium/chromium/96.0.4664.110/tools/clang/scripts/update.py | python - --output-dir=$PWD/.build/CR_Clang --host-os=linux
+                # Download libcxx headers and objects from upstream electron releases
+                DEBUG=libcxx-fetcher \
+                VSCODE_LIBCXX_OBJECTS_DIR=$PWD/.build/libcxx-objects \
+                VSCODE_LIBCXX_HEADERS_DIR=$PWD/.build/libcxx_headers  \
+                VSCODE_LIBCXXABI_HEADERS_DIR=$PWD/.build/libcxxabi_headers \
+                VSCODE_ARCH="$(NPM_ARCH)" \
+                node build/linux/libcxx-fetcher.js
+                # Set compiler toolchain
+                export CC=$PWD/.build/CR_Clang/bin/clang
+                export CXX=$PWD/.build/CR_Clang/bin/clang++
+                export CXXFLAGS="-nostdinc++ -D__NO_INLINE__ -isystem$PWD/.build/libcxx_headers -isystem$PWD/.build/libcxx_headers/include -isystem$PWD/.build/libcxxabi_headers/include -fPIC -flto=thin -fsplit-lto-unit"
+                export LDFLAGS="-stdlib=libc++ -fuse-ld=lld -flto=thin -fsplit-lto-unit -L$PWD/.build/libcxx-objects -lc++abi"
+                export VSCODE_REMOTE_CC=$(which gcc)
+                export VSCODE_REMOTE_CXX=$(which g++)
+              fi
 
-          for i in {1..3}; do # try 3 times, for Terrapin
-            yarn --frozen-lockfile && break
-            if [ $i -eq 3 ]; then
-              echo "Yarn failed too many times" >&2
-              exit 1
-            fi
-            echo "Yarn failed $i, trying again..."
-          done
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          GITHUB_TOKEN: "$(github-distro-mixin-password)"
-        displayName: Install dependencies
+              for i in {1..3}; do # try 3 times, for Terrapin
+                yarn --frozen-lockfile --check-files && break
+                if [ $i -eq 3 ]; then
+                  echo "Yarn failed too many times" >&2
+                  exit 1
+                fi
+                echo "Yarn failed $i, trying again..."
+              done
+            env:
+              PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+              GITHUB_TOKEN: "$(github-distro-mixin-password)"
+            displayName: Install dependencies
 
-      - script: |
-          set -e
-          yarn gulp vscode-symbols-linux-$(VSCODE_ARCH)
-        displayName: Build
+          - script: |
+              set -e
+              yarn gulp vscode-symbols-linux-$(VSCODE_ARCH)
+            displayName: Build
 
-      - task: BinSkim@3
-        inputs:
-          toolVersion: Latest
-          InputType:   CommandLine
-          arguments:   analyze $(agent.builddirectory)\scanbin\exe\*.* --recurse --local-symbol-directories $(agent.builddirectory)\scanbin\VSCode-linux-$(VSCODE_ARCH)\pdb
+          - task: BinSkim@3
+            inputs:
+              toolVersion: Latest
+              InputType: CommandLine
+              arguments: analyze $(agent.builddirectory)\scanbin\exe\*.* --recurse --local-symbol-directories $(agent.builddirectory)\scanbin\VSCode-linux-$(VSCODE_ARCH)\pdb
 
-      - task: TSAUpload@2
-        inputs:
-          GdnPublishTsaConfigFile: '$(Build.SourceDirectory)\build\azure-pipelines\.gdntsa'
+          - task: TSAUpload@2
+            inputs:
+              GdnPublishTsaConfigFile: '$(Build.SourceDirectory)\build\azure-pipelines\.gdntsa'

build/azure-pipelines/sql-mixin.js

@@ -0,0 +1,68 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+const json = require('gulp-json-editor');
+const buffer = require('gulp-buffer');
+const filter = require('gulp-filter');
+const es = require('event-stream');
+const vfs = require('vinyl-fs');
+const fancyLog = require('fancy-log');
+const ansiColors = require('ansi-colors');
+const fs = require('fs');
+const path = require('path');
+
+function main() {
+    const quality = process.env['VSCODE_QUALITY'];
+
+    if (!quality) {
+        console.log('Missing VSCODE_QUALITY, skipping mixin');
+        return;
+    }
+
+    const productJsonFilter = filter(f => f.relative === 'product.json', { restore: true });
+
+    fancyLog(ansiColors.blue('[mixin]'), `Mixing in sources:`);
+    return vfs
+        .src(`quality/${quality}/**`, { base: `quality/${quality}` })
+        .pipe(filter(f => !f.isDirectory()))
+        .pipe(productJsonFilter)
+        .pipe(buffer())
+        .pipe(json(o => {
+            const ossProduct = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'product.json'), 'utf8'));
+            let builtInExtensions = ossProduct.builtInExtensions;
+
+            if (Array.isArray(o.builtInExtensions)) {
+                fancyLog(ansiColors.blue('[mixin]'), 'Overwriting built-in extensions:', o.builtInExtensions.map(e => e.name));
+
+                builtInExtensions = o.builtInExtensions;
+            } else if (o.builtInExtensions) {
+                const include = o.builtInExtensions['include'] || [];
+                const exclude = o.builtInExtensions['exclude'] || [];
+
+                fancyLog(ansiColors.blue('[mixin]'), 'OSS built-in extensions:', builtInExtensions.map(e => e.name));
+                fancyLog(ansiColors.blue('[mixin]'), 'Including built-in extensions:', include.map(e => e.name));
+                fancyLog(ansiColors.blue('[mixin]'), 'Excluding built-in extensions:', exclude);
+
+                builtInExtensions = builtInExtensions.filter(ext => !include.find(e => e.name === ext.name) && !exclude.find(name => name === ext.name));
+                builtInExtensions = [...builtInExtensions, ...include];
+
+                fancyLog(ansiColors.blue('[mixin]'), 'Final built-in extensions:', builtInExtensions.map(e => e.name));
+            } else {
+                fancyLog(ansiColors.blue('[mixin]'), 'Inheriting OSS built-in extensions', builtInExtensions.map(e => e.name));
+            }
+
+            return { ...ossProduct, ...o, builtInExtensions };
+        }))
+        .pipe(productJsonFilter.restore)
+        .pipe(es.mapSync(function (f) {
+            fancyLog(ansiColors.blue('[mixin]'), f.relative, ansiColors.green('✔︎'));
+            return f;
+        }))
+        .pipe(vfs.dest('.'));
+}
+
+main();

build/azure-pipelines/sql-product-build.yml

@@ -4,87 +4,158 @@ resources:
     image: sqltoolscontainers.azurecr.io/linux-build-agent:6
     endpoint: SqlToolsContainers
 
-jobs:
-- job: Compile
-  pool:
-    vmImage: 'Ubuntu-18.04'
-  container: linux-x64
-  steps:
-  - script: |
-      set -e
-      echo "##vso[build.addbuildtag]$(VSCODE_QUALITY)"
-    displayName: Add Quality Build Tag
-  - template: sql-product-compile.yml
-  timeoutInMinutes: 120
+stages:
+  - stage: Compile
+    jobs:
+    - job: Compile
+      pool:
+        vmImage: 'Ubuntu-20.04'
+      container: linux-x64
+      steps:
+      - script: |
+          set -e
+          echo "##vso[build.addbuildtag]$(VSCODE_QUALITY)"
+        displayName: Add Quality Build Tag
+      - template: sql-product-compile.yml
+      timeoutInMinutes: 120
 
-- job: macOS
-  condition: and(succeeded(), eq(variables['VSCODE_BUILD_MACOS'], 'true'), ne(variables['VSCODE_QUALITY'], 'saw'))
-  pool:
-    vmImage: 'macOS-10.15'
-  dependsOn:
-  - Compile
-  steps:
-  - template: darwin/sql-product-build-darwin.yml
-  timeoutInMinutes: 90
+  - stage: macOS
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_MACOS'], 'true'), ne(variables['VSCODE_QUALITY'], 'saw'))
+    pool:
+      vmImage: 'macos-latest'
+    dependsOn:
+      - Compile
+    jobs:
+      - job: macOS
+        variables:
+          NPM_CONFIG_ARCH: x64
+          VSCODE_ARCH: x64
+        steps:
+        - template: darwin/sql-product-build-darwin.yml
+        timeoutInMinutes: 90
 
-- job: macOS_Signing
-  condition: and(succeeded(), eq(variables['VSCODE_BUILD_MACOS'], 'true'), eq(variables['signed'], true), ne(variables['VSCODE_QUALITY'], 'saw'))
-  pool:
-    vmImage: 'macOS-10.15'
-  dependsOn:
-  - macOS
-  steps:
-  - template: darwin/sql-product-build-darwin-signing.yml
-  timeoutInMinutes: 60
+      - job: macOS_Signing
+        variables:
+          VSCODE_ARCH: x64
+        condition: and(succeeded(), eq(variables['signed'], true))
+        dependsOn:
+        - macOS
+        steps:
+        - template: darwin/sql-product-build-darwin-signing.yml
+        timeoutInMinutes: 60
 
-- job: Linux
-  condition: and(succeeded(), eq(variables['VSCODE_BUILD_LINUX'], 'true'))
-  pool:
-    vmImage: 'Ubuntu-18.04'
-  container: linux-x64
-  dependsOn:
-  - Compile
-  steps:
-  - template: linux/sql-product-build-linux.yml
-    parameters:
-      extensionsToUnitTest: ["admin-tool-ext-win", "agent", "azcli", "azurecore", "cms", "dacpac", "data-workspace", "import", "machine-learning", "notebook", "resource-deployment", "schema-compare", "sql-bindings", "sql-database-projects"]
-  timeoutInMinutes: 90
+      - job: macOS_ARM64
+        variables:
+          NPM_CONFIG_ARCH: arm64
+          VSCODE_ARCH: arm64
+          # Do not run tests for arm64 build
+          RUN_TESTS: false
+          RUN_SMOKE_TESTS: false
+        condition: and(succeeded(), eq(variables['VSCODE_BUILD_MACOS_ARM64'], 'true'))
+        steps:
+        - template: darwin/sql-product-build-darwin.yml
+        timeoutInMinutes: 90
 
-- job: Windows
-  condition: and(succeeded(), eq(variables['VSCODE_BUILD_WIN32'], 'true'))
-  pool:
-    vmImage: 'windows-2019'
-  dependsOn:
-  - Compile
-  steps:
-  - template: win32/sql-product-build-win32.yml
-  timeoutInMinutes: 90
+      - job: macOS_Signing_ARM64
+        variables:
+          VSCODE_ARCH: arm64
+        condition: and(succeeded(), eq(variables['signed'], true))
+        dependsOn:
+        - macOS_ARM64
+        steps:
+        - template: darwin/sql-product-build-darwin-signing.yml
+        timeoutInMinutes: 60
 
-# disable due to invalid machine pool (karlb 3/9/2022)
-# - job: Windows_Test
-#   condition: and(succeeded(), eq(variables['VSCODE_BUILD_WIN32'], 'true'))
-#   pool:
-#     name: mssqltools
-#   dependsOn:
-#   - Linux
-#   - Windows
-#   steps:
-#   - template: win32/sql-product-test-win32.yml
-#   timeoutInMinutes: 90
+      - job: macOS_Universal
+        variables:
+          NPM_CONFIG_ARCH: x64
+          VSCODE_ARCH: universal
+          # Do not run tests for universal build
+          RUN_TESTS: false
+          RUN_SMOKE_TESTS: false
+        dependsOn:
+        - macOS
+        - macOS_ARM64
+        steps:
+        - template: darwin/sql-product-build-darwin.yml
+        timeoutInMinutes: 90
 
-- job: Release
-  condition: and(succeeded(), or(eq(variables['VSCODE_RELEASE'], 'true'), and(eq(variables['VSCODE_QUALITY'], 'insider'), eq(variables['Build.Reason'], 'Schedule'))))
-  pool:
-    vmImage: 'Ubuntu-18.04'
-  dependsOn:
-  - macOS
-  - Linux
-  - Windows
-# disable due to invalid machine pool (karlb 3/9/2022)
-#  - Windows_Test
-  - macOS_Signing
-  steps:
-  - template: sql-release.yml
+      - job: macOS_Signing_Universal
+        variables:
+          VSCODE_ARCH: universal
+        condition: and(succeeded(), eq(variables['signed'], true))
+        dependsOn:
+        - macOS_Universal
+        steps:
+        - template: darwin/sql-product-build-darwin-signing.yml
+        timeoutInMinutes: 60
+
+  - stage: Linux
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_LINUX'], true))
+    dependsOn:
+      - Compile
+    jobs:
+      - job: Linux
+        pool:
+          vmImage: 'Ubuntu-20.04'
+        container: linux-x64
+        steps:
+        - template: linux/sql-product-build-linux.yml
+          parameters:
+            extensionsToUnitTest: ["admin-tool-ext-win", "agent", "azcli", "azurecore", "cms", "dacpac", "data-workspace", "import", "machine-learning", "notebook", "resource-deployment", "schema-compare", "sql-bindings", "sql-database-projects"]
+        timeoutInMinutes: 90
+
+  - stage: Windows
+    condition: and(succeeded(), eq(variables['VSCODE_BUILD_WIN32'], true))
+    pool:
+      vmImage: 'windows-2019'
+    dependsOn:
+      - Compile
+    jobs:
+      - job: Windows
+        steps:
+        - template: win32/sql-product-build-win32.yml
+        timeoutInMinutes: 90
+
+    # disable due to invalid machine pool (karlb 3/9/2022)
+    # - job: Windows_Test
+    #   condition: and(succeeded(), eq(variables['VSCODE_BUILD_WIN32'], 'true'))
+    #   pool:
+    #     name: mssqltools
+    #   dependsOn:
+    #   - Linux
+    #   - Windows
+    #   steps:
+    #   - template: win32/sql-product-test-win32.yml
+    #   timeoutInMinutes: 90
+
+  - stage: Release
+    # Requirements:
+    # 1. Release can be created only from builds of the official build pipeline, but not all builds of it should be released automatically.
+    # 2. A build should be released only when the release variable is set to true.
+    # 3. The daily scheduled Insiders build should be released automatically.
+    #
+    # Limitation:
+    # Ideally, we should be able to use the condition `and(succeeded(), eq(variables['VSCODE_RELEASE'], 'true')` to achieve what we want. The VSCODE_RELEASE variable can be defined as overwritable or non-overwritable based on whether we want to
+    # release from the pipeline. Unfortunately ADO doesn't allow overriding variable values for scheduled runs. (see https://learn.microsoft.com/en-us/azure/devops/pipelines/process/scheduled-triggers?view=azure-devops&tabs=yaml#scheduled-triggers).
+    # This means we can't simply set VSCODE_RELEASE to true only for scheduled builds and have to set it to true for all runs of the pipeline by default.
+    #
+    # Implementation:
+    # Set the VSCODE_RELEASE variable's default value to true and add the release tag for following scenarios:
+    # 1. The build is a scheduled insiders build.
+    # 2. The build is not an insiders build. e.g. rc1, stable, saw.
+    # To release an ad-hoc insiders build, manually add 'Release' tag to the build.
+    condition: and(succeeded(), eq(variables['VSCODE_RELEASE'], 'true'), or(ne(variables['VSCODE_QUALITY'], 'insider'), and(eq(variables['VSCODE_QUALITY'], 'insider'), eq(variables['Build.Reason'], 'Schedule'))))
+    pool:
+      vmImage: 'Ubuntu-20.04'
+    dependsOn:
+      - macOS
+      - Linux
+      - Windows
+    jobs:
+      - job: Add_Release_Tag
+        steps:
+        - template: sql-release.yml
 
 trigger: none
 pr: none

build/azure-pipelines/sql-product-compile.yml

@@ -74,7 +74,7 @@ steps:
 # inline small SVGs
 - script: |
     set -e
-    node build/azure-pipelines/mixin
+    node build/azure-pipelines/sql-mixin
   displayName: Mix in quality
 
 # Run these separately to avoid OOM errors on pipeline machines

build/azure-pipelines/sql-web-build.yml

@@ -7,7 +7,7 @@ resources:
 jobs:
 - job: LinuxWeb
   pool:
-    vmImage: 'Ubuntu-18.04'
+    vmImage: 'Ubuntu-20.04'
   container: linux-x64
   variables:
     VSCODE_ARCH: x64
@@ -17,7 +17,7 @@ jobs:
 
 - job: Docker
   pool:
-    vmImage: 'Ubuntu-18.04'
+    vmImage: 'Ubuntu-20.04'
   container: linux-x64
   dependsOn:
   - LinuxWeb

build/azure-pipelines/upload-cdn.js

@@ -4,32 +4,55 @@
  *--------------------------------------------------------------------------------------------*/
 'use strict';
 Object.defineProperty(exports, "__esModule", { value: true });
-const path = require("path");
 const es = require("event-stream");
+const Vinyl = require("vinyl");
 const vfs = require("vinyl-fs");
-const util = require("../lib/util");
 const filter = require("gulp-filter");
 const gzip = require("gulp-gzip");
+const identity_1 = require("@azure/identity");
 const azure = require('gulp-azure-storage');
-const root = path.dirname(path.dirname(__dirname));
-const commit = util.getVersion(root);
-function main() {
-    return vfs.src('**', { cwd: '../vscode-web', base: '../vscode-web', dot: true })
-        .pipe(filter(f => !f.isDirectory()))
-        .pipe(gzip({ append: false }))
-        .pipe(es.through(function (data) {
-        console.log('Uploading CDN file:', data.relative); // debug
-        this.emit('data', data);
-    }))
-        .pipe(azure.upload({
+const commit = process.env['VSCODE_DISTRO_COMMIT'] || process.env['BUILD_SOURCEVERSION'];
+const credential = new identity_1.ClientSecretCredential(process.env['AZURE_TENANT_ID'], process.env['AZURE_CLIENT_ID'], process.env['AZURE_CLIENT_SECRET']);
+async function main() {
+    const files = [];
+    const options = {
         account: process.env.AZURE_STORAGE_ACCOUNT,
-        key: process.env.AZURE_STORAGE_ACCESS_KEY,
+        credential,
         container: process.env.VSCODE_QUALITY,
         prefix: commit + '/',
         contentSettings: {
             contentEncoding: 'gzip',
             cacheControl: 'max-age=31536000, public'
         }
-    }));
+    };
+    await new Promise((c, e) => {
+        vfs.src('**', { cwd: '../vscode-web', base: '../vscode-web', dot: true })
+            .pipe(filter(f => !f.isDirectory()))
+            .pipe(gzip({ append: false }))
+            .pipe(es.through(function (data) {
+            console.log('Uploading:', data.relative); // debug
+            files.push(data.relative);
+            this.emit('data', data);
+        }))
+            .pipe(azure.upload(options))
+            .on('end', () => c())
+            .on('error', (err) => e(err));
+    });
+    await new Promise((c, e) => {
+        const listing = new Vinyl({
+            path: 'files.txt',
+            contents: Buffer.from(files.join('\n')),
+            stat: { mode: 0o666 }
+        });
+        console.log(`Uploading: files.txt (${files.length} files)`); // debug
+        es.readArray([listing])
+            .pipe(gzip({ append: false }))
+            .pipe(azure.upload(options))
+            .on('end', () => c())
+            .on('error', (err) => e(err));
+    });
 }
-main();
+main().catch(err => {
+    console.error(err);
+    process.exit(1);
+});

build/azure-pipelines/upload-cdn.ts

@@ -5,36 +5,61 @@
 
 'use strict';
 
-import * as path from 'path';
 import * as es from 'event-stream';
 import * as Vinyl from 'vinyl';
 import * as vfs from 'vinyl-fs';
-import * as util from '../lib/util';
 import * as filter from 'gulp-filter';
 import * as gzip from 'gulp-gzip';
+import { ClientSecretCredential } from '@azure/identity';
 const azure = require('gulp-azure-storage');
 
-const root = path.dirname(path.dirname(__dirname));
-const commit = util.getVersion(root);
+const commit = process.env['VSCODE_DISTRO_COMMIT'] || process.env['BUILD_SOURCEVERSION'];
+const credential = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
 
-function main() {
-	return vfs.src('**', { cwd: '../vscode-web', base: '../vscode-web', dot: true })
-		.pipe(filter(f => !f.isDirectory()))
-		.pipe(gzip({ append: false }))
-		.pipe(es.through(function (data: Vinyl) {
-			console.log('Uploading CDN file:', data.relative); // debug
-			this.emit('data', data);
-		}))
-		.pipe(azure.upload({
-			account: process.env.AZURE_STORAGE_ACCOUNT,
-			key: process.env.AZURE_STORAGE_ACCESS_KEY,
-			container: process.env.VSCODE_QUALITY,
-			prefix: commit + '/',
-			contentSettings: {
-				contentEncoding: 'gzip',
-				cacheControl: 'max-age=31536000, public'
-			}
-		}));
+async function main(): Promise<void> {
+	const files: string[] = [];
+	const options = {
+		account: process.env.AZURE_STORAGE_ACCOUNT,
+		credential,
+		container: process.env.VSCODE_QUALITY,
+		prefix: commit + '/',
+		contentSettings: {
+			contentEncoding: 'gzip',
+			cacheControl: 'max-age=31536000, public'
+		}
+	};
+
+	await new Promise<void>((c, e) => {
+		vfs.src('**', { cwd: '../vscode-web', base: '../vscode-web', dot: true })
+			.pipe(filter(f => !f.isDirectory()))
+			.pipe(gzip({ append: false }))
+			.pipe(es.through(function (data: Vinyl) {
+				console.log('Uploading:', data.relative); // debug
+				files.push(data.relative);
+				this.emit('data', data);
+			}))
+			.pipe(azure.upload(options))
+			.on('end', () => c())
+			.on('error', (err: any) => e(err));
+	});
+
+	await new Promise<void>((c, e) => {
+		const listing = new Vinyl({
+			path: 'files.txt',
+			contents: Buffer.from(files.join('\n')),
+			stat: { mode: 0o666 } as any
+		});
+
+		console.log(`Uploading: files.txt (${files.length} files)`); // debug
+		es.readArray([listing])
+			.pipe(gzip({ append: false }))
+			.pipe(azure.upload(options))
+			.on('end', () => c())
+			.on('error', (err: any) => e(err));
+	});
 }
 
-main();
+main().catch(err => {
+	console.error(err);
+	process.exit(1);
+});

build/azure-pipelines/upload-configuration.js

@@ -0,0 +1,111 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSettingsSearchBuildId = exports.shouldSetupSettingsSearch = void 0;
+const path = require("path");
+const os = require("os");
+const cp = require("child_process");
+const vfs = require("vinyl-fs");
+const util = require("../lib/util");
+const identity_1 = require("@azure/identity");
+const azure = require('gulp-azure-storage');
+const packageJson = require("../../package.json");
+const commit = process.env['VSCODE_DISTRO_COMMIT'] || process.env['BUILD_SOURCEVERSION'];
+function generateVSCodeConfigurationTask() {
+    return new Promise((resolve, reject) => {
+        const buildDir = process.env['AGENT_BUILDDIRECTORY'];
+        if (!buildDir) {
+            return reject(new Error('$AGENT_BUILDDIRECTORY not set'));
+        }
+        if (!shouldSetupSettingsSearch()) {
+            console.log(`Only runs on main and release branches, not ${process.env.BUILD_SOURCEBRANCH}`);
+            return resolve(undefined);
+        }
+        if (process.env.VSCODE_QUALITY !== 'insider' && process.env.VSCODE_QUALITY !== 'stable') {
+            console.log(`Only runs on insider and stable qualities, not ${process.env.VSCODE_QUALITY}`);
+            return resolve(undefined);
+        }
+        const result = path.join(os.tmpdir(), 'configuration.json');
+        const userDataDir = path.join(os.tmpdir(), 'tmpuserdata');
+        const extensionsDir = path.join(os.tmpdir(), 'tmpextdir');
+        const arch = process.env['VSCODE_ARCH'];
+        const appRoot = path.join(buildDir, `VSCode-darwin-${arch}`);
+        const appName = process.env.VSCODE_QUALITY === 'insider' ? 'Visual\\ Studio\\ Code\\ -\\ Insiders.app' : 'Visual\\ Studio\\ Code.app';
+        const appPath = path.join(appRoot, appName, 'Contents', 'Resources', 'app', 'bin', 'code');
+        const codeProc = cp.exec(`${appPath} --export-default-configuration='${result}' --wait --user-data-dir='${userDataDir}' --extensions-dir='${extensionsDir}'`, (err, stdout, stderr) => {
+            clearTimeout(timer);
+            if (err) {
+                console.log(`err: ${err} ${err.message} ${err.toString()}`);
+                reject(err);
+            }
+            if (stdout) {
+                console.log(`stdout: ${stdout}`);
+            }
+            if (stderr) {
+                console.log(`stderr: ${stderr}`);
+            }
+            resolve(result);
+        });
+        const timer = setTimeout(() => {
+            codeProc.kill();
+            reject(new Error('export-default-configuration process timed out'));
+        }, 12 * 1000);
+        codeProc.on('error', err => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+}
+function shouldSetupSettingsSearch() {
+    const branch = process.env.BUILD_SOURCEBRANCH;
+    return !!(branch && (/\/main$/.test(branch) || branch.indexOf('/release/') >= 0));
+}
+exports.shouldSetupSettingsSearch = shouldSetupSettingsSearch;
+function getSettingsSearchBuildId(packageJson) {
+    try {
+        const branch = process.env.BUILD_SOURCEBRANCH;
+        const branchId = branch.indexOf('/release/') >= 0 ? 0 :
+            /\/main$/.test(branch) ? 1 :
+                2; // Some unexpected branch
+        const out = cp.execSync(`git rev-list HEAD --count`);
+        const count = parseInt(out.toString());
+        // <version number><commit count><branchId (avoid unlikely conflicts)>
+        // 1.25.1, 1,234,567 commits, main = 1250112345671
+        return util.versionStringToNumber(packageJson.version) * 1e8 + count * 10 + branchId;
+    }
+    catch (e) {
+        throw new Error('Could not determine build number: ' + e.toString());
+    }
+}
+exports.getSettingsSearchBuildId = getSettingsSearchBuildId;
+async function main() {
+    const configPath = await generateVSCodeConfigurationTask();
+    if (!configPath) {
+        return;
+    }
+    const settingsSearchBuildId = getSettingsSearchBuildId(packageJson);
+    if (!settingsSearchBuildId) {
+        throw new Error('Failed to compute build number');
+    }
+    const credential = new identity_1.ClientSecretCredential(process.env['AZURE_TENANT_ID'], process.env['AZURE_CLIENT_ID'], process.env['AZURE_CLIENT_SECRET']);
+    return new Promise((c, e) => {
+        vfs.src(configPath)
+            .pipe(azure.upload({
+            account: process.env.AZURE_STORAGE_ACCOUNT,
+            credential,
+            container: 'configuration',
+            prefix: `${settingsSearchBuildId}/${commit}/`
+        }))
+            .on('end', () => c())
+            .on('error', (err) => e(err));
+    });
+}
+if (require.main === module) {
+    main().catch(err => {
+        console.error(err);
+        process.exit(1);
+    });
+}

build/azure-pipelines/upload-configuration.ts

@@ -0,0 +1,131 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+import * as path from 'path';
+import * as os from 'os';
+import * as cp from 'child_process';
+import * as vfs from 'vinyl-fs';
+import * as util from '../lib/util';
+import { ClientSecretCredential } from '@azure/identity';
+const azure = require('gulp-azure-storage');
+import * as packageJson from '../../package.json';
+
+const commit = process.env['VSCODE_DISTRO_COMMIT'] || process.env['BUILD_SOURCEVERSION'];
+
+function generateVSCodeConfigurationTask(): Promise<string | undefined> {
+	return new Promise((resolve, reject) => {
+		const buildDir = process.env['AGENT_BUILDDIRECTORY'];
+		if (!buildDir) {
+			return reject(new Error('$AGENT_BUILDDIRECTORY not set'));
+		}
+
+		if (!shouldSetupSettingsSearch()) {
+			console.log(`Only runs on main and release branches, not ${process.env.BUILD_SOURCEBRANCH}`);
+			return resolve(undefined);
+		}
+
+		if (process.env.VSCODE_QUALITY !== 'insider' && process.env.VSCODE_QUALITY !== 'stable') {
+			console.log(`Only runs on insider and stable qualities, not ${process.env.VSCODE_QUALITY}`);
+			return resolve(undefined);
+		}
+
+		const result = path.join(os.tmpdir(), 'configuration.json');
+		const userDataDir = path.join(os.tmpdir(), 'tmpuserdata');
+		const extensionsDir = path.join(os.tmpdir(), 'tmpextdir');
+		const arch = process.env['VSCODE_ARCH'];
+		const appRoot = path.join(buildDir, `VSCode-darwin-${arch}`);
+		const appName = process.env.VSCODE_QUALITY === 'insider' ? 'Visual\\ Studio\\ Code\\ -\\ Insiders.app' : 'Visual\\ Studio\\ Code.app';
+		const appPath = path.join(appRoot, appName, 'Contents', 'Resources', 'app', 'bin', 'code');
+		const codeProc = cp.exec(
+			`${appPath} --export-default-configuration='${result}' --wait --user-data-dir='${userDataDir}' --extensions-dir='${extensionsDir}'`,
+			(err, stdout, stderr) => {
+				clearTimeout(timer);
+				if (err) {
+					console.log(`err: ${err} ${err.message} ${err.toString()}`);
+					reject(err);
+				}
+
+				if (stdout) {
+					console.log(`stdout: ${stdout}`);
+				}
+
+				if (stderr) {
+					console.log(`stderr: ${stderr}`);
+				}
+
+				resolve(result);
+			}
+		);
+		const timer = setTimeout(() => {
+			codeProc.kill();
+			reject(new Error('export-default-configuration process timed out'));
+		}, 12 * 1000);
+
+		codeProc.on('error', err => {
+			clearTimeout(timer);
+			reject(err);
+		});
+	});
+}
+
+export function shouldSetupSettingsSearch(): boolean {
+	const branch = process.env.BUILD_SOURCEBRANCH;
+	return !!(branch && (/\/main$/.test(branch) || branch.indexOf('/release/') >= 0));
+}
+
+export function getSettingsSearchBuildId(packageJson: { version: string }) {
+	try {
+		const branch = process.env.BUILD_SOURCEBRANCH!;
+		const branchId = branch.indexOf('/release/') >= 0 ? 0 :
+			/\/main$/.test(branch) ? 1 :
+				2; // Some unexpected branch
+
+		const out = cp.execSync(`git rev-list HEAD --count`);
+		const count = parseInt(out.toString());
+
+		// <version number><commit count><branchId (avoid unlikely conflicts)>
+		// 1.25.1, 1,234,567 commits, main = 1250112345671
+		return util.versionStringToNumber(packageJson.version) * 1e8 + count * 10 + branchId;
+	} catch (e) {
+		throw new Error('Could not determine build number: ' + e.toString());
+	}
+}
+
+async function main(): Promise<void> {
+	const configPath = await generateVSCodeConfigurationTask();
+
+	if (!configPath) {
+		return;
+	}
+
+	const settingsSearchBuildId = getSettingsSearchBuildId(packageJson);
+
+	if (!settingsSearchBuildId) {
+		throw new Error('Failed to compute build number');
+	}
+
+	const credential = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
+
+	return new Promise((c, e) => {
+		vfs.src(configPath)
+			.pipe(azure.upload({
+				account: process.env.AZURE_STORAGE_ACCOUNT,
+				credential,
+				container: 'configuration',
+				prefix: `${settingsSearchBuildId}/${commit}/`
+			}))
+			.on('end', () => c())
+			.on('error', (err: any) => e(err));
+	});
+}
+
+if (require.main === module) {
+	main().catch(err => {
+		console.error(err);
+		process.exit(1);
+	});
+}

build/azure-pipelines/upload-nlsmetadata.js

@@ -4,85 +4,92 @@
  *--------------------------------------------------------------------------------------------*/
 'use strict';
 Object.defineProperty(exports, "__esModule", { value: true });
-const path = require("path");
 const es = require("event-stream");
 const vfs = require("vinyl-fs");
-const util = require("../lib/util");
 const merge = require("gulp-merge-json");
 const gzip = require("gulp-gzip");
+const identity_1 = require("@azure/identity");
 const azure = require('gulp-azure-storage');
-const root = path.dirname(path.dirname(__dirname));
-const commit = util.getVersion(root);
+const commit = process.env['VSCODE_DISTRO_COMMIT'] || process.env['BUILD_SOURCEVERSION'];
+const credential = new identity_1.ClientSecretCredential(process.env['AZURE_TENANT_ID'], process.env['AZURE_CLIENT_ID'], process.env['AZURE_CLIENT_SECRET']);
 function main() {
-    return es.merge(vfs.src('out-vscode-web-min/nls.metadata.json', { base: 'out-vscode-web-min' }), vfs.src('.build/extensions/**/nls.metadata.json', { base: '.build/extensions' }), vfs.src('.build/extensions/**/nls.metadata.header.json', { base: '.build/extensions' }), vfs.src('.build/extensions/**/package.nls.json', { base: '.build/extensions' }))
-        .pipe(merge({
-        fileName: 'combined.nls.metadata.json',
-        jsonSpace: '',
-        edit: (parsedJson, file) => {
-            let key;
-            if (file.base === 'out-vscode-web-min') {
-                return { vscode: parsedJson };
-            }
-            // Handle extensions and follow the same structure as the Core nls file.
-            switch (file.basename) {
-                case 'package.nls.json':
-                    // put package.nls.json content in Core NlsMetadata format
-                    // language packs use the key "package" to specify that
-                    // translations are for the package.json file
-                    parsedJson = {
-                        messages: {
-                            package: Object.values(parsedJson)
-                        },
-                        keys: {
-                            package: Object.keys(parsedJson)
-                        },
-                        bundles: {
-                            main: ['package']
+    return new Promise((c, e) => {
+        es.merge(vfs.src('out-vscode-web-min/nls.metadata.json', { base: 'out-vscode-web-min' }), vfs.src('.build/extensions/**/nls.metadata.json', { base: '.build/extensions' }), vfs.src('.build/extensions/**/nls.metadata.header.json', { base: '.build/extensions' }), vfs.src('.build/extensions/**/package.nls.json', { base: '.build/extensions' }))
+            .pipe(merge({
+            fileName: 'combined.nls.metadata.json',
+            jsonSpace: '',
+            edit: (parsedJson, file) => {
+                let key;
+                if (file.base === 'out-vscode-web-min') {
+                    return { vscode: parsedJson };
+                }
+                // Handle extensions and follow the same structure as the Core nls file.
+                switch (file.basename) {
+                    case 'package.nls.json':
+                        // put package.nls.json content in Core NlsMetadata format
+                        // language packs use the key "package" to specify that
+                        // translations are for the package.json file
+                        parsedJson = {
+                            messages: {
+                                package: Object.values(parsedJson)
+                            },
+                            keys: {
+                                package: Object.keys(parsedJson)
+                            },
+                            bundles: {
+                                main: ['package']
+                            }
+                        };
+                        break;
+                    case 'nls.metadata.header.json':
+                        parsedJson = { header: parsedJson };
+                        break;
+                    case 'nls.metadata.json': {
+                        // put nls.metadata.json content in Core NlsMetadata format
+                        const modules = Object.keys(parsedJson);
+                        const json = {
+                            keys: {},
+                            messages: {},
+                            bundles: {
+                                main: []
+                            }
+                        };
+                        for (const module of modules) {
+                            json.messages[module] = parsedJson[module].messages;
+                            json.keys[module] = parsedJson[module].keys;
+                            json.bundles.main.push(module);
                         }
-                    };
-                    break;
-                case 'nls.metadata.header.json':
-                    parsedJson = { header: parsedJson };
-                    break;
-                case 'nls.metadata.json':
-                    // put nls.metadata.json content in Core NlsMetadata format
-                    const modules = Object.keys(parsedJson);
-                    const json = {
-                        keys: {},
-                        messages: {},
-                        bundles: {
-                            main: []
-                        }
-                    };
-                    for (const module of modules) {
-                        json.messages[module] = parsedJson[module].messages;
-                        json.keys[module] = parsedJson[module].keys;
-                        json.bundles.main.push(module);
+                        parsedJson = json;
+                        break;
                     }
-                    parsedJson = json;
-                    break;
+                }
+                key = 'vscode.' + file.relative.split('/')[0];
+                return { [key]: parsedJson };
+            },
+        }))
+            .pipe(gzip({ append: false }))
+            .pipe(vfs.dest('./nlsMetadata'))
+            .pipe(es.through(function (data) {
+            console.log(`Uploading ${data.path}`);
+            // trigger artifact upload
+            console.log(`##vso[artifact.upload containerfolder=nlsmetadata;artifactname=combined.nls.metadata.json]${data.path}`);
+            this.emit('data', data);
+        }))
+            .pipe(azure.upload({
+            account: process.env.AZURE_STORAGE_ACCOUNT,
+            credential,
+            container: 'nlsmetadata',
+            prefix: commit + '/',
+            contentSettings: {
+                contentEncoding: 'gzip',
+                cacheControl: 'max-age=31536000, public'
             }
-            key = 'vscode.' + file.relative.split('/')[0];
-            return { [key]: parsedJson };
-        },
-    }))
-        .pipe(gzip({ append: false }))
-        .pipe(vfs.dest('./nlsMetadata'))
-        .pipe(es.through(function (data) {
-        console.log(`Uploading ${data.path}`);
-        // trigger artifact upload
-        console.log(`##vso[artifact.upload containerfolder=nlsmetadata;artifactname=combined.nls.metadata.json]${data.path}`);
-        this.emit('data', data);
-    }))
-        .pipe(azure.upload({
-        account: process.env.AZURE_STORAGE_ACCOUNT,
-        key: process.env.AZURE_STORAGE_ACCESS_KEY,
-        container: 'nlsmetadata',
-        prefix: commit + '/',
-        contentSettings: {
-            contentEncoding: 'gzip',
-            cacheControl: 'max-age=31536000, public'
-        }
-    }));
+        }))
+            .on('end', () => c())
+            .on('error', (err) => e(err));
+    });
 }
-main();
+main().catch(err => {
+    console.error(err);
+    process.exit(1);
+});

build/azure-pipelines/upload-nlsmetadata.ts

@@ -5,103 +5,112 @@
 
 'use strict';
 
-import * as path from 'path';
 import * as es from 'event-stream';
 import * as Vinyl from 'vinyl';
 import * as vfs from 'vinyl-fs';
-import * as util from '../lib/util';
 import * as merge from 'gulp-merge-json';
 import * as gzip from 'gulp-gzip';
+import { ClientSecretCredential } from '@azure/identity';
 const azure = require('gulp-azure-storage');
 
-const root = path.dirname(path.dirname(__dirname));
-const commit = util.getVersion(root);
+const commit = process.env['VSCODE_DISTRO_COMMIT'] || process.env['BUILD_SOURCEVERSION'];
+const credential = new ClientSecretCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_CLIENT_SECRET']!);
 
 interface NlsMetadata {
-	keys: { [module: string]: string },
-	messages: { [module: string]: string },
-	bundles: { [bundle: string]: string[] },
+	keys: { [module: string]: string };
+	messages: { [module: string]: string };
+	bundles: { [bundle: string]: string[] };
 }
 
-function main() {
-	return es.merge(
-		vfs.src('out-vscode-web-min/nls.metadata.json', { base: 'out-vscode-web-min' }),
-		vfs.src('.build/extensions/**/nls.metadata.json', { base: '.build/extensions' }),
-		vfs.src('.build/extensions/**/nls.metadata.header.json', { base: '.build/extensions' }),
-		vfs.src('.build/extensions/**/package.nls.json', { base: '.build/extensions' }))
-		.pipe(merge({
-			fileName: 'combined.nls.metadata.json',
-			jsonSpace: '',
-			edit: (parsedJson, file) => {
-				let key;
-				if (file.base === 'out-vscode-web-min') {
-					return { vscode: parsedJson };
-				}
+function main(): Promise<void> {
+	return new Promise((c, e) => {
 
-				// Handle extensions and follow the same structure as the Core nls file.
-				switch (file.basename) {
-					case 'package.nls.json':
-						// put package.nls.json content in Core NlsMetadata format
-						// language packs use the key "package" to specify that
-						// translations are for the package.json file
-						parsedJson = {
-							messages: {
-								package: Object.values(parsedJson)
-							},
-							keys: {
-								package: Object.keys(parsedJson)
-							},
-							bundles: {
-								main: ['package']
+		es.merge(
+			vfs.src('out-vscode-web-min/nls.metadata.json', { base: 'out-vscode-web-min' }),
+			vfs.src('.build/extensions/**/nls.metadata.json', { base: '.build/extensions' }),
+			vfs.src('.build/extensions/**/nls.metadata.header.json', { base: '.build/extensions' }),
+			vfs.src('.build/extensions/**/package.nls.json', { base: '.build/extensions' }))
+			.pipe(merge({
+				fileName: 'combined.nls.metadata.json',
+				jsonSpace: '',
+				edit: (parsedJson, file) => {
+					let key;
+					if (file.base === 'out-vscode-web-min') {
+						return { vscode: parsedJson };
+					}
+
+					// Handle extensions and follow the same structure as the Core nls file.
+					switch (file.basename) {
+						case 'package.nls.json':
+							// put package.nls.json content in Core NlsMetadata format
+							// language packs use the key "package" to specify that
+							// translations are for the package.json file
+							parsedJson = {
+								messages: {
+									package: Object.values(parsedJson)
+								},
+								keys: {
+									package: Object.keys(parsedJson)
+								},
+								bundles: {
+									main: ['package']
+								}
+							};
+							break;
+
+						case 'nls.metadata.header.json':
+							parsedJson = { header: parsedJson };
+							break;
+
+						case 'nls.metadata.json': {
+							// put nls.metadata.json content in Core NlsMetadata format
+							const modules = Object.keys(parsedJson);
+
+							const json: NlsMetadata = {
+								keys: {},
+								messages: {},
+								bundles: {
+									main: []
+								}
+							};
+							for (const module of modules) {
+								json.messages[module] = parsedJson[module].messages;
+								json.keys[module] = parsedJson[module].keys;
+								json.bundles.main.push(module);
 							}
-						};
-						break;
-
-					case 'nls.metadata.header.json':
-						parsedJson = { header: parsedJson };
-						break;
-
-					case 'nls.metadata.json':
-						// put nls.metadata.json content in Core NlsMetadata format
-						const modules = Object.keys(parsedJson);
-
-						const json: NlsMetadata = {
-							keys: {},
-							messages: {},
-							bundles: {
-								main: []
-							}
-						};
-						for (const module of modules) {
-							json.messages[module] = parsedJson[module].messages;
-							json.keys[module] = parsedJson[module].keys;
-							json.bundles.main.push(module);
+							parsedJson = json;
+							break;
 						}
-						parsedJson = json;
-						break;
+					}
+					key = 'vscode.' + file.relative.split('/')[0];
+					return { [key]: parsedJson };
+				},
+			}))
+			.pipe(gzip({ append: false }))
+			.pipe(vfs.dest('./nlsMetadata'))
+			.pipe(es.through(function (data: Vinyl) {
+				console.log(`Uploading ${data.path}`);
+				// trigger artifact upload
+				console.log(`##vso[artifact.upload containerfolder=nlsmetadata;artifactname=combined.nls.metadata.json]${data.path}`);
+				this.emit('data', data);
+			}))
+			.pipe(azure.upload({
+				account: process.env.AZURE_STORAGE_ACCOUNT,
+				credential,
+				container: 'nlsmetadata',
+				prefix: commit + '/',
+				contentSettings: {
+					contentEncoding: 'gzip',
+					cacheControl: 'max-age=31536000, public'
 				}
-				key = 'vscode.' + file.relative.split('/')[0];
-				return { [key]: parsedJson };
-			},
-		}))
-		.pipe(gzip({ append: false }))
-		.pipe(vfs.dest('./nlsMetadata'))
-		.pipe(es.through(function (data: Vinyl) {
-			console.log(`Uploading ${data.path}`);
-			// trigger artifact upload
-			console.log(`##vso[artifact.upload containerfolder=nlsmetadata;artifactname=combined.nls.metadata.json]${data.path}`);
-			this.emit('data', data);
-		}))
-		.pipe(azure.upload({
-			account: process.env.AZURE_STORAGE_ACCOUNT,
-			key: process.env.AZURE_STORAGE_ACCESS_KEY,
-			container: 'nlsmetadata',
-			prefix: commit + '/',
-			contentSettings: {
-				contentEncoding: 'gzip',
-				cacheControl: 'max-age=31536000, public'
-			}
-		}));
+			}))
+			.on('end', () => c())
+			.on('error', (err: any) => e(err));
+	});
 }
 
-main();
+main().catch(err => {
+	console.error(err);
+	process.exit(1);
+});
+

build/azure-pipelines/web/product-build-web.yml

@@ -1,18 +1,14 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
-
-  - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-    inputs:
-      versionSpec: "1.x"
+      versionSpec: "16.x"
 
   - task: AzureKeyVault@1
     displayName: "Azure Key Vault: Get Secrets"
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: 'github-distro-mixin-password,web-storage-account,web-storage-key,ticino-storage-key'
+      SecretsFilter: "github-distro-mixin-password"
 
   - task: DownloadPipelineArtifact@2
     inputs:
@@ -37,6 +33,14 @@ steps:
       git config user.name "VSCode"
     displayName: Prepare tooling
 
+  - script: |
+      set -e
+      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
+      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      git checkout FETCH_HEAD
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
   - script: |
       set -e
       git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")
@@ -49,7 +53,7 @@ steps:
 
   - task: Cache@2
     inputs:
-      key: 'nodeModules | $(Agent.OS) | .build/yarnlockhash'
+      key: "nodeModules | $(Agent.OS) | .build/yarnlockhash"
       path: .build/node_modules_cache
       cacheHitVar: NODE_MODULES_RESTORED
     displayName: Restore node_modules cache
@@ -64,13 +68,14 @@ steps:
       set -e
       npx https://aka.ms/enablesecurefeed standAlone
     timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
     displayName: Switch to Terrapin packages
 
   - script: |
       set -e
       for i in {1..3}; do # try 3 times, for Terrapin
-        yarn --frozen-lockfile && break
+        yarn --frozen-lockfile --check-files && break
         if [ $i -eq 3 ]; then
           echo "Yarn failed too many times" >&2
           exit 1
@@ -103,25 +108,44 @@ steps:
         yarn gulp vscode-web-min-ci
     displayName: Build
 
+  - task: AzureCLI@2
+    inputs:
+      azureSubscription: "vscode-builds-subscription"
+      scriptType: pscore
+      scriptLocation: inlineScript
+      addSpnToEnvironment: true
+      inlineScript: |
+        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"
+
   - script: |
       set -e
-      AZURE_STORAGE_ACCOUNT="$(web-storage-account)" \
-      AZURE_STORAGE_ACCESS_KEY="$(web-storage-key)" \
-        node build/azure-pipelines/upload-cdn.js
+      AZURE_STORAGE_ACCOUNT="vscodeweb" \
+      AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
+      AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
+      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+        node build/azure-pipelines/upload-cdn
     displayName: Upload to CDN
 
-    # upload only the workbench.web.api.js source maps because
+    # upload only the workbench.web.main.js source maps because
     # we just compiled these bits in the previous step and the
     # general task to upload source maps has already been run
   - script: |
       set -e
-      AZURE_STORAGE_ACCESS_KEY="$(ticino-storage-key)" \
-        node build/azure-pipelines/upload-sourcemaps out-vscode-web-min out-vscode-web-min/vs/workbench/workbench.web.api.js.map
+      AZURE_STORAGE_ACCOUNT="ticino" \
+      AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
+      AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
+      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
+        node build/azure-pipelines/upload-sourcemaps out-vscode-web-min out-vscode-web-min/vs/workbench/workbench.web.main.js.map
     displayName: Upload sourcemaps (Web)
 
   - script: |
       set -e
-      AZURE_STORAGE_ACCESS_KEY="$(ticino-storage-key)" \
+      AZURE_STORAGE_ACCOUNT="ticino" \
+      AZURE_TENANT_ID="$(AZURE_TENANT_ID)" \
+      AZURE_CLIENT_ID="$(AZURE_CLIENT_ID)" \
+      AZURE_CLIENT_SECRET="$(AZURE_CLIENT_SECRET)" \
         node build/azure-pipelines/upload-nlsmetadata
     displayName: Upload NLS Metadata
     condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))

build/azure-pipelines/web/sql-product-build-web.yml

@@ -75,7 +75,7 @@ steps:
 # inline small SVGs
 - script: |
     set -e
-    node build/azure-pipelines/mixin
+    node build/azure-pipelines/sql-mixin
   displayName: Mix in quality
 
 - script: |

build/azure-pipelines/win32/continuous-build-win32.yml

@@ -56,7 +56,7 @@ steps:
 
   - powershell: |
       .\scripts\test.bat --tfs "Unit Tests"
-    displayName: Run Unit Tests (Electron)
+    displayName: Run Core Unit Tests # {{SQL CARBON EDIT}} Rename to core for clarity
 
   # - powershell: | {{SQL CARBON EDIT}} disable
   #     yarn test-browser --browser chromium --browser firefox --tfs "Browser Unit Tests"
@@ -64,7 +64,7 @@ steps:
 
   # - powershell: | {{SQL CARBON EDIT}} disable
   #     .\scripts\test-integration.bat --tfs "Integration Tests"
-  #   displayName: Run Integration Tests (Electron)
+  #   displayName: Run Core Integration Tests # {{SQL CARBON EDIT}} Rename to core for clarity
 
   - task: PublishPipelineArtifact@0
     displayName: "Publish Crash Reports"

build/azure-pipelines/win32/listprocesses.bat

@@ -0,0 +1,3 @@
+echo "------------------------------------"
+tasklist /V
+echo "------------------------------------"

build/azure-pipelines/win32/product-build-win32.yml

@@ -1,15 +1,11 @@
 steps:
   - task: NodeTool@0
     inputs:
-      versionSpec: "14.x"
-
-  - task: geeklearningio.gl-vsts-tasks-yarn.yarn-installer-task.YarnInstaller@2
-    inputs:
-      versionSpec: "1.x"
+      versionSpec: "16.x"
 
   - task: UsePythonVersion@0
     inputs:
-      versionSpec: "2.x"
+      versionSpec: "3.x"
       addToPath: true
 
   - task: AzureKeyVault@1
@@ -17,7 +13,7 @@ steps:
     inputs:
       azureSubscription: "vscode-builds-subscription"
       KeyVaultName: vscode
-      SecretsFilter: "github-distro-mixin-password,vscode-storage-key,builds-docdb-key-readwrite,ESRP-PKI,esrp-aad-username,esrp-aad-password"
+      SecretsFilter: "github-distro-mixin-password,ESRP-PKI,esrp-aad-username,esrp-aad-password"
 
   - task: DownloadPipelineArtifact@2
     inputs:
@@ -25,11 +21,11 @@ steps:
       path: $(Build.ArtifactStagingDirectory)
     displayName: Download compilation output
 
-  - powershell: |
-      . build/azure-pipelines/win32/exec.ps1
-      $ErrorActionPreference = "Stop"
-      exec { tar --force-local -xzf $(Build.ArtifactStagingDirectory)/compilation.tar.gz }
+  - task: ExtractFiles@1
     displayName: Extract compilation output
+    inputs:
+      archiveFilePatterns: "$(Build.ArtifactStagingDirectory)/compilation.tar.gz"
+      cleanDestinationFolder: false
 
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
@@ -40,6 +36,16 @@ steps:
       exec { git config user.name "VSCode" }
     displayName: Prepare tooling
 
+  - powershell: |
+      . build/azure-pipelines/win32/exec.ps1
+      $ErrorActionPreference = "Stop"
+
+      exec { git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $(VSCODE_DISTRO_REF) }
+      Write-Host "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
+      exec { git checkout FETCH_HEAD }
+    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
+    displayName: Checkout override commit
+
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
@@ -71,6 +77,7 @@ steps:
       $ErrorActionPreference = "Stop"
       exec { npx https://aka.ms/enablesecurefeed standAlone }
     timeoutInMinutes: 5
+    retryCountOnTaskFailure: 3
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), eq(variables['ENABLE_TERRAPIN'], 'true'))
     displayName: Switch to Terrapin packages
 
@@ -80,7 +87,7 @@ steps:
       $ErrorActionPreference = "Stop"
       $env:npm_config_arch="$(VSCODE_ARCH)"
       $env:CHILD_CONCURRENCY="1"
-      retry { exec { yarn --frozen-lockfile } }
+      retry { exec { yarn --frozen-lockfile --check-files } }
     env:
       ELECTRON_SKIP_BINARY_DOWNLOAD: 1
       PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
@@ -127,6 +134,12 @@ steps:
     displayName: Prepare Package
     condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
 
+  - powershell: |
+      . build/azure-pipelines/win32/exec.ps1
+      $ErrorActionPreference = "Stop"
+      exec { node build/azure-pipelines/mixin --server }
+    displayName: Mix in quality
+
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
@@ -151,15 +164,23 @@ steps:
       exec { yarn electron $(VSCODE_ARCH) }
       exec { .\scripts\test.bat --build --tfs "Unit Tests" }
     displayName: Run unit tests (Electron)
-    timeoutInMinutes: 7
+    timeoutInMinutes: 15
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
-      exec { yarn test-browser --build --browser chromium --browser firefox --tfs "Browser Unit Tests" }
-    displayName: Run unit tests (Browser)
-    timeoutInMinutes: 7
+      exec { yarn test-node --build }
+    displayName: Run unit tests (node.js)
+    timeoutInMinutes: 15
+    condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
+
+  - powershell: |
+      . build/azure-pipelines/win32/exec.ps1
+      $ErrorActionPreference = "Stop"
+      exec { yarn test-browser-no-install --sequential --build --browser chromium --browser firefox --tfs "Browser Unit Tests" }
+    displayName: Run unit tests (Browser, Chromium & Firefox)
+    timeoutInMinutes: 20
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
   - powershell: |
@@ -173,15 +194,15 @@ steps:
       $AppNameShort = $AppProductJson.nameShort
       exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-win32-$(VSCODE_ARCH)"; .\scripts\test-integration.bat --build --tfs "Integration Tests" }
     displayName: Run integration tests (Electron)
-    timeoutInMinutes: 10
+    timeoutInMinutes: 20
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
-      exec { $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-web-win32-$(VSCODE_ARCH)"; .\resources\server\test\test-web-integration.bat --browser firefox }
-    displayName: Run integration tests (Browser)
-    timeoutInMinutes: 10
+      exec { $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-web-win32-$(VSCODE_ARCH)"; .\scripts\test-web-integration.bat --browser firefox }
+    displayName: Run integration tests (Browser, Firefox)
+    timeoutInMinutes: 20
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
   - powershell: |
@@ -190,25 +211,34 @@ steps:
       $AppRoot = "$(agent.builddirectory)\VSCode-win32-$(VSCODE_ARCH)"
       $AppProductJson = Get-Content -Raw -Path "$AppRoot\resources\app\product.json" | ConvertFrom-Json
       $AppNameShort = $AppProductJson.nameShort
-      exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-win32-$(VSCODE_ARCH)"; .\resources\server\test\test-remote-integration.bat }
-    displayName: Run remote integration tests (Electron)
-    timeoutInMinutes: 7
+      exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-win32-$(VSCODE_ARCH)"; .\scripts\test-remote-integration.bat }
+    displayName: Run integration tests (Remote)
+    timeoutInMinutes: 20
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
+  - powershell: |
+      . build/azure-pipelines/win32/exec.ps1
+      exec {.\build\azure-pipelines\win32\listprocesses.bat }
+    displayName: Diagnostics before smoke test run
+    continueOnError: true
+    condition: and(succeededOrFailed(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
+
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
-      exec { yarn --cwd test/smoke compile }
-    displayName: Compile smoke tests
+      $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-web-win32-$(VSCODE_ARCH)"
+      exec { yarn smoketest-no-compile --web --tracing --headless }
+    displayName: Run smoke tests (Browser, Chromium)
+    timeoutInMinutes: 10
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
       $AppRoot = "$(agent.builddirectory)\VSCode-win32-$(VSCODE_ARCH)"
-      exec { yarn smoketest-no-compile --build "$AppRoot" --screenshots $(Build.SourcesDirectory)\.build\logs\smoke-tests }
+      exec { yarn smoketest-no-compile --tracing --build "$AppRoot" }
     displayName: Run smoke tests (Electron)
-    timeoutInMinutes: 5
+    timeoutInMinutes: 20
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
   - powershell: |
@@ -216,19 +246,17 @@ steps:
       $ErrorActionPreference = "Stop"
       $AppRoot = "$(agent.builddirectory)\VSCode-win32-$(VSCODE_ARCH)"
       $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-win32-$(VSCODE_ARCH)"
-      exec { yarn smoketest-no-compile --build "$AppRoot" --remote }
+      exec { yarn smoketest-no-compile --tracing --remote --build "$AppRoot" }
     displayName: Run smoke tests (Remote)
-    timeoutInMinutes: 5
+    timeoutInMinutes: 20
     condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
-      $ErrorActionPreference = "Stop"
-      $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\vscode-reh-web-win32-$(VSCODE_ARCH)"
-      exec { yarn smoketest-no-compile --web --browser firefox --headless }
-    displayName: Run smoke tests (Browser)
-    timeoutInMinutes: 5
-    condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
+      exec {.\build\azure-pipelines\win32\listprocesses.bat }
+    displayName: Diagnostics after smoke test run
+    continueOnError: true
+    condition: and(succeededOrFailed(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
   - task: PublishPipelineArtifact@0
     inputs:
@@ -238,13 +266,23 @@ steps:
     continueOnError: true
     condition: failed()
 
+  # In order to properly symbolify above crash reports
+  # (if any), we need the compiled native modules too
+  - task: PublishPipelineArtifact@0
+    inputs:
+      artifactName: node-modules-windows-$(VSCODE_ARCH)
+      targetPath: node_modules
+    displayName: "Publish Node Modules"
+    continueOnError: true
+    condition: failed()
+
   - task: PublishPipelineArtifact@0
     inputs:
       artifactName: logs-windows-$(VSCODE_ARCH)-$(System.JobAttempt)
       targetPath: .build\logs
     displayName: "Publish Log Files"
     continueOnError: true
-    condition: and(succeededOrFailed(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
+    condition: and(failed(), eq(variables['VSCODE_STEP_ON_IT'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
 
   - task: PublishTestResults@2
     displayName: Publish Tests Results
@@ -262,14 +300,6 @@ steps:
     displayName: Download ESRPClient
     condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
 
-  - powershell: |
-      . build/azure-pipelines/win32/exec.ps1
-      $ErrorActionPreference = "Stop"
-      exec { yarn --cwd build }
-      exec { yarn --cwd build compile }
-    displayName: Compile build tools
-    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
-
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
@@ -310,9 +340,6 @@ steps:
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
-      $env:AZURE_STORAGE_ACCESS_KEY_2 = "$(vscode-storage-key)"
-      $env:AZURE_DOCUMENTDB_MASTERKEY = "$(builds-docdb-key-readwrite)"
-      $env:VSCODE_MIXIN_PASSWORD="$(github-distro-mixin-password)"
       .\build\azure-pipelines\win32\prepare-publish.ps1
     displayName: Publish
     condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
@@ -341,3 +368,27 @@ steps:
     artifact: vscode_web_win32_$(VSCODE_ARCH)_archive
     displayName: Publish web server archive
     condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
+
+  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
+    displayName: Generate SBOM (client)
+    inputs:
+      BuildDropPath: $(agent.builddirectory)/VSCode-win32-$(VSCODE_ARCH)
+      PackageName: Visual Studio Code
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - publish: $(agent.builddirectory)/VSCode-win32-$(VSCODE_ARCH)/_manifest
+    displayName: Publish SBOM (client)
+    artifact: vscode_client_win32_$(VSCODE_ARCH)_sbom
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'))
+
+  - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
+    displayName: Generate SBOM (server)
+    inputs:
+      BuildDropPath: $(agent.builddirectory)/vscode-server-win32-$(VSCODE_ARCH)
+      PackageName: Visual Studio Code Server
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))
+
+  - publish: $(agent.builddirectory)/vscode-server-win32-$(VSCODE_ARCH)/_manifest
+    displayName: Publish SBOM (server)
+    artifact: vscode_server_win32_$(VSCODE_ARCH)_sbom
+    condition: and(succeeded(), ne(variables['VSCODE_PUBLISH'], 'false'), ne(variables['VSCODE_ARCH'], 'arm64'))

build/azure-pipelines/win32/sql-product-build-win32.yml

@@ -95,7 +95,7 @@ steps:
   - powershell: |
       . build/azure-pipelines/win32/exec.ps1
       $ErrorActionPreference = "Stop"
-      exec { node build/azure-pipelines/mixin }
+      exec { node build/azure-pipelines/sql-mixin }
     displayName: Mix in quality
 
   - powershell: |
@@ -137,29 +137,22 @@ steps:
   #     $ErrorActionPreference = "Stop"
   #     exec { yarn electron x64 }
   #     exec { .\scripts\test.bat --build --coverage --reporter mocha-junit-reporter --tfs "Unit Tests" }
-  #   displayName: Run unit tests (Electron)
+  #   displayName: Run core unit tests
   #   condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'))
 
-  - powershell: |
-      # Figure out the full absolute path of the product we just built
-      # including the remote server and configure the integration tests
-      # to run with these builds instead of running out of sources.
-      . build/azure-pipelines/win32/exec.ps1
-      $ErrorActionPreference = "Stop"
-      $AppRoot = "$(agent.builddirectory)\azuredatastudio-win32-x64"
-      $AppProductJson = Get-Content -Raw -Path "$AppRoot\resources\app\product.json" | ConvertFrom-Json
-      $AppNameShort = $AppProductJson.nameShort
-      # exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\azuredatastudio-reh-win32-x64"; .\scripts\test-integration.bat --build --tfs "Integration Tests" }
-    displayName: Run integration tests (Electron)
-    condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'))
-
+  # {{SQL CARBON TODO}} -- reenable
   # - powershell: |
+  #     # Figure out the full absolute path of the product we just built
+  #     # including the remote server and configure the integration tests
+  #     # to run with these builds instead of running out of sources.
   #     . build/azure-pipelines/win32/exec.ps1
   #     $ErrorActionPreference = "Stop"
-  #     exec { .\scripts\test-unstable.bat --build --tfs }
-  #   continueOnError: true
-  #   condition: and(succeeded(), eq(variables['RUN_UNSTABLE_TESTS'], 'true'))
-  #   displayName: Run unstable tests
+  #     $AppRoot = "$(agent.builddirectory)\azuredatastudio-win32-x64"
+  #     $AppProductJson = Get-Content -Raw -Path "$AppRoot\resources\app\product.json" | ConvertFrom-Json
+  #     $AppNameShort = $AppProductJson.nameShort
+  #     # exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; $env:VSCODE_REMOTE_SERVER_PATH = "$(agent.builddirectory)\azuredatastudio-reh-win32-x64"; .\scripts\test-integration.bat --build --tfs "Integration Tests" }
+  #   displayName: Run core integration tests
+  #   condition: and(succeeded(), eq(variables['RUN_TESTS'], 'true'))
 
   - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
     displayName: 'Sign out code'

build/azure-pipelines/win32/sql-product-test-win32.yml

@@ -67,30 +67,6 @@ steps:
     STANDALONE_SQL_PWD_2019: $(ads-integration-test-standalone-server-password-2019)
     STANDALONE_SQL_2019: $(ads-integration-test-standalone-server-2019)
 
-- powershell: |
-    . build/azure-pipelines/win32/exec.ps1
-    $ErrorActionPreference = "Stop"
-    $AppRoot = "$(Agent.TempDirectory)\azuredatastudio-win32-x64"
-    $AppProductJson = Get-Content -Raw -Path "$AppRoot\resources\app\product.json" | ConvertFrom-Json
-    $AppNameShort = $AppProductJson.nameShort
-    exec { $env:INTEGRATION_TEST_ELECTRON_PATH = "$AppRoot\$AppNameShort.exe"; .\scripts\sql-test-integration-unstable.bat }
-  continueOnError: true
-  condition: and(succeeded(), and(eq(variables['RUN_UNSTABLE_TESTS'], 'true'), ne(variables['RUN_INTEGRATION_TESTS'], 'false')))
-  displayName: Run unstable integration tests
-  env:
-    BDC_BACKEND_USERNAME: $(ads-integration-test-bdc-server-username)
-    BDC_BACKEND_PWD: $(ads-integration-test-bdc-server-password)
-    BDC_BACKEND_HOSTNAME: $(ads-integration-test-bdc-server)
-    STANDALONE_SQL_USERNAME: $(ads-integration-test-standalone-server-username)
-    STANDALONE_SQL_PWD: $(ads-integration-test-standalone-server-password)
-    STANDALONE_SQL: $(ads-integration-test-standalone-server)
-    AZURE_SQL_USERNAME: $(ads-integration-test-azure-server-username)
-    AZURE_SQL_PWD: $(ads-integration-test-azure-server-password)
-    AZURE_SQL: $(ads-integration-test-azure-server)
-    STANDALONE_SQL_USERNAME_2019: $(ads-integration-test-standalone-server-username-2019)
-    STANDALONE_SQL_PWD_2019: $(ads-integration-test-standalone-server-password-2019)
-    STANDALONE_SQL_2019: $(ads-integration-test-standalone-server-2019)
-
 - task: PublishTestResults@2
   displayName: 'Publish Integration and Smoke Test Results'
   inputs:

build/builtin/.eslintrc

@@ -8,8 +8,8 @@
 		"no-console": 0,
 		"no-cond-assign": 0,
 		"no-unused-vars": 1,
-		"no-extra-semi": "warn",
-		"semi": "warn"
+		"no-extra-semi": "off",
+		"semi": "off"
 	},
 	"extends": "eslint:recommended",
 	"parserOptions": {
@@ -17,4 +17,4 @@
 			"experimentalObjectRestSpread": true
 		}
 	}
-}
+}

build/builtin/browser-main.js

@@ -2,6 +2,7 @@
  *  Copyright (c) Microsoft Corporation. All rights reserved.
  *  Licensed under the Source EULA. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
+//@ts-check
 
 const fs = require('fs');
 const path = require('path');
@@ -11,14 +12,28 @@ const { ipcRenderer } = require('electron');
 const builtInExtensionsPath = path.join(__dirname, '..', '..', 'product.json');
 const controlFilePath = path.join(os.homedir(), '.vscode-oss-dev', 'extensions', 'control.json');
 
+/**
+ * @param {string} filePath
+ */
 function readJson(filePath) {
 	return JSON.parse(fs.readFileSync(filePath, { encoding: 'utf8' }));
 }
 
+/**
+ * @param {string} filePath
+ * @param {any} obj
+ */
 function writeJson(filePath, obj) {
 	fs.writeFileSync(filePath, JSON.stringify(obj, null, 2));
 }
 
+/**
+ * @param {HTMLFormElement} form
+ * @param {string} id
+ * @param {string} title
+ * @param {string} value
+ * @param {boolean} checked
+ */
 function renderOption(form, id, title, value, checked) {
 	const input = document.createElement('input');
 	input.type = 'radio';
@@ -36,7 +51,14 @@ function renderOption(form, id, title, value, checked) {
 	return input;
 }
 
+/**
+ * @param {HTMLElement} el
+ * @param {any} state
+ */
 function render(el, state) {
+	/**
+	 * @param {any} state
+	 */
 	function setState(state) {
 		try {
 			writeJson(controlFilePath, state.control);
@@ -114,7 +136,9 @@ function main() {
 		control = {};
 	}
 
-	render(el, { builtin, control });
+	if (el) {
+		render(el, { builtin, control });
+	}
 }
 
 window.onload = main;

build/builtin/main.js

@@ -2,6 +2,7 @@
  *  Copyright (c) Microsoft Corporation. All rights reserved.
  *  Licensed under the Source EULA. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
+// @ts-check
 
 const { app, BrowserWindow, ipcMain, dialog } = require('electron');
 const url = require('url');

build/darwin/create-universal-app.js

@@ -8,22 +8,53 @@ const vscode_universal_bundler_1 = require("vscode-universal-bundler");
 const cross_spawn_promise_1 = require("@malept/cross-spawn-promise");
 const fs = require("fs-extra");
 const path = require("path");
-const plist = require("plist");
 const product = require("../../product.json");
+const glob = require("glob"); // {{SQL CARBON EDIT}}
 async function main() {
     const buildDir = process.env['AGENT_BUILDDIRECTORY'];
     const arch = process.env['VSCODE_ARCH'];
     if (!buildDir) {
         throw new Error('$AGENT_BUILDDIRECTORY not set');
     }
+    // {{SQL CARBON EDIT}}
+    const x64AppNameBase = 'azuredatastudio-darwin-x64';
+    const arm64AppNameBase = 'azuredatastudio-darwin-arm64';
+    // {{SQL CARBON EDIT}} - END
     const appName = product.nameLong + '.app';
-    const x64AppPath = path.join(buildDir, 'VSCode-darwin-x64', appName);
-    const arm64AppPath = path.join(buildDir, 'VSCode-darwin-arm64', appName);
+    const x64AppPath = path.join(buildDir, x64AppNameBase, appName); // {{SQL CARBON EDIT}} - CHANGE VSCode to azuredatastudio
+    const arm64AppPath = path.join(buildDir, arm64AppNameBase, appName); // {{SQL CARBON EDIT}} - CHANGE VSCode to azuredatastudio
     const x64AsarPath = path.join(x64AppPath, 'Contents', 'Resources', 'app', 'node_modules.asar');
     const arm64AsarPath = path.join(arm64AppPath, 'Contents', 'Resources', 'app', 'node_modules.asar');
-    const outAppPath = path.join(buildDir, `VSCode-darwin-${arch}`, appName);
+    const outAppPath = path.join(buildDir, `azuredatastudio-darwin-${arch}`, appName); // {{SQL CARBON EDIT}} - CHANGE VSCode to azuredatastudio
     const productJsonPath = path.resolve(outAppPath, 'Contents', 'Resources', 'app', 'product.json');
-    const infoPlistPath = path.resolve(outAppPath, 'Contents', 'Info.plist');
+    // {{SQL CARBON EDIT}}
+    // Current STS arm64 builds doesn't work on osx-arm64, we need to use the x64 version of STS on osx-arm64 until the issue is fixed.
+    // Tracked by: https://github.com/microsoft/azuredatastudio/issues/20775
+    // makeUniversalApp function will complain if the x64 ADS and arm64 ADS have the same STS binaries, to workaround the issue, we need
+    // to delete STS from both of them and then copy it to the universal app.
+    const stsPath = '/Contents/Resources/app/extensions/mssql/sqltoolsservice';
+    const tempSTSDir = path.join(buildDir, 'sqltoolsservice');
+    const x64STSDir = path.join(x64AppPath, stsPath);
+    const arm64STSDir = path.join(arm64AppPath, stsPath);
+    const targetSTSDirs = [x64STSDir, arm64STSDir];
+    // backup the x64 STS to a temporary directory, later it will be copied to the universal app directory.
+    await fs.copy(x64STSDir, tempSTSDir);
+    // delete STS directories from both x64 ADS and arm64 ADS.
+    console.debug(`Removing SqlToolsService folders.`);
+    targetSTSDirs.forEach(async (dir) => {
+        await fs.remove(dir);
+    });
+    // makeUniversalApp requires the non-binary files in arm64 and x64 versions to be exactly the same,
+    // but sometimes the content of nls.metadata.json files could be different(only the order of the entries).
+    // To workaround the issue, we need to replace these files in arm64 ADS with the files from x64 ADS.
+    // Tracked by issue: https://github.com/microsoft/azuredatastudio/issues/20792
+    const sourceFiles = glob.sync(path.join(x64AppPath, '/Contents/Resources/app/**/nls.metadata.json'));
+    sourceFiles.forEach(source => {
+        const target = source.replace(x64AppNameBase, arm64AppNameBase);
+        console.debug(`Replacing file '${target}' with '${source}'`);
+        fs.copySync(source, target, { overwrite: true });
+    });
+    // {{SQL CARBON EDIT}} - END
     await (0, vscode_universal_bundler_1.makeUniversalApp)({
         x64AppPath,
         arm64AppPath,
@@ -35,6 +66,7 @@ async function main() {
             'CodeResources',
             'fsevents.node',
             'Info.plist',
+            'MainMenu.nib',
             '.npmrc'
         ],
         outAppPath,
@@ -45,18 +77,15 @@ async function main() {
         darwinUniversalAssetId: 'darwin-universal'
     });
     await fs.writeJson(productJsonPath, productJson);
-    let infoPlistString = await fs.readFile(infoPlistPath, 'utf8');
-    let infoPlistJson = plist.parse(infoPlistString);
-    Object.assign(infoPlistJson, {
-        LSRequiresNativeExecution: true
-    });
-    await fs.writeFile(infoPlistPath, plist.build(infoPlistJson), 'utf8');
     // Verify if native module architecture is correct
     const findOutput = await (0, cross_spawn_promise_1.spawn)('find', [outAppPath, '-name', 'keytar.node']);
-    const lipoOutput = await (0, cross_spawn_promise_1.spawn)('lipo', ['-archs', findOutput.replace(/\n$/, "")]);
-    if (lipoOutput.replace(/\n$/, "") !== 'x86_64 arm64') {
+    const lipoOutput = await (0, cross_spawn_promise_1.spawn)('lipo', ['-archs', findOutput.replace(/\n$/, '')]);
+    if (lipoOutput.replace(/\n$/, '') !== 'x86_64 arm64') {
         throw new Error(`Invalid arch, got : ${lipoOutput}`);
     }
+    // {{SQL CARBON EDIT}}
+    console.debug(`Copying SqlToolsService to the universal app folder.`);
+    await fs.copy(tempSTSDir, path.join(outAppPath, stsPath), { overwrite: true });
 }
 if (require.main === module) {
     main().catch(err => {

build/darwin/create-universal-app.ts

@@ -9,8 +9,8 @@ import { makeUniversalApp } from 'vscode-universal-bundler';
 import { spawn } from '@malept/cross-spawn-promise';
 import * as fs from 'fs-extra';
 import * as path from 'path';
-import * as plist from 'plist';
 import * as product from '../../product.json';
+import * as glob from 'glob'; // {{SQL CARBON EDIT}}
 
 async function main() {
 	const buildDir = process.env['AGENT_BUILDDIRECTORY'];
@@ -20,14 +20,48 @@ async function main() {
 		throw new Error('$AGENT_BUILDDIRECTORY not set');
 	}
 
+	// {{SQL CARBON EDIT}}
+	const x64AppNameBase = 'azuredatastudio-darwin-x64';
+	const arm64AppNameBase = 'azuredatastudio-darwin-arm64';
+	// {{SQL CARBON EDIT}} - END
+
 	const appName = product.nameLong + '.app';
-	const x64AppPath = path.join(buildDir, 'VSCode-darwin-x64', appName);
-	const arm64AppPath = path.join(buildDir, 'VSCode-darwin-arm64', appName);
+	const x64AppPath = path.join(buildDir, x64AppNameBase, appName); // {{SQL CARBON EDIT}} - CHANGE VSCode to azuredatastudio
+	const arm64AppPath = path.join(buildDir, arm64AppNameBase, appName); // {{SQL CARBON EDIT}} - CHANGE VSCode to azuredatastudio
 	const x64AsarPath = path.join(x64AppPath, 'Contents', 'Resources', 'app', 'node_modules.asar');
 	const arm64AsarPath = path.join(arm64AppPath, 'Contents', 'Resources', 'app', 'node_modules.asar');
-	const outAppPath = path.join(buildDir, `VSCode-darwin-${arch}`, appName);
+	const outAppPath = path.join(buildDir, `azuredatastudio-darwin-${arch}`, appName); // {{SQL CARBON EDIT}} - CHANGE VSCode to azuredatastudio
 	const productJsonPath = path.resolve(outAppPath, 'Contents', 'Resources', 'app', 'product.json');
-	const infoPlistPath = path.resolve(outAppPath, 'Contents', 'Info.plist');
+
+	// {{SQL CARBON EDIT}}
+	// Current STS arm64 builds doesn't work on osx-arm64, we need to use the x64 version of STS on osx-arm64 until the issue is fixed.
+	// Tracked by: https://github.com/microsoft/azuredatastudio/issues/20775
+	// makeUniversalApp function will complain if the x64 ADS and arm64 ADS have the same STS binaries, to workaround the issue, we need
+	// to delete STS from both of them and then copy it to the universal app.
+	const stsPath = '/Contents/Resources/app/extensions/mssql/sqltoolsservice';
+	const tempSTSDir = path.join(buildDir, 'sqltoolsservice');
+	const x64STSDir = path.join(x64AppPath, stsPath);
+	const arm64STSDir = path.join(arm64AppPath, stsPath);
+	const targetSTSDirs = [x64STSDir, arm64STSDir];
+	// backup the x64 STS to a temporary directory, later it will be copied to the universal app directory.
+	await fs.copy(x64STSDir, tempSTSDir);
+	// delete STS directories from both x64 ADS and arm64 ADS.
+	console.debug(`Removing SqlToolsService folders.`);
+	targetSTSDirs.forEach(async dir => {
+		await fs.remove(dir);
+	});
+
+	// makeUniversalApp requires the non-binary files in arm64 and x64 versions to be exactly the same,
+	// but sometimes the content of nls.metadata.json files could be different(only the order of the entries).
+	// To workaround the issue, we need to replace these files in arm64 ADS with the files from x64 ADS.
+	// Tracked by issue: https://github.com/microsoft/azuredatastudio/issues/20792
+	const sourceFiles = glob.sync(path.join(x64AppPath, '/Contents/Resources/app/**/nls.metadata.json'));
+	sourceFiles.forEach(source => {
+		const target = source.replace(x64AppNameBase, arm64AppNameBase);
+		console.debug(`Replacing file '${target}' with '${source}'`);
+		fs.copySync(source, target, { overwrite: true });
+	});
+	// {{SQL CARBON EDIT}} - END
 
 	await makeUniversalApp({
 		x64AppPath,
@@ -40,6 +74,7 @@ async function main() {
 			'CodeResources',
 			'fsevents.node',
 			'Info.plist', // TODO@deepak1556: regressed with 11.4.2 internal builds
+			'MainMenu.nib', // Generated sequence is not deterministic with Xcode 13
 			'.npmrc'
 		],
 		outAppPath,
@@ -52,19 +87,16 @@ async function main() {
 	});
 	await fs.writeJson(productJsonPath, productJson);
 
-	let infoPlistString = await fs.readFile(infoPlistPath, 'utf8');
-	let infoPlistJson = plist.parse(infoPlistString);
-	Object.assign(infoPlistJson, {
-		LSRequiresNativeExecution: true
-	});
-	await fs.writeFile(infoPlistPath, plist.build(infoPlistJson), 'utf8');
-
 	// Verify if native module architecture is correct
-	const findOutput = await spawn('find', [outAppPath, '-name', 'keytar.node'])
-	const lipoOutput = await spawn('lipo', ['-archs', findOutput.replace(/\n$/, "")]);
-	if (lipoOutput.replace(/\n$/, "") !== 'x86_64 arm64') {
-		throw new Error(`Invalid arch, got : ${lipoOutput}`)
+	const findOutput = await spawn('find', [outAppPath, '-name', 'keytar.node']);
+	const lipoOutput = await spawn('lipo', ['-archs', findOutput.replace(/\n$/, '')]);
+	if (lipoOutput.replace(/\n$/, '') !== 'x86_64 arm64') {
+		throw new Error(`Invalid arch, got : ${lipoOutput}`);
 	}
+
+	// {{SQL CARBON EDIT}}
+	console.debug(`Copying SqlToolsService to the universal app folder.`);
+	await fs.copy(tempSTSDir, path.join(outAppPath, stsPath), { overwrite: true });
 }
 
 if (require.main === module) {