Fix MSIX stage in release pipeline (#24900)

Co-authored-by: Justin Chung <chungjustin@microsoft.com>
Co-authored-by: Travis Plunk <travis.plunk@microsoft.com>

.pipelines/PowerShell-Release-Official.yml

@@ -202,8 +202,10 @@ extends:
           displayName: 'Validate Linux ARM64 Fxd Packages'
           jobtype: 'linux'
           artifactName: 'drop_linux_package_fxdependent'
+          # this is really an architecture independent package
           packageNamePattern: '**/*linux-x64-fxdependent.tar.gz'
           arm64: 'yes'
+          enableCredScan: false
 
     - stage: validatePackages
       displayName: 'Validate Packages'
@@ -331,25 +333,20 @@ extends:
       displayName: Publish PMC
       dependsOn: PushGitTagAndMakeDraftPublic
       jobs:
-      - template: /.pipelines/templates/release-publish-pmc.yml@self
+      - template: /.pipelines/templates/approvalJob.yml@self
         parameters:
-          skipPublish: ${{ parameters.SkipPMCPublish }}
+          displayName: Publish to PMC
+          jobName: ReleaseToPMC
+          instructions: |
+            Run PowerShell-Release-Official-Azure.yml pipeline to publish to PMC
 
     - stage: ReleaseDocker
       dependsOn: PushGitTagAndMakeDraftPublic
       displayName: 'Docker Release'
       jobs:
-      - template: /.pipelines/templates/approvalJob.yml@self
-        parameters:
-          displayName: Start Docker Build
-          jobName: StartDockerBuild
-          instructions: |
-            Kick off Docker build
-
       - template: /.pipelines/templates/approvalJob.yml@self
         parameters:
           displayName: Start Docker Release
-          dependsOnJob: StartDockerBuild
           jobName: StartDockerRelease
           instructions: |
             Kickoff docker release

.pipelines/templates/release-create-msix.yml

@@ -28,24 +28,38 @@ jobs:
       displayName: Download x86 msix
       patterns: '**/*.msix'
 
-    - task: AzurePowerShell@5
-      displayName: Install makeappx tool
-      retryCountOnTaskFailure: 1
-      inputs:
-        azureSubscription: az-blob-cicd-infra
-        scriptType: inlineScript
-        azurePowerShellVersion: LatestVersion
-        pwsh: true
-        inline: |
-          $toolsDir = '$(Pipeline.Workspace)\releasePipeline\tools'
-          New-Item $toolsDir -Type Directory -Force > $null
-          Invoke-RestMethod -Uri '$(makeappUrlDirect)' -OutFile "$toolsDir\makeappx.zip"
-          Expand-Archive "$toolsDir\makeappx.zip" -DestinationPath "$toolsDir\makeappx" -Force
-          $exePath = "$toolsDir\makeappx\makeappx.exe"
+    - pwsh: |
+        $azureRmModule = Get-InstalledModule AzureRM -ErrorAction SilentlyContinue -Verbose
+        if ($azureRmModule) {
+          Write-Host 'AzureRM module exists. Removing it'
+          Uninstall-AzureRm
+          Write-Host 'AzureRM module removed'
+        }
 
-          $vstsCommandString = "vso[task.setvariable variable=MakeAppxPath]$exePath"
-          Write-Host "sending " + $vstsCommandString
-          Write-Host "##$vstsCommandString"
+        Install-Module -Name Az.Storage -Force -AllowClobber -Scope CurrentUser -Verbose
+      displayName: Remove AzRM modules and install Az.Storage
+
+    
+    # Finds the makeappx tool on the machine with image: 'onebranch.azurecr.io/windows/ltsc2022/vse2022:latest'
+    - pwsh: |
+        $cmd = Get-Command makeappx.exe -ErrorAction Ignore
+        if ($cmd) {
+            Write-Verbose -Verbose 'makeappx available in PATH'
+            $exePath = $cmd.Source
+        } else {
+            $toolsDir = '$(Pipeline.Workspace)\releasePipeline\tools'
+            New-Item $toolsDir -Type Directory -Force > $null
+            $makeappx = Get-ChildItem -Recurse 'C:\Program Files (x86)\Windows Kits\10\makeappx.exe' |
+              Where-Object { $_.DirectoryName -match 'x64' } |
+              Select-Object -Last 1
+            $exePath = $makeappx.FullName
+            Write-Verbose -Verbose 'makeappx was found:'
+        }
+        $vstsCommandString = "vso[task.setvariable variable=MakeAppxPath]$exePath"
+        Write-Host "sending " + $vstsCommandString
+        Write-Host "##$vstsCommandString"
+      displayName: Find makeappx tool
+      retryCountOnTaskFailure: 1
 
     - pwsh: |
         $sourceDir = '$(Pipeline.Workspace)\releasePipeline\msix'
@@ -73,18 +87,6 @@ jobs:
       displayName: Create MsixBundle
       retryCountOnTaskFailure: 1
 
-    - pwsh: |
-        $azureRmModule = Get-InstalledModule AzureRM -ErrorAction SilentlyContinue -Verbose
-        if ($azureRmModule) {
-          Write-Host 'AzureRM module exists. Removing it'
-          Uninstall-AzureRm
-          Write-Host 'AzureRM module removed'
-        }
-
-        Install-Module -Name Az.Storage -Force -AllowClobber -Scope CurrentUser -Verbose
-
-      displayName: Remove AzRM modules and install Az.Storage
-
     - task: AzurePowerShell@5
       displayName: Upload msix to blob
       inputs:

.pipelines/templates/release-validate-fxdpackages.yml

@@ -1,10 +1,25 @@
 parameters:
-  jobName: ""
-  displayName: ""
-  jobtype: ""
-  artifactName: ""
-  packageNamePattern: ""
-  arm64: "no"
+  - name: jobName
+    type: string
+    default: ""
+  - name: displayName
+    type: string
+    default: ""
+  - name: jobtype
+    type: string
+    default: ""
+  - name: artifactName
+    type: string
+    default: ""
+  - name: packageNamePattern
+    type: string
+    default: ""
+  - name: arm64
+    type: string
+    default: "no"
+  - name: enableCredScan
+    type: boolean
+    default: true
 
 jobs:
 - job: ${{ parameters.jobName }}
@@ -19,6 +34,8 @@ jobs:
     value: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
   - name: ob_sdl_tsa_configFile
     value: $(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
+  - name: ob_sdl_credscan_enabled
+    value: ${{ parameters.enableCredScan }}
 
   pool:
     type: ${{ parameters.jobtype }}

.pipelines/templates/uploadToAzure.yml

@@ -6,7 +6,7 @@ jobs:
     type: windows
   variables:
   - name: ob_sdl_sbom_enabled
-    value: false
+    value: true
   - name: runCodesignValidationInjection
     value: false
   - name: NugetSecurityAnalysisWarningLevel
@@ -241,7 +241,7 @@ jobs:
       Write-Verbose -Verbose "Creating output directory for GitHub Release files: $(ob_outputDirectory)/GitHubPackages"
       New-Item -Path $(ob_outputDirectory)/GitHubPackages -ItemType Directory -Force
       Get-ChildItem -Path "$(Build.ArtifactStagingDirectory)/downloads/*" -Recurse | 
-        Where-Object { $_.Extension -notin '.msix', '.nupkg' } | 
+        Where-Object { $_.Extension -notin '.msix', '.nupkg' -and $_.Name -notmatch '-gc'} | 
         Copy-Item -Destination $(ob_outputDirectory)/GitHubPackages -Recurse -Verbose
       
       Write-Verbose -Verbose "Creating output directory for NuGet packages: $(ob_outputDirectory)/NuGetPackages"