Add stage to publish Microsoft.PowerShell.PSResourceGet to ADO feed

.pipelines/PSResourceGet-Official.yml

@@ -10,6 +10,10 @@ parameters: # parameters are shown up in ADO UI in a build queue time
   displayName: 'Enable debug output'
   type: boolean
   default: false
+- name: 'onlyPublishToCFSFeed'
+  displayName: 'Only publish to ADO CFS feed (i.e excludes PSGallery)'
+  type: boolean
+  default: false
 
 variables:
   - name: DOTNET_CLI_TELEMETRY_OPTOUT
@@ -18,6 +22,7 @@ variables:
     value: 1
   - name: WindowsContainerImage
     value: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest # Docker image which is used to build the project https://aka.ms/obpipelines/containers
+  - group: ArtifactFeedVariables
 
 resources:
   repositories:
@@ -286,9 +291,56 @@ extends:
             Get-ChildItem "$(ob_outputDirectory)" -Recurse
           displayName: Find Signed Nupkg
 
+    - stage: releaseCFS
+      displayName: 'Publish Package to CFS feed (msazure)'
+      dependsOn: stagebuild
+      jobs:
+      - job: validation
+        displayName: Publish to CFS feed
+        variables:
+        - name: ob_outputDirectory
+          value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
+        - name: repoRoot
+          value: $(Build.SourcesDirectory)\PSResourceGet
+        - name: ob_sdl_tsa_configFile
+          value: $(Build.SourcesDirectory)\PSResourceGet\.config\tsaoptions.json
+        - name: signSrcPath
+          value: $(repoRoot)/out
+        - name: depsPath
+          value: $(signSrcPath)\Microsoft.PowerShell.PSResourceGet\Dependencies
+        - name: ob_sdl_sbom_enabled
+          value: true
+        - name: ob_signing_setup_enabled
+          value: true
+        #CodeQL tasks added manually to workaround signing failures
+        - name: ob_sdl_codeql_compiled_enabled
+          value: false
+        pool:
+          type: windows
+        steps:
+        - download: current
+          artifact: 'drop_stagebuild_nupkg'
+        - task: NuGetAuthenticate@1
+          displayName: 'Authenticate to external Azure Artifacts feed'
+          inputs:
+            azureDevOpsServiceConnection: 'PSGetPushToMsAzureFeed'
+            feedUrl: 'https://msazure.pkgs.visualstudio.com/One/_packaging/pwsh-deployment-module-feed/nuget/v3/index.json'
+        - pwsh: |
+            $publishNupkg = Get-ChildItem -Path '$(Pipeline.Workspace)\drop_stagebuild_nupkg\PSResourceGet\signed\PublishedNupkg\Microsoft.PowerShell.PSResourceGet.*.nupkg' -Recurse -File | Select-Object -First 1
+            if (-not $publishNupkg)
+            {
+              throw "No nupkg found under $(Pipeline.Workspace) matching Microsoft.PowerShell.PSResourceGet.*.nupkg"
+            }
+            $publishNupkgPath = $publishNupkg.FullName
+            Write-Verbose -Verbose "Package found at path: $publishNupkgPath"
+            $adoRepoUri = "https://msazure.pkgs.visualstudio.com/One/_packaging/pwsh-deployment-module-feed/nuget/v3/index.json"
+            dotnet nuget push $publishNupkgPath --source $adoRepoUri --api-key az --skip-duplicate
+          displayName: 'Push package to external Azure Artifacts feed'
+
     - stage: release
       displayName: Release PSResourceGet
       dependsOn: stagebuild
+      condition: and(succeeded(), not(${{ parameters.onlyPublishToCFSFeed }}))
       variables:
         version: $[ stageDependencies.build.main.outputs['package.version'] ]
         drop: $(Pipeline.Workspace)/drop_stagebuild_nupkg