Use ESRP for publishig

Author: edvilme

pythonEnvironmentsApi/.npmignore api/.npmignorepythonEnvironmentsApi/.npmignore renamed to api/.npmignore

@@ -18,7 +18,7 @@
         "vscode": "^1.110.0"
     },
     "license": "MIT",
-    "homepage": "https://github.com/microsoft/vscode-python-environments/tree/main/pythonEnvironmentsApi",
+    "homepage": "https://github.com/microsoft/vscode-python-environments/tree/main/api",
     "repository": {
         "type": "git",
         "url": "https://github.com/microsoft/vscode-python-environments"

pythonEnvironmentsApi/LICENSE.md api/LICENSE.mdpythonEnvironmentsApi/LICENSE.md renamed to api/LICENSE.md

@@ -24,58 +24,21 @@ parameters:
     type: boolean
     default: false
 
-  - name: publishToConsumptionFeed
-    displayName: 📡 Publish to msft_consumption feed
-    type: boolean
-    default: false
-
-  - name: buildSteps
-    type: stepList
-    default:
-      - task: NodeTool@0
-        inputs:
-          versionSpec: '22.21.1'
-        displayName: Select Node version
-
-      - script: npm install
-        workingDirectory: $(Build.SourcesDirectory)/pythonEnvironmentsApi
-        displayName: Install package dependencies
-
-      - script: npm run compile
-        workingDirectory: $(Build.SourcesDirectory)/pythonEnvironmentsApi
-        displayName: Compile TypeScript
-
-      - script: npm pack --ignore-scripts
-        workingDirectory: $(Build.SourcesDirectory)/pythonEnvironmentsApi
-        displayName: Pack npm package
-
 variables:
   - name: TeamName
     value: vscode-python-environments
   - name: PackageName
     value: '@vscode/python-environments'
   - name: PackageDir
-    value: pythonEnvironmentsApi
+    value: api
   - name: npmTag
     ${{ if eq(parameters.quality, 'preview') }}:
       value: next
     ${{ else }}:
       value: latest
-  - name: AzureArtifactsFeedUrl
-    value: 'https://pkgs.dev.azure.com/azure-public/vside/_packaging/python-environments/npm/registry/'
-  # Same URL without the https:// prefix (used in .npmrc auth lines)
-  - name: AzureArtifactsFeedUrlNoProtocol
-    value: 'pkgs.dev.azure.com/azure-public/vside/_packaging/python-environments/npm/registry/'
-  # Managed Identity service connection for Azure Artifacts auth (shared with Pylance)
-  - name: AzureServiceConnection
-    value: 'PylanceSecureVsIdePublishWithManagedIdentity'
-  - name: ConsumptionFeedUrl
-    value: 'https://pkgs.dev.azure.com/azure-public/vside/_packaging/msft_consumption/npm/registry/'
-  - name: ConsumptionFeedUrlNoProtocol
-    value: 'pkgs.dev.azure.com/azure-public/vside/_packaging/msft_consumption/npm/registry/'
 
 extends:
-  template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
+  template: azure-pipelines/MicroBuild.1ES.Official.Publish.yml@MicroBuildTemplate
   parameters:
     sdl:
       sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
@@ -103,122 +66,44 @@ extends:
                   targetPath: $(Build.ArtifactStagingDirectory)
                   artifactName: npm-package
             steps:
-              - ${{ each step in parameters.buildSteps }}:
-                  - ${{ step }}
+              - task: NodeTool@0
+                inputs:
+                  versionSpec: '22.21.1'
+                displayName: Select Node version
+
+              - script: npm install
+                workingDirectory: $(Build.SourcesDirectory)/api
+                displayName: Install package dependencies
+
+              - script: npm run compile
+                workingDirectory: $(Build.SourcesDirectory)/api
+                displayName: Compile TypeScript
+
+              - script: npm pack --ignore-scripts
+                workingDirectory: $(Build.SourcesDirectory)/api
+                displayName: Pack npm package
 
               - task: CopyFiles@2
                 displayName: Copy package tarball to staging
                 inputs:
-                  sourceFolder: $(Build.SourcesDirectory)/pythonEnvironmentsApi
+                  sourceFolder: $(Build.SourcesDirectory)/api
                   contents: '*.tgz'
                   targetFolder: $(Build.ArtifactStagingDirectory)
 
-      - stage: Publish
-        displayName: Publish to Azure Artifacts
+      - stage: Publish to NPM
+        displayName: Publish to NPM
         dependsOn: Build
         condition: and(succeeded(), eq('${{ parameters.publishPackage }}', 'true'))
         jobs:
           - job: PublishPackage
-            displayName: Publish $(PackageName)
-            templateContext:
-              type: releaseJob
-              isProduction: true
-              inputs:
-                - input: pipelineArtifact
-                  artifactName: npm-package
-                  targetPath: $(Pipeline.Workspace)/npm-package
+            displayName: Publish npm package
             steps:
-              - checkout: none
-
-              - task: NodeTool@0
-                inputs:
-                  versionSpec: '22.21.1'
-                displayName: Select Node version
-
-              # Acquire a short-lived AAD token via Managed Identity (no stored secrets)
-              # SEE https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-security-configuration/configuration-guides/pat-burndown-guidance
-              - task: AzureCLI@2
-                displayName: Acquire AAD token via Managed Identity
-                inputs:
-                  azureSubscription: '$(AzureServiceConnection)'
-                  scriptType: 'pscore'
-                  scriptLocation: 'inlineScript'
-                  inlineScript: |
-                    $token = az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv
-                    Write-Host "##vso[task.setvariable variable=AzdoToken;issecret=true]$token"
-
-              - powershell: |
-                  @"
-                  registry=$(AzureArtifactsFeedUrl)
-                  always-auth=true
-                  "@ | Out-File -FilePath .npmrc
-
-                  @"
-                  ; begin auth token
-                  //$(AzureArtifactsFeedUrlNoProtocol):username=VssSessionToken
-                  //$(AzureArtifactsFeedUrlNoProtocol):_authToken=$env:AZDO_TOKEN
-                  //$(AzureArtifactsFeedUrlNoProtocol):email=not-used@example.com
-                  ; end auth token
-                  "@ | Out-File -FilePath $HOME/.npmrc
-                env:
-                  AZDO_TOKEN: $(AzdoToken)
-                displayName: Create .npmrc files
-
-              - powershell: |
-                  $tgz = Get-ChildItem "$(Pipeline.Workspace)/npm-package/*.tgz" | Select-Object -First 1
-                  if (-not $tgz) {
-                      Write-Error "No .tgz file found in $(Pipeline.Workspace)/npm-package/"
-                      exit 1
-                  }
-                  Write-Host "Publishing: $($tgz.FullName)"
-                  if ("$(npmTag)" -eq "next") {
-                      npm publish $tgz.FullName --registry $(AzureArtifactsFeedUrl) --tag next --ignore-scripts
-                  } else {
-                      npm publish $tgz.FullName --registry $(AzureArtifactsFeedUrl) --ignore-scripts
-                  }
-                displayName: npm publish (${{ parameters.quality }})
-
-      - stage: PublishConsumption
-        displayName: Publish package to msft_consumption feed
-        dependsOn: Publish
-        condition: and(not(failed()), eq('${{ parameters.publishToConsumptionFeed }}', 'true'))
-        jobs:
-          - job: PullToConsumption
-            displayName: Pull $(PackageName) to msft_consumption
-            steps:
-              - checkout: none
-
-              - task: NodeTool@0
-                inputs:
-                  versionSpec: '22.21.1'
-                displayName: Select Node version
-
-              - task: AzureCLI@2
-                displayName: Acquire AAD token via Managed Identity
-                inputs:
-                  azureSubscription: '$(AzureServiceConnection)'
-                  scriptType: 'pscore'
-                  scriptLocation: 'inlineScript'
-                  inlineScript: |
-                    $token = az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv
-                    Write-Host "##vso[task.setvariable variable=AzdoToken;issecret=true]$token"
-
-              - powershell: |
-                  @"
-                  registry=$(ConsumptionFeedUrl)
-                  always-auth=true
-                  "@ | Out-File -FilePath .npmrc
-
-                  @"
-                  ; begin auth token
-                  //$(ConsumptionFeedUrlNoProtocol):username=VssSessionToken
-                  //$(ConsumptionFeedUrlNoProtocol):_authToken=$env:AZDO_TOKEN
-                  //$(ConsumptionFeedUrlNoProtocol):email=not-used@example.com
-                  ; end auth token
-                  "@ | Out-File -FilePath $HOME/.npmrc
-                env:
-                  AZDO_TOKEN: $(AzdoToken)
-                displayName: Create .npmrc files
-
-              - script: npm i -g $(PackageName)@$(npmTag) --registry $(ConsumptionFeedUrl)
-                displayName: Pull to msft_consumption
+              - template: MicroBuild.Publish.yml@MicroBuildTemplate
+                parameters:
+                  intent: 'PackageDistribution'
+                  contentType: 'npm'
+                  contentSource: 'Folder'
+                  folderLocation: '$(Build.ArtifactStagingDirectory)'
+                  waitForReleaseCompletion: true
+                  owners: 'plseng@microsoft.com'
+                  approvers: 'eduardovil@microsoft.com;grwheele@microsoft.com'

pythonEnvironmentsApi/README.md api/README.mdpythonEnvironmentsApi/README.md renamed to api/README.md

@@ -17,5 +17,5 @@
         "resolveJsonModule": true,
         "removeComments": true
     },
-    "exclude": ["examples", "pythonEnvironmentsApi"]
+    "exclude": ["examples", "api"]
 }