[release/v7.4] Add Windows Store Signing to MSIX bundle (#25472)

pwshBot · jshigetomi · Justin Chung · web-flow · commit e2c3e5de7bf6 · 2025-04-28T13:36:35.000-05:00
Co-authored-by: Justin Chung &lt;124807742+jshigetomi@users.noreply.github.com&gt;
Co-authored-by: Justin Chung &lt;chungjustin@microsoft.com&gt;
diff --git a/.pipelines/PowerShell-Release-Official.yml b/.pipelines/PowerShell-Release-Official.yml
@@ -58,6 +58,7 @@ variables:
   - name: ReleaseTagVar
     value: ${{ parameters.ReleaseTagVar }}
   - group: PoolNames
+  - group: MSIXSigningProfile
 
 resources:
   repositories:
diff --git a/.pipelines/templates/release-create-msix.yml b/.pipelines/templates/release-create-msix.yml
@@ -75,6 +75,24 @@ jobs:
       displayName: Create MsixBundle
       retryCountOnTaskFailure: 1
 
+    - task: onebranch.pipeline.signing@1
+      displayName: Sign MsixBundle
+      inputs:
+        command: 'sign'
+        signing_profile: $(MSIXProfile)
+        files_to_sign: '**/*.msixbundle'
+        search_root: '$(BundleDir)'
+    
+    - pwsh: |
+        $signedBundle = Get-ChildItem -Path $(BundleDir) -Filter "*.msixbundle" -File
+        Write-Verbose -Verbose "Signed bundle: $signedBundle"
+
+        Copy-Item -Path $signedBundle -Destination $(ob_outputDirectory) -Verbose
+
+        Write-Verbose -Verbose "Uploaded Bundle:"
+        Get-ChildItem -Path $(ob_outputDirectory) | Write-Verbose -Verbose
+      displayName: Upload msixbundle to Artifacts
+
     - task: AzurePowerShell@5
       displayName: Upload msix to blob
       inputs:
