Test larger runner, fix issue with signing tool arguments

Add some initial outline for next release job (not sure how we want to test this one...)

Author: michael-hawker

.github/workflows/build.yml

@@ -57,7 +57,7 @@ jobs:
   # Build both Uno.UI/WinUI2/UWP and Uno.WinUI/WinUI3/WindowsAppSDK versions of our packages using a matrix
   build:
     needs: [Xaml-Style-Check]
-    runs-on: windows-latest
+    runs-on: windows-latest-large
 
     # See https://docs.github.com/actions/using-jobs/using-a-matrix-for-your-jobs
     strategy:
@@ -139,7 +139,9 @@ jobs:
       - name: Push Pull Request Packages
         if: ${{ env.IS_PR }}
         run: |
-          dotnet nuget add source https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-PullRequests/nuget/v3/index.json --name PullRequests --username dummy --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}
+          dotnet nuget add source https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-PullRequests/nuget/v3/index.json `
+            --name PullRequests `
+            --username dummy --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}
           dotnet nuget push "**/*.nupkg" --api-key dummy --source PullRequests --skip-duplicate
 
       # Run tests
@@ -211,15 +213,18 @@ jobs:
 
   sign:
     needs: [build]
-    # TODO: if: ${{ env.IS_MAIN }}
+    # TODO: if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/rel/') }}
     runs-on: windows-latest
+    permissions:
+      id-token: write # Required for requesting the JWT
 
     strategy:
       fail-fast: false # prevent one matrix pipeline from being cancelled if one fails, we want them both to run to completion.
       matrix:
         platform: [WinUI2, WinUI3]
 
     steps:
+      # TODO: Just upload/download file list file to build artifact as in example?
       - name: Checkout Repository
         uses: actions/checkout@v3
 
@@ -238,29 +243,69 @@ jobs:
         run: dotnet tool install --tool-path ./tools sign --version 0.9.1-beta.23356.1
 
       - name: Sign Packages
-        run: ./tools/sign code azure-key-vault "**/*.nupkg" \
-          --timestamp-url "http://timestamp.digicert.com" \
-          --base-directory "${{ github.workspace }}/packages" \
-          --file-list "${{ github.workspace }}/.github/workflows/SignClientFileList.txt" \
-          --publisher-name ".NET Foundation" \
-          --description "Windows Community Toolkit" \
-          --description-url "https://github.com/CommunityToolkit/Windows" \
-          --azure-key-vault-certificate "${{ secrets.SIGN_CERTIFICATE }}" \
-          --azure-key-vault-client-id "${{ secrets.SIGN_CLIENT_ID }}" \
-          --azure-key-vault-client-secret "${{ secrets.SIGN_CLIENT_SECRET }}" \
-          --azure-key-vault-tenant-id "${{ secrets.SIGN_TENANT_ID }}" \
+        run: >
+          ./tools/sign code azure-key-vault
+          **/*.nupkg
+          --base-directory "${{ github.workspace }}/packages"
+          --file-list "${{ github.workspace }}/.github/workflows/SignClientFileList.txt"
+          --timestamp-url "http://timestamp.digicert.com"
+          --publisher-name ".NET Foundation"
+          --description "Windows Community Toolkit"
+          --description-url "https://github.com/CommunityToolkit/Windows"
           --azure-key-vault-url "${{ secrets.SIGN_KEY_VAULT_URL }}"
+          --azure-key-vault-client-id ${{ secrets.SIGN_CLIENT_ID }}
+          --azure-key-vault-client-secret "${{ secrets.SIGN_CLIENT_SECRET }}"
+          --azure-key-vault-tenant-id ${{ secrets.SIGN_TENANT_ID }}
+          --azure-key-vault-certificate "${{ secrets.SIGN_CERTIFICATE }}"
+          --verbosity Information
 
-      #- name: Add source (main)
-      #  run: dotnet nuget update source MainLatest --username dummy --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}
-
-      # TODO: For now push to PR feed so we can validate if any of this works...
+      # TODO: For now push to PR feed so we can validate if any of this works... change to MainLatest after
       - name: Push Signed Packages
         run: |
-          dotnet nuget add source https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-PullRequests/nuget/v3/index.json --name PullRequests --username dummy --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}
+          dotnet nuget add source https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-PullRequests/nuget/v3/index.json `
+            --name PullRequests `
+            --username dummy --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}
           dotnet nuget push "**/*.nupkg" --api-key dummy --source PullRequests --skip-duplicate
 
-      # TODO: If release we should push to NuGet
+      - name: Upload Signed Packages as Artifacts (for release)
+        uses: actions/upload-artifact@v3
+        # TODO: if: ${{ env.IS_RELEASE }}
+        with:
+          name: signed-nuget-packages-${{ matrix.platform }}
+          if-no-files-found: error
+          path: |
+            ${{ github.workspace }}/packages/**/*.nupkg
+
+  release:
+    if: ${{ startsWith(github.ref, 'refs/heads/rel/') }}
+    needs: [sign]
+    environment: nuget-release-gate # This gates this job until manually approved
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false # prevent one matrix pipeline from being cancelled if one fails, we want them both to run to completion.
+      matrix:
+        platform: [WinUI2, WinUI3]
+
+    steps:
+      - name: Install .NET SDK v${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Download signed packages for ${{ matrix.platform }}
+        uses: actions/download-artifact@v3
+        with:
+          name: signed-nuget-packages-${{ matrix.platform }}
+          path: ./packages
+
+      - name: Push to NuGet.org
+        run: >
+          dotnet nuget push
+          **/*.nupkg
+          --source https://api.nuget.org/v3/index.json
+          --api-key ${{ secrets.NUGET_PACKAGE_PUSH_TOKEN }}
+          --skip-duplicate
 
   wasm-linux:
     runs-on: ubuntu-latest