Update build and release pipeline

.config/tsaoptions.json

@@ -0,0 +1,10 @@
+{
+    "instanceUrl": "https://msazure.visualstudio.com",
+    "projectName": "One",
+    "areaPath": "One\\MGMT\\Compute\\Powershell\\Powershell\\PowerShell Core",
+    "notificationAliases": [
+        "andschwa@microsoft.com",
+        "slee@microsoft.com"
+    ],
+    "codebaseName": "PSDSC_202502"
+}

.github/workflows/ci-test.yml

@@ -0,0 +1,51 @@
+name: CI Tests
+
+on:
+  push:
+    branches: [ v2 ]
+  pull_request:
+    branches: [ v2 ]
+
+jobs:
+  ci:
+    name: pester
+    runs-on: windows-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install PSResources
+        run: ./tools/installPSResources.ps1
+        shell: pwsh
+
+      - name: Build
+        run: ./build.ps1 -Build
+        shell: pwsh
+
+      - name: Test
+        run: ./build.ps1 -Test
+        shell: pwsh
+
+      - name: Test Windows PowerShell
+        run: |
+           ./tools/installPSResources.ps1
+           ./build.ps1 -Test
+        shell: powershell
+
+      - name: Package
+        run: ./build.ps1 -Publish
+        shell: pwsh
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: PSDesiredStateConfiguration-package
+          path: out/**/*.nupkg
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: PSDesiredStateConfiguration-tests
+          path: out/testResults.xml

.pipelines/PSDesiredStateConfiguration-OneBranch.yml

@@ -0,0 +1,155 @@
+trigger:
+- main
+
+schedules:
+- cron: '18 11 * * 5'
+  displayName: Weekly CodeQL
+  branches:
+    include:
+    - main
+  always: true
+
+parameters:
+- name: debug
+  displayName: Enable debug output
+  type: boolean
+  default: false
+- name: OfficialBuild
+  displayName: Use Official OneBranch template
+  type: boolean
+  default: true
+- name: Release
+  displayName: Generate a release
+  type: boolean
+  default: false
+
+variables:
+  system.debug: ${{ parameters.debug }}
+  BuildConfiguration: Release
+  WindowsContainerImage: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
+  OneBranchTemplate: ${{ iif(parameters.OfficialBuild, 'v2/OneBranch.Official.CrossPlat.yml@templates', 'v2/OneBranch.NonOfficial.CrossPlat.yml@templates') }}
+
+resources:
+  repositories:
+    - repository: templates
+      type: git
+      name: OneBranch.Pipelines/GovernedTemplates
+      ref: refs/heads/main
+
+extends:
+  # https://aka.ms/obpipelines/templates
+  template: ${{ variables.OneBranchTemplate }}
+  parameters:
+    globalSdl: # https://aka.ms/obpipelines/sdl
+      asyncSdl:
+        enabled: true
+        forStages: [build]
+    featureFlags:
+      EnableCDPxPAT: false
+      WindowsHostVersion:
+        Version: 2022
+        Network: KS3
+    release:
+      category: NonAzure
+    stages:
+    - stage: build
+      jobs:
+      - job: main
+        displayName: Build package
+        pool:
+          type: windows
+        variables:
+          ob_outputDirectory: $(Build.SourcesDirectory)/out
+        steps:
+          - pwsh: |
+              $manifest = Import-PowerShellDataFile ./src/PSDesiredStateConfiguration/PSDesiredStateConfiguration.psd1
+              $version = $manifest.ModuleVersion
+              Write-Output "##vso[task.setvariable variable=version;isOutput=true]$version"
+            name: package
+            displayName: Get version from module manifest
+          - task: onebranch.pipeline.version@1
+            displayName: Set OneBranch version
+            inputs:
+              system: Custom
+              customVersion: $(package.version)
+          - pwsh: ./tools/installPSResources.ps1 -PSRepository CFS
+            displayName: Install PSResources
+          - pwsh: ./build.ps1 -Clean -Build -Test
+            displayName: Build
+          - task: onebranch.pipeline.signing@1
+            displayName: Sign 1st-party files
+            inputs:
+              command: sign
+              signing_profile: external_distribution
+              search_root: $(Build.SourcesDirectory)/out
+              files_to_sign: |
+                **/*.psd1;
+                **/*.psm1;
+          - pwsh: ./build.ps1 -Publish
+            displayName: Package module
+          - task: onebranch.pipeline.signing@1
+            displayName: Sign NuGet package
+            inputs:
+              command: sign
+              signing_profile: external_distribution
+              search_root: $(Build.SourcesDirectory)/out
+              files_to_sign: |
+                *.nupkg
+    - stage: release
+      dependsOn: build
+      condition: and(succeeded(), ${{ eq(parameters.Release, true) }})
+      variables:
+        ob_release_environment: ${{ iif(parameters.OfficialBuild, 'Production', 'Test') }}
+        version: $[ stageDependencies.build.main.outputs['package.version'] ]
+      jobs:
+      - job: github
+        displayName: Publish draft to GitHub
+        pool:
+          type: release
+        templateContext:
+          inputs:
+          - input: pipelineArtifact
+            artifactName: drop_build_main
+        steps:
+        - task: GitHubRelease@1
+          displayName: Create GitHub release
+          inputs:
+            gitHubConnection: GitHub
+            repositoryName: PowerShell/PSDesiredStateConfiguration
+            target: main
+            assets: $(Pipeline.Workspace)/PSDesiredStateConfiguration.$(version).nupkg
+            tagSource: userSpecifiedTag
+            tag: $(version)
+            isDraft: true
+            addChangeLog: false
+            releaseNotesSource: inline
+            releaseNotesInline: "<!-- TODO: Generate release notes on GitHub! -->"
+      - job: validation
+        displayName: Manual validation
+        pool:
+          type: server
+        timeoutInMinutes: 1440
+        steps:
+        - task: ManualValidation@0
+          displayName: Wait 24 hours for validation
+          inputs:
+            notifyUsers: $(Build.RequestedForEmail)
+            instructions: Please validate the release and then publish it!
+            timeoutInMinutes: 1440
+      - job: publish
+        dependsOn: validation
+        displayName: Publish to PowerShell Gallery
+        pool:
+          type: release
+        templateContext:
+          inputs:
+          - input: pipelineArtifact
+            artifactName: drop_build_main
+        steps:
+        - task: NuGetCommand@2
+          displayName: Publish module to PowerShell Gallery
+          inputs:
+            command: push
+            packagesToPush: $(Pipeline.Workspace)/PSDesiredStateConfiguration.$(version).nupkg
+            nuGetFeedType: external
+            publishFeedCredentials: PowerShellGallery