Adding CI build for InstanceExport

[fredrodlima]

Solves

Asana Update InstanceExport script to be digitally signed
When I was on-call and investigating the 8093 FD ticket where the client was having issues to export their instance data in a mac. I tried to help but even with a Windows machine they were reporting seen errors. In my investigation I found that one of the problems that users could have is that our PS script is not currently digitally signed. This PR tries to cover this bit of the process so they should only be prompted to trust the script and with the signature we have in place in our script if they would like to.

Description

I first started by NG's suggestion on taking a look what he have done for Connectors repo and PowerBI connector release. You can also take a look if you are curious about the steps in the #16 PR. I've follow the steps in my local machine to install the DevResultsRoot certificate and place it in the trust providers store.

Then, I've created a New-SelfSignCertificate with a password, used Export-PfxCertificate to create a .pfx file in my local machine and used the [convert]::ToBase64String((Get-Content -path ".\spc.pfx" -Encoding byte)) to convert it to a base 64 string so we could add it to the repo secrets. Then, I created to secrets in the DevResultsTools repo one PFX_PWORD with the password for install the pfx and BASE64_PFX_CONTENT to be able to use it in the git hub actions file.

In parallel with the steps already mentioned I've created a main.yml file in the repo to handle the build for each commit we push in the repo. I had to perform a couple of tries before achieving the version I'm submitting here for inspection and as well my little misunderstandings about certificates were also a factor of doubting that I was going in the right direction. As a result, right now we have a ci building and publishing the artifact as a zip file named PowerShell.DevResultTools.InstanceExport and that brings inside only the InstanceExport.ps1 file with a <#PSScriptInfo for general info and versioning of the script and a # SIG # Begin signature block that will be the signature for the certificate we have created.

Please note, that in order to proper trust the signed code clients will need to perform a previous step for properly running it and they should receive a similar screen when they would like to run the script for export an Instance. I tried to describe the steps you need to do in the How To Test section so we can update the instructions in the repo for users be able to properly handle it themselves when they need it.

How To Test

0 - Create a new directory in your machine
1 - Download the last build artifact and save it in your new directory
2 - Extract the files in the directory
3 - Open a new Power Shell terminal as an admin
4 - Run the command Get-ExecutionPolicy
5 - See if you get the RemoteSigned output
6 - If not, please run the following command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned
7 - Try to run the script using a PowerShell Admin terminal (prompt)
8 - See if you get the following message:
.\InstanceExport.ps1: File C:\InstanceExport\InstanceExport.ps1 cannot be loaded. A certificate chain could not be built to a trusted root authority.. it means that you don't have the DevResults PowerShell Signing Certificate certificate installed to validate the script signature
10 - Download the DevResultsInstanceExport.cer file on G:\Shared Drives\Engineering\Azure Certificates
11 - Install the certificate in your machine making sure to install it in the Trusted Root Certificate Authorities store choosing:

• Current User/Local Machine
• Choose in the next part of wizard install Place all certificates in the following store
• Click in Browse.. button
• Choose Trusted Root Certification Authorities
  You will probably will be looking at a screen like this
  
  12 - Click on Next and then on Finish to install it.
  13 - Open Certificates Manager (certmgr) and check that the DevResultsRoot certificate was installed in the Trusted Root Certification Authorities store like the image below
  
  14 - Try to run the script again in the PowerShell terminal
  15 - See if you get the following message:
  Do you want to run software from this untrusted publisher? File C:\InstanceExport\InstanceExport.ps1 is published by CN=DevResults PowerShell Signing Certificate and is not trusted on your system. Only run scripts from trusted publishers. [V] Never run [D] Do not run [R] Run once [A] Always run [?] Help (default is "D"):
  16 - Choose option [R] Run once
  17 - Check that you are able to run the script (and get data exported for an instance if you have a manifest.json file already)
  18 - Check again your Certificates Manager (certmgr) and look in Trusted Publisher
  19 - It should be empty or have already existing trusted publishers but not DevResults PowerShell Signing Certificate
  
  20 - Run the script again and when prompted the same question choose now option [A] Always Run
  21 - Check that you are able to run the script just fine (and get data exported for an instance if you have a manifest.json file already)
  22 - Check again your Certificates Manager (certmgr) and look in Trusted Publisher store and you will see the DevResults PowerShell Signing Certificate
  
  23 - (Optional) Get a manifest.json using DevResults API and export an instance data for tests. I've used engineering instance on my tests.

Verifications:

Submitter:

• Added / Updated Test Coverage
• New tables added to DeleteAllData stored procedure
• Checked custom queries & setup scripts for removed/renamed tables & columns
• All strings are localized
• All pseudonyms accounted for
• Assigned appropriate pull request labels

Data Reviewer:

• Works as described
• Tasks created for KB, RN, and client comms

Engineer Reviewer:

• Works as described
• Increases test coverage
• Tested for Partner regressions
• Does not leak PII through Exception Messages or Logs
• Missed refactoring opportunities?
• Tested for broader potential regressions than actual code changes might suggest
• Clean Code?
• Reflects engineering goals

[bigdogwillfeed]

Sorry for the long delay on this.

This signs the instance export script and is trusted once the DevResultsRoot certificate is trusted as a root CA. Nice 👍🏼