Add Package Signing and Release Staging/Pipeline for NuGet.org

[michael-hawker]

Updates our build behavior to the following:

• PRs will only be pushed unsigned to the PullRequest feeds

• main merges will get signed and pushed to the MainLatest feeds

• rel/<major>.<minor>.<date>[-<prereleasetag>] builds will get signed and pushed to the MainLatest feed, then wait for approval before being pushed to NuGet.org

• For PR/main - the Version date is grabbed from the last commit in the git log, we needed a stable version date as otherwise the UWP and WASDK build times could cause the versions to be different by a day at the UTC rollover time.

• For Release builds, the Version date is grabbed from the rel/ branch naming (along with any prerelease tag)

• Packages uploaded as artifacts to the feed for main and release builds

• Uses new .NET Foundation signing tool

Other changes:

• WinUI package includes UWP again (this was a 1.2 WASK bug fixed in 1.3, so re-enabling to make it easier for folks to switch packages at their leisure).
• Sets our build step for Windows to run on larger VM runner, adds ~2x improvement when dedicated, will see how it handles in parallel, have 4 concurrent builds configured in runner settings atm.
• Reformats the build script's complex commands across multiple lines for easier readibility.

[michael-hawker]

Oops, left the if statement on the upload for what would it may look like later which would prevent the test from working... 🤦‍♂️

[michael-hawker]

Misread how to do the multiple arguments across lines, trying easier syntax. rebased off main now that #173 is merged.

Also testing out larger runner now, will see what that does to build times.

[michael-hawker]

Yay, signing is working! 🎉🎉🎉

Was working earlier in the day almost on first attempt, was just being dumb as I had it uploading the packages in the build step (as we'll do when finished), but since I wanted to push the signed packages there to validate they were getting skipped as they already existed on the prior push... 🤦‍♂️

Monday I'll clean-up this PR and it's commits and set things up as we want them in production:

• PRs will only be pushed unsigned to the PullRequest feeds
• main merges will get signed and pushed to the MainLatest feeds
• rel/* builds will get signed and pushed to the MainLatest feed, then wait for approval before being pushed to NuGet.org

That last bit we're not going to be able to test in the PR, so we'll have to 🤞 that I don't have a typo I guess until we're ready to try the preview/rc or whatever we want to call the NuGet 'preview'. Think we can do that Monday afternoon, will try and rally a quick chat with the team Monday.

TODO:

• Fix the versioning race condition between UWP and WinUI pipelines with setting the date part of the version, i.e. bubble it up as an environment value set in the build.yml at the top and then pass down as a property to the msbuild/pack cmds...

[michael-hawker]

Fixed the versioning problem we had by centralizing the date on other stable factors that DateTime.Now...

Was a bit tricky adding the extra build parameter for some reason, but cleaned up and appears to be working back now.

Just waiting on CommunityToolkit/Tooling-Windows-Submodule#123, then will update the submodule to main once that's in and upload the final if checks for Release and have things push to MainLatest over PullRequests when integrating into main, etc...

[michael-hawker]

Alright, pushed up the final conditional checks for running things only at the desired time...

We should be good to see how this goes first in PR, then in main for signing once merged, and then a live test for NuGet will be the scariest, as I don't think we can test that as easily as it's all based off the actual branch names... Hopefully, we won't need changes, and can just create a branch and spawn a workflow.

[michael-hawker]

Apparently need to explicitly check for == 'true'... fixed

[michael-hawker]

Sweet, looks like we're all working here:

[Mysterious-Dev]

Will this be used to publish a preview at each commit or for something else?

[michael-hawker]

Will this be used to publish a preview at each commit or for something else?

Yes, any commit to main will cause new packages to be pushed to our MainLatest feed, see https://aka.ms/wct/wiki/previewpackages

We'll only push to NuGet at specific times though.

[Arlodotexe]

This looks good to go, as long as all the secret values are set up in the repo.