Move GitHub Release tasks to separate explicitly release jobs (#692)

* Move GitHub Release tasks to separate explicitly release jobs

Author: gfs

Changelog.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.60] - 2025-06-36
+## Pipelines
+Pipeline updates
+
 ## [1.0.59] - 2025-06-10
 ## Misc (non-code)
 Removes old doc publish workflow. 

Pipelines/cli/devskim-cli-release.yml

@@ -106,7 +106,7 @@ extends:
           outputs:
           - output: pipelineArtifact
             path: '$(Build.StagingDirectory)'
-            artifact: 'Signed_Binaries_$(System.JobId)_$(System.JobAttempt)'
+            artifact: 'Signed_Binaries'
           # see https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/outputs/nuget-packages
           - output: nuget
             useDotNetTask: false
@@ -121,6 +121,12 @@ extends:
             packageType: 'sdk'
             version: ${{ variables.DotnetVersion }}
         - template: nbgv-set-version-steps.yml@templates
+        # set-version-steps only sets it for current job, while adding isOutput only sets it for future jobs
+        # https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-variables-scripts?view=azure-devops&tabs=powershell#set-an-output-variable-for-use-in-future-jobs
+        - powershell: |
+              $version = (nbgv get-version -v AssemblyInformationalVersion).split('+')[0]
+              Write-Host "##vso[task.setvariable variable=releaseVersion;isOutput=true]$version"
+          name: outputReleaseVersionVar
         - task: DownloadPipelineArtifact@2
           inputs:
             displayName: 'Download linux-mac-archive'  
@@ -554,6 +560,21 @@ extends:
                 $tmp = (Get-FileHash "$(Build.StagingDirectory)\$name").Hash
                 Add-Content $(Build.StagingDirectory)\HASHES.txt "$tmp`t$name"
               }
+      - job: gitHubReleaseJob
+        # Based on Documentation: https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/releasepipelines/releaseworkflows/releasejob?tabs=standardreleasejob
+        displayName: GitHub Release Job
+        dependsOn: sign_hash_release
+        variables:
+          ReleaseVersion: $[ dependencies.sign_hash_release.outputs['outputReleaseVersionVar.releaseVersion'] ]
+        # pool: you can optionally specify pool as you would normally do for a standard job
+        templateContext:
+          type: releaseJob  # Required, this indicates this job is a release job
+          isProduction: true  # Required, must be 'true' or 'false'
+          inputs:  # All input build artifacts must be declared here
+          - input: pipelineArtifact  # Required, type of the input artifact
+            artifactName: Signed_Binaries  # Required, name of the pipeline artifact
+            targetPath: $(Pipeline.Workspace)/drop  # Optional, specifies where the artifact is downloaded
+        steps:
         - task: GitHubRelease@1
           displayName: Release to GitHub
           inputs:

Pipelines/vs/devskim-visualstudio-release.yml

@@ -74,9 +74,15 @@ extends:
           outputs:
           - output: pipelineArtifact
             path: '$(Build.StagingDirectory)'
-            artifact: 'Signed_Binaries_$(System.JobId)_$(System.JobAttempt)'
+            artifact: 'Signed_Binaries'
         steps:
         - template: nbgv-set-version-steps.yml@templates
+        # set-version-steps only sets it for current job, while adding isOutput only sets it for future jobs
+        # https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-variables-scripts?view=azure-devops&tabs=powershell#set-an-output-variable-for-use-in-future-jobs
+        - powershell: |
+              $version = (nbgv get-version -v AssemblyInformationalVersion).split('+')[0]
+              Write-Host "##vso[task.setvariable variable=releaseVersion;isOutput=true]$version"
+          name: outputReleaseVersionVar
         - task: DownloadPipelineArtifact@2
           displayName: Retrieve Unsigned Artifact 
           inputs:
@@ -169,6 +175,21 @@ extends:
               $vsixPath = Resolve-Path $env:BUILD_STAGINGDIRECTORY\*.vsix -Relative
               & $vsixPublisher publish -payload $vsixPath -publishManifest $(Build.StagingDirectory)/publish.manifest.json -personalAccessToken $aadToken -ignoreWarnings "VSIXValidatorWarning01,VSIXValidatorWarning02,VSIXValidatorWarning08"
             workingDirectory: '$(Build.StagingDirectory)'
+      - job: gitHubReleaseJob
+        # Based on Documentation: https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/releasepipelines/releaseworkflows/releasejob?tabs=standardreleasejob
+        displayName: GitHub Release Job
+        dependsOn: sign_hash_release
+        variables:
+          ReleaseVersion: $[ dependencies.sign_hash_release.outputs['outputReleaseVersionVar.releaseVersion'] ]
+        # pool: you can optionally specify pool as you would normally do for a standard job
+        templateContext:
+          type: releaseJob  # Required, this indicates this job is a release job
+          isProduction: true  # Required, must be 'true' or 'false'
+          inputs:  # All input build artifacts must be declared here
+          - input: pipelineArtifact  # Required, type of the input artifact
+            artifactName: Signed_Binaries  # Required, name of the pipeline artifact
+            targetPath: $(Pipeline.Workspace)/drop  # Optional, specifies where the artifact is downloaded
+        steps:
         - task: GitHubRelease@1
           displayName: Release to GitHub
           inputs:

Pipelines/vscode/devskim-vscode-release.yml

@@ -83,9 +83,15 @@ extends:
           outputs:
           - output: pipelineArtifact
             path: '$(Build.StagingDirectory)'
-            artifact: 'Signed_Binaries_$(System.JobId)_$(System.JobAttempt)'
+            artifact: 'Signed_Binaries'
         steps:
         - template: nbgv-set-version-steps.yml@templates
+        # set-version-steps only sets it for current job, while adding isOutput only sets it for future jobs
+        # https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-variables-scripts?view=azure-devops&tabs=powershell#set-an-output-variable-for-use-in-future-jobs
+        - powershell: |
+              $version = (nbgv get-version -v AssemblyInformationalVersion).split('+')[0]
+              Write-Host "##vso[task.setvariable variable=releaseVersion;isOutput=true]$version"
+          name: outputReleaseVersionVar
         - task: DownloadPipelineArtifact@2
           displayName: Retrieve Unsigned Artifact 
           inputs:
@@ -180,7 +186,21 @@ extends:
                     echo "Publishing as official release = $(ReleaseVersion)"
                     vsce publish --packagePath $packPath --azure-credential
                 }
-
+      - job: gitHubReleaseJob
+        # Based on Documentation: https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/releasepipelines/releaseworkflows/releasejob?tabs=standardreleasejob
+        displayName: GitHub Release Job
+        dependsOn: sign_hash_release
+        variables:
+          ReleaseVersion: $[ dependencies.sign_hash_release.outputs['outputReleaseVersionVar.releaseVersion'] ]
+        # pool: you can optionally specify pool as you would normally do for a standard job
+        templateContext:
+          type: releaseJob  # Required, this indicates this job is a release job
+          isProduction: true  # Required, must be 'true' or 'false'
+          inputs:  # All input build artifacts must be declared here
+          - input: pipelineArtifact  # Required, type of the input artifact
+            artifactName: Signed_Binaries  # Required, name of the pipeline artifact
+            targetPath: $(Pipeline.Workspace)/drop  # Optional, specifies where the artifact is downloaded
+        steps:
         - task: GitHubRelease@1
           displayName: Release to GitHub
           inputs: