Get Azure Pipelines building

We're switching (back) from GitHub Actions to Azure Pipelines because GitHub Actions is prohibitively expensive and Azure Pipelines is free.

azure-pipelines.yml

@@ -13,10 +13,6 @@ trigger:
     - azure-pipelines/release.yml
 
 parameters:
-- name: includeMacOS
-  displayName: Build on macOS
-  type: boolean
-  default: false # macOS is often bogged down in Azure Pipelines
 - name: RunTests
   displayName: Run tests
   type: boolean
@@ -25,12 +21,11 @@ parameters:
 variables:
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
   BuildConfiguration: Release
-  #codecov_token: # Get a new one from https://codecov.io/
-  #ci_feed: # Azure Artifacts feed URL
+  codecov_token: 38462e91-92d5-4fa6-be55-f363099a3e15
+  ci_feed: https://pkgs.dev.azure.com/andrewarnott/OSS/_packaging/PublicCI/nuget/v3/index.json
   NUGET_PACKAGES: $(Agent.TempDirectory)/.nuget/packages/
 
 jobs:
 - template: azure-pipelines/build.yml
   parameters:
-    includeMacOS: ${{ parameters.includeMacOS }}
     RunTests: ${{ parameters.RunTests }}

azure-pipelines/artifacts/rust.ps1

@@ -0,0 +1,7 @@
+if (!(Test-Path "obj/src/nerdbank-zcash-rust/")) { return }
+
+$root = 'obj/src/nerdbank-zcash-rust/'
+
+@{
+    $root = Get-ChildItem $root -Recurse
+}

azure-pipelines/build.yml

@@ -5,6 +5,7 @@ parameters:
     vmImage: windows-2022
 - name: includeMacOS
   type: boolean
+  default: true
 - name: RunTests
   type: boolean
   default: true
@@ -21,6 +22,12 @@ jobs:
   - script: dotnet nbgv cloud -c
     displayName: ⚙ Set build number
 
+  - pwsh: src/nerdbank-zcash-rust/build_all.ps1 -Release
+    displayName: 🛠️ cargo build
+  - pwsh: cargo test -r --target x86_64-pc-windows-msvc
+    displayName: 🧪 cargo test
+    workingDirectory: src/nerdbank-zcash-rust
+
   - template: dotnet.yml
     parameters:
       RunTests: ${{ parameters.RunTests }}
@@ -33,6 +40,13 @@ jobs:
     fetchDepth: 0 # avoid shallow clone so nbgv can do its work.
     clean: true
   - template: install-dependencies.yml
+
+  - pwsh: src/nerdbank-zcash-rust/build_all.ps1 -Release
+    displayName: 🛠️ cargo build
+  - pwsh: cargo test -r --target x86_64-unknown-linux-gnu
+    displayName: 🧪 cargo test
+    workingDirectory: src/nerdbank-zcash-rust
+
   - template: dotnet.yml
     parameters:
       RunTests: ${{ parameters.RunTests }}
@@ -48,24 +62,45 @@ jobs:
     fetchDepth: 0 # avoid shallow clone so nbgv can do its work.
     clean: true
   - template: install-dependencies.yml
+
+  - pwsh: src/nerdbank-zcash-rust/build_all.ps1 -Release
+    displayName: 🛠️ cargo build
+  - pwsh: cargo test -r --target x86_64-apple-darwin
+    displayName: 🧪 cargo test
+    workingDirectory: src/nerdbank-zcash-rust
+
   - template: dotnet.yml
     parameters:
       RunTests: ${{ parameters.RunTests }}
 
-- job: WrapUp
+- job: Pack
   dependsOn:
   - Windows
   - Linux
   - macOS
+  pool:
+    vmImage: Ubuntu 20.04
+  variables:
+  - ${{ if eq(variables['System.TeamFoundationCollectionUri'], 'https://dev.azure.com/andrewarnott/') }}:
+    - group: dotnetfoundation code signing
+  steps:
+  - checkout: self
+    fetchDepth: 0 # avoid shallow clone so nbgv can do its work.
+    clean: true
+  - template: install-dependencies.yml
+  - template: pack.yml
+
+- job: WrapUp
+  dependsOn:
+  - Pack
   pool: ${{ parameters.windowsPool }} # Use Windows agent because PublishSymbols task requires it (https://github.com/microsoft/azure-pipelines-tasks/issues/13821).
   condition: succeededOrFailed()
   steps:
   - checkout: self
     fetchDepth: 0 # avoid shallow clone so nbgv can do its work.
     clean: true
   - template: install-dependencies.yml
-    parameters:
-      initArgs: -NoRestore
+  - template: pack.yml
   - template: publish-symbols.yml
     parameters:
       includeMacOS: ${{ parameters.includeMacOS }}

azure-pipelines/pack.yml

@@ -0,0 +1,47 @@
+steps:
+- task: DownloadPipelineArtifact@2
+  displayName: 🔻 Download Windows code coverage results
+  inputs:
+    buildType: current
+    targetPath: obj/src/nerdbank-zcash-rust
+    artifactName: rust-Windows
+- task: DownloadPipelineArtifact@2
+  displayName: 🔻 Download Linux code coverage results
+  inputs:
+    buildType: current
+    targetPath: obj/src/nerdbank-zcash-rust
+    artifactName: rust-Linux
+- task: DownloadPipelineArtifact@2
+  displayName: 🔻 Download macOS code coverage results
+  inputs:
+    buildType: current
+    targetPath: obj/src/nerdbank-zcash-rust
+    artifactName: rust-macOS
+
+- script: dotnet pack --no-restore -c $(BuildConfiguration) -warnaserror /bl:"$(Build.ArtifactStagingDirectory)/build_logs/pack.binlog"
+  displayName: 🛠 build
+
+- pwsh: >
+    dotnet tool install --tool-path obj SignClient
+
+    obj/SignClient sign
+    --baseDirectory 'bin/Packages/$(BuildConfiguration)'
+    --input '**/*'
+    --config '$(System.DefaultWorkingDirectory)/azure-pipelines/SignClient.json'
+    --filelist '$(System.DefaultWorkingDirectory)/azure-pipelines/signfiles.txt'
+    --user '$(codesign_username)'
+    --secret '$(codesign_secret)'
+    --name 'Nerdbank.GitVersioning'
+    --descriptionUrl 'https://github.com/dotnet/Nerdbank.GitVersioning'
+  displayName: 🔏 Code sign
+  condition: and(succeeded(), eq(variables['System.TeamFoundationCollectionUri'], 'https://dev.azure.com/andrewarnott/'), eq(variables['Agent.OS'], 'Windows_NT'), ne(variables['Build.Reason'], 'PullRequest'))
+
+- powershell: azure-pipelines/variables/_pipelines.ps1
+  failOnStderr: true
+  displayName: ⚙ Update pipeline variables based on build outputs
+  condition: succeededOrFailed()
+
+- powershell: azure-pipelines/artifacts/_pipelines.ps1 -ArtifactNameSuffix "-$(Agent.JobName)" -Verbose
+  failOnStderr: true
+  displayName: 📢 Publish artifacts
+  condition: succeededOrFailed()

azure-pipelines/signfiles.txt

@@ -1,3 +1,4 @@
+**/Nerdbank.Bitcoin.dll
 **/Nerdbank.Cryptocurrencies.dll
 **/Nerdbank.Zcash.dll
 **/*nerdbank_zcash_rust*