From 7e8b8deb7542eb0ff70df5d9f2e62616254d06c7 Mon Sep 17 00:00:00 2001
From: Justin Chung <124807742+jshigetomi@users.noreply.github.com>
Date: Wed, 16 Apr 2025 16:10:40 -0500
Subject: [PATCH] Add Windows Store Signing to MSIX bundle (#25296)

Co-authored-by: Justin Chung <chungjustin@microsoft.com>
---
 .pipelines/PowerShell-Release-Official.yml   |  1 +
 .pipelines/templates/release-create-msix.yml | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/.pipelines/PowerShell-Release-Official.yml b/.pipelines/PowerShell-Release-Official.yml
index 1d986f872d6..bbbf7d86454 100644
--- a/.pipelines/PowerShell-Release-Official.yml
+++ b/.pipelines/PowerShell-Release-Official.yml
@@ -58,6 +58,7 @@ variables:
   - name: ReleaseTagVar
     value: ${{ parameters.ReleaseTagVar }}
   - group: PoolNames
+  - group: MSIXSigningProfile
 
 resources:
   repositories:
diff --git a/.pipelines/templates/release-create-msix.yml b/.pipelines/templates/release-create-msix.yml
index 3714e623b5e..751ce1ec5e2 100644
--- a/.pipelines/templates/release-create-msix.yml
+++ b/.pipelines/templates/release-create-msix.yml
@@ -75,6 +75,24 @@ jobs:
       displayName: Create MsixBundle
       retryCountOnTaskFailure: 1
 
+    - task: onebranch.pipeline.signing@1
+      displayName: Sign MsixBundle
+      inputs:
+        command: 'sign'
+        signing_profile: $(MSIXProfile)
+        files_to_sign: '**/*.msixbundle'
+        search_root: '$(BundleDir)'
+    
+    - pwsh: |
+        $signedBundle = Get-ChildItem -Path $(BundleDir) -Filter "*.msixbundle" -File
+        Write-Verbose -Verbose "Signed bundle: $signedBundle"
+
+        Copy-Item -Path $signedBundle -Destination $(ob_outputDirectory) -Verbose
+
+        Write-Verbose -Verbose "Uploaded Bundle:"
+        Get-ChildItem -Path $(ob_outputDirectory) | Write-Verbose -Verbose
+      displayName: Upload msixbundle to Artifacts
+
     - task: AzurePowerShell@5
       displayName: Upload msix to blob
       inputs: