From 21fd44c1788595ea3c601e3d2efb7746ee55ec74 Mon Sep 17 00:00:00 2001
From: Pavel Glac <pavelglac@gmail.com>
Date: Mon, 6 Oct 2025 08:06:21 +0000
Subject: [PATCH 1/2] release pipeline

---
 .azure-devops/release.yaml | 80 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 .azure-devops/release.yaml

diff --git a/.azure-devops/release.yaml b/.azure-devops/release.yaml
new file mode 100644
index 0000000..0a6dd92
--- /dev/null
+++ b/.azure-devops/release.yaml
@@ -0,0 +1,80 @@
+pr: none
+trigger:
+  - main
+variables:
+  - group: InfoSec-SecurityResults
+  - name: tags
+    value: production,externalfacing
+  - name: serviceTreeID
+    value: 21f0b890-e3a8-4c0b-b9e7-2f764f8b799c
+
+resources:
+  repositories:
+    - repository: 1ESPipelineTemplates
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+
+  parameters:
+    sdl:
+      sourceAnalysisPool:
+        name: Azure-Pipelines-1ESPT-ExDShared
+        image: windows-2022
+        os: windows
+    stages:
+      - stage: release
+        variables:
+          # OPTIONAL: Set this varibale to 'true' to enable signing in a target stage.
+          # Remove if signing is not required.
+          Build.ESRP.CodeSign.Enabled: true
+          # OPTIONAL: To disable required tools not applicable in the pipeline set to false.
+          # Supported values: BinSkim, Roslyn, ESLint, PREFast.
+          Build.SDL.<Roslyn>.Enabled: false
+          Build.SDL.<ESLint>.Enabled: true
+        jobs:
+          - job: Release
+            pool:
+              name: Azure-Pipelines-1ESPT-ExDShared
+              image: ubuntu-latest
+              os: linux
+            steps:
+              - checkout: self
+              - script: yarn --frozen-lockfile
+                displayName: yarn
+              - script: yarn ci-test
+                displayName: build and test [test]
+
+              - task: 1ES.PublishPipelineArtifact@1
+                displayName: "Publish built package"
+                inputs:
+                  artifactName: package-$(Build.BuildNumber)
+                  targetPath: $(System.DefaultWorkingDirectory)/dist
+
+              - script: |
+                  mkdir -p $(System.DefaultWorkingDirectory)/packages
+                  npm pack --pack-destination $(System.DefaultWorkingDirectory)/packages
+                displayName: "Generate npm package (.tgz)"
+
+              # - task: EsrpRelease@9
+              #   displayName: "ESRP Release to npm"
+              #   inputs:
+              #     connectedservicename: $(Release.ConnectedServiceName)
+              #     usemanagedidentity: true
+              #     keyvaultname: $(Release.KeyVaultName)
+              #     signcertname: $(Release.SignCertName)
+              #     clientid: $(Release.ClientId)
+              #     contenttype: "npm"
+              #     folderlocation: $(System.DefaultWorkingDirectory)/packages
+              #     owners: $(Release.Owners)
+              #     approvers: $(Release.Approvers)
+              #     mainpublisher: ESRPRELPACMAN
+              #     domaintenantid: $(Release.DomainTenantId)
+
+              - task: 1ES.PublishPipelineArtifact@1
+                displayName: 📒 Publish Manifest
+                inputs:
+                  artifactName: SBom-$(System.JobAttempt)
+                  targetPath: $(System.DefaultWorkingDirectory)/_manifest

From 48ff010f3643e128064f8b54a1d24ef5fef6ce86 Mon Sep 17 00:00:00 2001
From: Pavel Glac <pavelglac@gmail.com>
Date: Mon, 6 Oct 2025 15:47:08 +0000
Subject: [PATCH 2/2] disable codesigning

---
 .azure-devops/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.azure-devops/release.yaml b/.azure-devops/release.yaml
index 0a6dd92..e5d8ae1 100644
--- a/.azure-devops/release.yaml
+++ b/.azure-devops/release.yaml
@@ -29,7 +29,7 @@ extends:
         variables:
           # OPTIONAL: Set this varibale to 'true' to enable signing in a target stage.
           # Remove if signing is not required.
-          Build.ESRP.CodeSign.Enabled: true
+          Build.ESRP.CodeSign.Enabled: false
           # OPTIONAL: To disable required tools not applicable in the pipeline set to false.
           # Supported values: BinSkim, Roslyn, ESLint, PREFast.
           Build.SDL.<Roslyn>.Enabled: false