From 2176168aaea79fa7d7a74166978ee98e42ffc9bd Mon Sep 17 00:00:00 2001
From: Aditya Patwardhan <adityap@microsoft.com>
Date: Tue, 28 Sep 2021 13:54:15 -0700
Subject: [PATCH 1/2] Use PowerShell 1ES pool for the release build

---
 tools/releaseBuild/yaml/releaseBuild.yml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/tools/releaseBuild/yaml/releaseBuild.yml b/tools/releaseBuild/yaml/releaseBuild.yml
index fa6eeed..04e967c 100644
--- a/tools/releaseBuild/yaml/releaseBuild.yml
+++ b/tools/releaseBuild/yaml/releaseBuild.yml
@@ -36,7 +36,11 @@ stages:
     - template: windows-build.yml
 
   - job: SignWin
-    pool: Package ES Standard Build
+    pool:
+      name: PowerShell1ES
+      demands:
+      - ImageOverride -equals MMS2019
+
     displayName: Sign Windows
     variables:
     - group: ESRP
@@ -84,7 +88,10 @@ stages:
     - SignWin
     - BuildLinux
     - BuildMac
-    pool: Package ES Standard Build
+    pool:
+      name: PowerShell1ES
+      demands:
+      - ImageOverride -equals MMS2019
     variables:
     - group: ESRP
 
@@ -97,7 +104,9 @@ stages:
   jobs:
   - job: Compliance_Job
     pool:
-      name: Package ES Standard Build
+      name: PowerShell1ES
+      demands:
+      - ImageOverride -equals MMS2019
     steps:
     - checkout: self
       clean: true

From b5006826b2d15b785241d4e966869016a70d4d79 Mon Sep 17 00:00:00 2001
From: Aditya Patwardhan <adityap@microsoft.com>
Date: Tue, 28 Sep 2021 14:51:01 -0700
Subject: [PATCH 2/2] Enable running APIScan on 1ES pool agents

---
 tools/releaseBuild/yaml/releaseBuild.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tools/releaseBuild/yaml/releaseBuild.yml b/tools/releaseBuild/yaml/releaseBuild.yml
index 04e967c..c6e22f6 100644
--- a/tools/releaseBuild/yaml/releaseBuild.yml
+++ b/tools/releaseBuild/yaml/releaseBuild.yml
@@ -1,10 +1,13 @@
 trigger: none
 
 variables:
-  AuthenticodeSignType: '400'
-  BuildConfiguration: 'Release'
-  NuGetPackagePath: '$(System.ArtifactsDirectory)/NuGetRelease'
-  PackageRoot: '$(System.ArtifactsDirectory)/Packages'
+  - name: BuildConfiguration
+    value: 'Release'
+  - name: NuGetPackagePath
+    value: '$(System.ArtifactsDirectory)/NuGetRelease'
+  - name: PackageRoot
+    value: '$(System.ArtifactsDirectory)/Packages'
+  - group: PSNativeAPIScan
 
 resources:
   repositories:
@@ -175,6 +178,7 @@ stages:
         softwareName: 'PowerShellNative'
         softwareNameFolder: '$(Pipeline.Workspace)/uncompressed'
         softwareVersion: '$(PackageVersion)'
+        connectionString: RunAs=App;AppId=$(APIScanClient);TenantId=$(APIScanTenant);AppKey=$(APIScanSecret)
         APIScan: true # set to false when not using Windows APIs.
 
 - template: publish.yml