[release/v7.5] Fix MSIX stage in release pipeline (#25345)

Co-authored-by: Justin Chung <124807742+jshigetomi@users.noreply.github.com>
Co-authored-by: Travis Plunk <travis.plunk@microsoft.com>

.pipelines/PowerShell-Release-Official.yml

@@ -204,8 +204,10 @@ extends:
           displayName: 'Validate Linux ARM64 Fxd Packages'
           jobtype: 'linux'
           artifactName: 'drop_linux_package_fxdependent'
+          # this is really an architecture independent package
           packageNamePattern: '**/*linux-x64-fxdependent.tar.gz'
           arm64: 'yes'
+          enableCredScan: false
 
     - stage: validatePackages
       displayName: 'Validate Packages'
@@ -333,25 +335,20 @@ extends:
       displayName: Publish PMC
       dependsOn: PushGitTagAndMakeDraftPublic
       jobs:
-      - template: /.pipelines/templates/release-publish-pmc.yml@self
+      - template: /.pipelines/templates/approvalJob.yml@self
         parameters:
-          skipPublish: ${{ parameters.SkipPMCPublish }}
+          displayName: Publish to PMC
+          jobName: ReleaseToPMC
+          instructions: |
+            Run PowerShell-Release-Official-Azure.yml pipeline to publish to PMC
 
     - stage: ReleaseDocker
       dependsOn: PushGitTagAndMakeDraftPublic
       displayName: 'Docker Release'
       jobs:
-      - template: /.pipelines/templates/approvalJob.yml@self
-        parameters:
-          displayName: Start Docker Build
-          jobName: StartDockerBuild
-          instructions: |
-            Kick off Docker build
-
       - template: /.pipelines/templates/approvalJob.yml@self
         parameters:
           displayName: Start Docker Release
-          dependsOnJob: StartDockerBuild
           jobName: StartDockerRelease
           instructions: |
             Kickoff docker release

.pipelines/templates/release-create-msix.yml

@@ -37,18 +37,16 @@ jobs:
         } else {
             $toolsDir = '$(Pipeline.Workspace)\releasePipeline\tools'
             New-Item $toolsDir -Type Directory -Force > $null
-            Invoke-RestMethod -Uri '$(makeappUrl)' -OutFile "$toolsDir\makeappx.zip"
-            Expand-Archive "$toolsDir\makeappx.zip" -DestinationPath "$toolsDir\makeappx" -Force
-            $exePath = "$toolsDir\makeappx\makeappx.exe"
-
-            Write-Verbose -Verbose 'makeappx was installed:'
-            Get-ChildItem -Path $toolsDir -Recurse
+            $makeappx = Get-ChildItem -Recurse 'C:\Program Files (x86)\Windows Kits\10\makeappx.exe' |
+              Where-Object { $_.DirectoryName -match 'x64' } |
+              Select-Object -Last 1
+            $exePath = $makeappx.FullName
+            Write-Verbose -Verbose 'makeappx was found:'
         }
-
         $vstsCommandString = "vso[task.setvariable variable=MakeAppxPath]$exePath"
         Write-Host "sending " + $vstsCommandString
         Write-Host "##$vstsCommandString"
-      displayName: Install makeappx tool
+      displayName: Find makeappx tool
       retryCountOnTaskFailure: 1
 
     - pwsh: |
@@ -77,18 +75,6 @@ jobs:
       displayName: Create MsixBundle
       retryCountOnTaskFailure: 1
 
-    - pwsh: |
-        $azureRmModule = Get-InstalledModule AzureRM -ErrorAction SilentlyContinue -Verbose
-        if ($azureRmModule) {
-          Write-Host 'AzureRM module exists. Removing it'
-          Uninstall-AzureRm
-          Write-Host 'AzureRM module removed'
-        }
-
-        Install-Module -Name Az.Storage -Force -AllowClobber -Scope CurrentUser -Verbose
-
-      displayName: Remove AzRM modules and install Az.Storage
-
     - task: AzurePowerShell@5
       displayName: Upload msix to blob
       inputs:

.pipelines/templates/release-validate-fxdpackages.yml

@@ -1,10 +1,25 @@
 parameters:
-  jobName: ""
-  displayName: ""
-  jobtype: ""
-  artifactName: ""
-  packageNamePattern: ""
-  arm64: "no"
+  - name: jobName
+    type: string
+    default: ""
+  - name: displayName
+    type: string
+    default: ""
+  - name: jobtype
+    type: string
+    default: ""
+  - name: artifactName
+    type: string
+    default: ""
+  - name: packageNamePattern
+    type: string
+    default: ""
+  - name: arm64
+    type: string
+    default: "no"
+  - name: enableCredScan
+    type: boolean
+    default: true
 
 jobs:
 - job: ${{ parameters.jobName }}
@@ -19,6 +34,8 @@ jobs:
     value: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
   - name: ob_sdl_tsa_configFile
     value: $(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
+  - name: ob_sdl_credscan_enabled
+    value: ${{ parameters.enableCredScan }}
 
   pool:
     type: ${{ parameters.jobtype }}

.pipelines/templates/uploadToAzure.yml

@@ -6,7 +6,7 @@ jobs:
     type: windows
   variables:
   - name: ob_sdl_sbom_enabled
-    value: false
+    value: true
   - name: runCodesignValidationInjection
     value: false
   - name: NugetSecurityAnalysisWarningLevel
@@ -241,7 +241,7 @@ jobs:
       Write-Verbose -Verbose "Creating output directory for GitHub Release files: $(ob_outputDirectory)/GitHubPackages"
       New-Item -Path $(ob_outputDirectory)/GitHubPackages -ItemType Directory -Force
       Get-ChildItem -Path "$(Build.ArtifactStagingDirectory)/downloads/*" -Recurse | 
-        Where-Object { $_.Extension -notin '.msix', '.nupkg' } | 
+        Where-Object { $_.Extension -notin '.msix', '.nupkg' -and $_.Name -notmatch '-gc'} | 
         Copy-Item -Destination $(ob_outputDirectory)/GitHubPackages -Recurse -Verbose
       
       Write-Verbose -Verbose "Creating output directory for NuGet packages: $(ob_outputDirectory)/NuGetPackages"