vscode/build/azure-pipelines/product-publish.yml

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: "16.x"

  - task: AzureKeyVault@1
    displayName: "Azure Key Vault: Get Secrets"
    inputs:
      azureSubscription: "vscode-builds-subscription"
      KeyVaultName: vscode
      SecretsFilter: "github-distro-mixin-password"

  - script: |
      set -e
      cat << EOF > ~/.netrc
      machine github.com
      login vscode
      password $(github-distro-mixin-password)
      EOF

      git config user.email "vscode@microsoft.com"
      git config user.name "VSCode"      
    displayName: Prepare tooling

  - script: |
      set -e
      git fetch https://github.com/$(VSCODE_MIXIN_REPO).git $VSCODE_DISTRO_REF
      echo "##vso[task.setvariable variable=VSCODE_DISTRO_COMMIT;]$(git rev-parse FETCH_HEAD)"
      git checkout FETCH_HEAD      
    condition: and(succeeded(), ne(variables.VSCODE_DISTRO_REF, ' '))
    displayName: Checkout override commit

  - script: |
      set -e
      git pull --no-rebase https://github.com/$(VSCODE_MIXIN_REPO).git $(node -p "require('./package.json').distro")      
    displayName: Merge distro

  - pwsh: |
      . build/azure-pipelines/win32/exec.ps1
      cd build
      exec { yarn }      
    displayName: Install build dependencies

  - download: current
    patterns: "**/artifacts_processed_*.txt"
    displayName: Download all artifacts_processed text files

  - task: AzureCLI@2
    inputs:
      azureSubscription: "vscode-builds-subscription"
      scriptType: pscore
      scriptLocation: inlineScript
      addSpnToEnvironment: true
      inlineScript: |
        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"        

  - task: AzureCLI@2
    inputs:
      azureSubscription: "vscode-builds-mooncake-subscription"
      scriptType: pscore
      scriptLocation: inlineScript
      addSpnToEnvironment: true
      inlineScript: |
        Write-Host "##vso[task.setvariable variable=AZURE_MOONCAKE_TENANT_ID]$env:tenantId"
        Write-Host "##vso[task.setvariable variable=AZURE_MOONCAKE_CLIENT_ID]$env:servicePrincipalId"
        Write-Host "##vso[task.setvariable variable=AZURE_MOONCAKE_CLIENT_SECRET;issecret=true]$env:servicePrincipalKey"        

  - pwsh: |
      . build/azure-pipelines/win32/exec.ps1

      if (Test-Path "$(Pipeline.Workspace)/artifacts_processed_*/artifacts_processed_*.txt") {
        Write-Host "Artifacts already processed so a build must have already been created."
        return
      }

      $env:AZURE_TENANT_ID = "$(AZURE_TENANT_ID)"
      $env:AZURE_CLIENT_ID = "$(AZURE_CLIENT_ID)"
      $env:AZURE_CLIENT_SECRET = "$(AZURE_CLIENT_SECRET)"
      $VERSION = node -p "require('./package.json').version"
      Write-Host "Creating build with version: $VERSION"
      exec { node build/azure-pipelines/common/createBuild.js $VERSION }      
    displayName: Create build if it hasn't been created before

  - pwsh: |
      $env:VSCODE_MIXIN_PASSWORD = "$(github-distro-mixin-password)"
      $env:AZURE_TENANT_ID = "$(AZURE_TENANT_ID)"
      $env:AZURE_CLIENT_ID = "$(AZURE_CLIENT_ID)"
      $env:AZURE_CLIENT_SECRET = "$(AZURE_CLIENT_SECRET)"
      $env:AZURE_MOONCAKE_TENANT_ID = "$(AZURE_MOONCAKE_TENANT_ID)"
      $env:AZURE_MOONCAKE_CLIENT_ID = "$(AZURE_MOONCAKE_CLIENT_ID)"
      $env:AZURE_MOONCAKE_CLIENT_SECRET = "$(AZURE_MOONCAKE_CLIENT_SECRET)"
      build/azure-pipelines/product-publish.ps1      
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
    displayName: Process artifacts

  - publish: $(Pipeline.Workspace)/artifacts_processed_$(System.StageAttempt)/artifacts_processed_$(System.StageAttempt).txt
    artifact: artifacts_processed_$(System.StageAttempt)
    displayName: Publish what artifacts were published for this stage attempt
    condition: always()

  - pwsh: |
      $ErrorActionPreference = 'Stop'

      # Determine which stages we need to watch
      $stages = @(
        if ($env:VSCODE_BUILD_STAGE_WINDOWS -eq 'True') { 'Windows' }
        if ($env:VSCODE_BUILD_STAGE_LINUX -eq 'True') { 'Linux' }
        if ($env:VSCODE_BUILD_STAGE_MACOS -eq 'True') { 'macOS' }
      )
      Write-Host "Stages to check: $stages"

      # Get the timeline and see if it says the other stage completed
      $timeline = Invoke-RestMethod "$($env:BUILDS_API_URL)timeline?api-version=6.0" -Headers @{
        Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN"
      }  -MaximumRetryCount 5 -RetryIntervalSec 1

      $failedStages = @()
      foreach ($stage in $stages) {
        $didStageFail = $timeline.records | Where-Object {
          $_.name -eq $stage -and $_.type -eq 'stage' -and $_.result -ne 'succeeded' -and $_.result -ne 'succeededWithIssues'
        }

        if($didStageFail) {
          $failedStages += $stage
        } else {
          Write-Host "'$stage' did not fail."
        }
      }

      if ($failedStages.Length) {
        throw "Failed stages: $($failedStages -join ', '). This stage will now fail so that it is easier to retry failed jobs."
      }      
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
    displayName: Determine if stage should succeed