Improve the Windows release build scripts (GH-30771)

Update to windows-2022 image
Promote queue variables to parameters for better UI
Structure build steps using parameters instead of conditions for simpler status display

17 files changed, 293 insertions, 229 deletions

diff --git a/.azure-pipelines/ci.yml b/.azure-pipelines/ci.yml
index 25cc726504..638625540e 100644
--- a/.azure-pipelines/ci.yml
+++ b/.azure-pipelines/ci.yml
@@ -98,7 +98,7 @@ jobs:
   condition: and(succeeded(), eq(dependencies.Prebuild.outputs['tests.run'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   strategy:
     matrix:
diff --git a/.azure-pipelines/pr.yml b/.azure-pipelines/pr.yml
index e2aae324f2..8b065e6cae 100644
--- a/.azure-pipelines/pr.yml
+++ b/.azure-pipelines/pr.yml
@@ -98,7 +98,7 @@ jobs:
   condition: and(succeeded(), eq(dependencies.Prebuild.outputs['tests.run'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   strategy:
     matrix:
diff --git a/.azure-pipelines/windows-release.yml b/.azure-pipelines/windows-release.yml
index 3d072e3b43..338c305ecd 100644
--- a/.azure-pipelines/windows-release.yml
+++ b/.azure-pipelines/windows-release.yml
@@ -1,129 +1,183 @@
 name: Release_$(Build.SourceBranchName)_$(SourceTag)_$(Date:yyyyMMdd)$(Rev:.rr)
 
+parameters:
+- name: GitRemote
+  displayName: "Git remote"
+  type: string
+  default: python
+  values:
+  - 'python'
+  - 'pablogsal'
+  - 'ambv'
+  - '(Other)'
+- name: GitRemote_Other
+  displayName: "If Other, specify Git remote"
+  type: string
+  default: 'python'
+- name: SourceTag
+  displayName: "Git tag"
+  type: string
+  default: main
+- name: DoPublish
+  displayName: "Publish release"
+  type: boolean
+  default: false
+- name: SigningCertificate
+  displayName: "Code signing certificate"
+  type: string
+  default: 'Python Software Foundation'
+  values:
+  - 'Python Software Foundation'
+  - 'TestSign'
+  - 'Unsigned'
+- name: SigningDescription
+  displayName: "Signature description"
+  type: string
+  default: 'Built: $(Build.BuildNumber)'
+- name: DoPGO
+  displayName: "Run PGO"
+  type: boolean
+  default: true
+- name: DoLayout
+  displayName: "Produce full layout artifact"
+  type: boolean
+  default: true
+- name: DoMSIX
+  displayName: "Produce Store packages"
+  type: boolean
+  default: true
+- name: DoNuget
+  displayName: "Produce Nuget packages"
+  type: boolean
+  default: true
+- name: DoEmbed
+  displayName: "Produce embeddable package"
+  type: boolean
+  default: true
+- name: DoMSI
+  displayName: "Produce EXE/MSI installer"
+  type: boolean
+  default: true
+- name: BuildToPublish
+  displayName: "Build number to publish (0 to skip)"
+  type: number
+  default: '0'
+
 variables:
     __RealSigningCertificate: 'Python Software Foundation'
+    ${{ if ne(parameters.GitRemote, '(Other)') }}:
+      GitRemote: ${{ parameters.GitRemote }}
+    ${{ else }}:
+      GitRemote: ${{ parameters.GitRemote_Other }}
+    SourceTag: ${{ parameters.SourceTag }}
+    DoPGO: ${{ parameters.DoPGO }}
+    ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
+      SigningCertificate: ${{ parameters.SigningCertificate }}
+    SigningDescription: ${{ parameters.SigningDescription }}
+    DoLayout: ${{ parameters.DoLayout }}
+    DoMSIX: ${{ parameters.DoMSIX }}
+    DoNuget: ${{ parameters.DoNuget }}
+    DoEmbed: ${{ parameters.DoEmbed }}
+    DoMSI: ${{ parameters.DoMSI }}
+    DoPublish: ${{ parameters.DoPublish }}
 # QUEUE TIME VARIABLES
-#   GitRemote: python
-#   SourceTag:
-#   DoPGO: true
-#   SigningCertificate: 'Python Software Foundation'
-#   SigningDescription: 'Built: $(Build.BuildNumber)'
-#   DoLayout: true
-#   DoMSIX: true
-#   DoNuget: true
-#   DoEmbed: true
-#   DoMSI: true
-#   DoPublish: false
-#   PyDotOrgUsername: ''
-#   PyDotOrgServer: ''
-#   BuildToPublish: ''
+#    PyDotOrgUsername: ''
+#    PyDotOrgServer: ''
 
 trigger: none
 pr: none
 
 stages:
-- stage: Build
-  displayName: Build binaries
-  condition: and(succeeded(), not(variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-build.yml
-
-- stage: Sign
-  displayName: Sign binaries
-  dependsOn: Build
-  condition: and(succeeded(), not(variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-sign.yml
-
-- stage: Layout
-  displayName: Generate layouts
-  dependsOn: Sign
-  condition: and(succeeded(), not(variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-layout-full.yml
-  - template: windows-release/stage-layout-embed.yml
-  - template: windows-release/stage-layout-nuget.yml
-
-- stage: Pack
-  dependsOn: Layout
-  condition: and(succeeded(), not(variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-pack-nuget.yml
-
-- stage: Test
-  dependsOn: Pack
-  condition: and(succeeded(), not(variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-test-embed.yml
-  - template: windows-release/stage-test-nuget.yml
-
-- stage: Layout_MSIX
-  displayName: Generate MSIX layouts
-  dependsOn: Sign
-  condition: and(succeeded(), and(eq(variables['DoMSIX'], 'true'), not(variables['BuildToPublish'])))
-  jobs:
-  - template: windows-release/stage-layout-msix.yml
-
-- stage: Pack_MSIX
-  displayName: Package MSIX
-  dependsOn: Layout_MSIX
-  condition: and(succeeded(), not(variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-pack-msix.yml
-
-- stage: Build_MSI
-  displayName: Build MSI installer
-  dependsOn: Sign
-  condition: and(succeeded(), and(eq(variables['DoMSI'], 'true'), not(variables['BuildToPublish'])))
-  jobs:
-  - template: windows-release/stage-msi.yml
-
-- stage: Test_MSI
-  displayName: Test MSI installer
-  dependsOn: Build_MSI
-  condition: and(succeeded(), not(variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-test-msi.yml
-
-- stage: PublishPyDotOrg
-  displayName: Publish to python.org
-  dependsOn: ['Test_MSI', 'Test']
-  condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), not(variables['BuildToPublish'])))
-  jobs:
-  - template: windows-release/stage-publish-pythonorg.yml
-
-- stage: PublishNuget
-  displayName: Publish to nuget.org
-  dependsOn: Test
-  condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), not(variables['BuildToPublish'])))
-  jobs:
-  - template: windows-release/stage-publish-nugetorg.yml
-
-- stage: PublishStore
-  displayName: Publish to Store
-  dependsOn: Pack_MSIX
-  condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), not(variables['BuildToPublish'])))
-  jobs:
-  - template: windows-release/stage-publish-store.yml
-
-
-- stage: PublishExistingPyDotOrg
-  displayName: Publish existing build to python.org
-  dependsOn: []
-  condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-publish-pythonorg.yml
-
-- stage: PublishExistingNuget
-  displayName: Publish existing build to nuget.org
-  dependsOn: []
-  condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-publish-nugetorg.yml
-
-- stage: PublishExistingStore
-  displayName: Publish existing build to Store
-  dependsOn: []
-  condition: and(succeeded(), and(eq(variables['DoPublish'], 'true'), variables['BuildToPublish']))
-  jobs:
-  - template: windows-release/stage-publish-store.yml
+- ${{ if eq(parameters.BuildToPublish, '0') }}:
+  - stage: Build
+    displayName: Build binaries
+    jobs:
+    - template: windows-release/stage-build.yml
+
+  - stage: Sign
+    displayName: Sign binaries
+    dependsOn: Build
+    jobs:
+    - template: windows-release/stage-sign.yml
+
+  - stage: Layout
+    displayName: Generate layouts
+    dependsOn: Sign
+    jobs:
+    - template: windows-release/stage-layout-full.yml
+    - template: windows-release/stage-layout-embed.yml
+    - template: windows-release/stage-layout-nuget.yml
+
+  - stage: Pack
+    dependsOn: Layout
+    jobs:
+    - template: windows-release/stage-pack-nuget.yml
+
+  - stage: Test
+    dependsOn: Pack
+    jobs:
+    - template: windows-release/stage-test-embed.yml
+    - template: windows-release/stage-test-nuget.yml
+
+  - stage: Layout_MSIX
+    displayName: Generate MSIX layouts
+    dependsOn: Sign
+    condition: and(succeeded(), eq(variables['DoMSIX'], 'true'))
+    jobs:
+    - template: windows-release/stage-layout-msix.yml
+
+  - stage: Pack_MSIX
+    displayName: Package MSIX
+    dependsOn: Layout_MSIX
+    jobs:
+    - template: windows-release/stage-pack-msix.yml
+
+  - stage: Build_MSI
+    displayName: Build MSI installer
+    dependsOn: Sign
+    condition: and(succeeded(), eq(variables['DoMSI'], 'true'))
+    jobs:
+    - template: windows-release/stage-msi.yml
+
+  - stage: Test_MSI
+    displayName: Test MSI installer
+    dependsOn: Build_MSI
+    jobs:
+    - template: windows-release/stage-test-msi.yml
+
+  - ${{ if eq(parameters.DoPublish, 'true') }}:
+    - stage: PublishPyDotOrg
+      displayName: Publish to python.org
+      dependsOn: ['Test_MSI', 'Test']
+      jobs:
+      - template: windows-release/stage-publish-pythonorg.yml
+
+    - stage: PublishNuget
+      displayName: Publish to nuget.org
+      dependsOn: Test
+      jobs:
+      - template: windows-release/stage-publish-nugetorg.yml
+
+    - stage: PublishStore
+      displayName: Publish to Store
+      dependsOn: Pack_MSIX
+      jobs:
+      - template: windows-release/stage-publish-store.yml
+
+- ${{ else }}:
+  - stage: PublishExisting
+    displayName: Publish existing build
+    dependsOn: []
+    condition: and(succeeded(), eq(variables['DoPublish'], 'true'))
+    jobs:
+    - template: windows-release/stage-publish-pythonorg.yml
+      parameters:
+        BuildToPublish: ${{ parameters.BuildToPublish }}
+
+    - template: windows-release/stage-publish-nugetorg.yml
+      parameters:
+        BuildToPublish: ${{ parameters.BuildToPublish }}
+
+    - template: windows-release/stage-publish-store.yml
+      parameters:
+        BuildToPublish: ${{ parameters.BuildToPublish }}
diff --git a/.azure-pipelines/windows-release/stage-build.yml b/.azure-pipelines/windows-release/stage-build.yml
index 69f3b1e164..f70414ba21 100644
--- a/.azure-pipelines/windows-release/stage-build.yml
+++ b/.azure-pipelines/windows-release/stage-build.yml
@@ -2,8 +2,8 @@ jobs:
 - job: Build_Docs
   displayName: Docs build
   pool:
-    name: 'Windows Release'
-    #vmImage: windows-2019
+    #name: 'Windows Release'
+    vmImage: windows-2022
 
   workspace:
     clean: all
@@ -45,7 +45,7 @@ jobs:
   displayName: Python build
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
@@ -91,7 +91,7 @@ jobs:
   condition: and(succeeded(), ne(variables['DoPGO'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
@@ -141,7 +141,7 @@ jobs:
   displayName: Publish Tcl/Tk Library
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
diff --git a/.azure-pipelines/windows-release/stage-layout-embed.yml b/.azure-pipelines/windows-release/stage-layout-embed.yml
index dbccdead14..c8b23d308d 100644
--- a/.azure-pipelines/windows-release/stage-layout-embed.yml
+++ b/.azure-pipelines/windows-release/stage-layout-embed.yml
@@ -4,7 +4,7 @@ jobs:
   condition: and(succeeded(), eq(variables['DoEmbed'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
diff --git a/.azure-pipelines/windows-release/stage-layout-full.yml b/.azure-pipelines/windows-release/stage-layout-full.yml
index 8fc8da3e52..0ba2fc017d 100644
--- a/.azure-pipelines/windows-release/stage-layout-full.yml
+++ b/.azure-pipelines/windows-release/stage-layout-full.yml
@@ -4,7 +4,7 @@ jobs:
   condition: and(succeeded(), eq(variables['DoLayout'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
diff --git a/.azure-pipelines/windows-release/stage-layout-msix.yml b/.azure-pipelines/windows-release/stage-layout-msix.yml
index def4f7d3c6..6efd327bdb 100644
--- a/.azure-pipelines/windows-release/stage-layout-msix.yml
+++ b/.azure-pipelines/windows-release/stage-layout-msix.yml
@@ -3,7 +3,7 @@ jobs:
   displayName: Make MSIX layout
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
diff --git a/.azure-pipelines/windows-release/stage-layout-nuget.yml b/.azure-pipelines/windows-release/stage-layout-nuget.yml
index 41cdff850e..b60a324dd9 100644
--- a/.azure-pipelines/windows-release/stage-layout-nuget.yml
+++ b/.azure-pipelines/windows-release/stage-layout-nuget.yml
@@ -4,7 +4,7 @@ jobs:
   condition: and(succeeded(), eq(variables['DoNuget'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
diff --git a/.azure-pipelines/windows-release/stage-msi.yml b/.azure-pipelines/windows-release/stage-msi.yml
index 9b965b09c1..f14bc9a45a 100644
--- a/.azure-pipelines/windows-release/stage-msi.yml
+++ b/.azure-pipelines/windows-release/stage-msi.yml
@@ -4,7 +4,7 @@ jobs:
   condition: and(succeeded(), not(variables['SigningCertificate']))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   variables:
     ReleaseUri: http://www.python.org/{arch}
diff --git a/.azure-pipelines/windows-release/stage-pack-msix.yml b/.azure-pipelines/windows-release/stage-pack-msix.yml
index 9f7919ee64..95988151a0 100644
--- a/.azure-pipelines/windows-release/stage-pack-msix.yml
+++ b/.azure-pipelines/windows-release/stage-pack-msix.yml
@@ -3,7 +3,7 @@ jobs:
   displayName: Pack MSIX bundles
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
diff --git a/.azure-pipelines/windows-release/stage-publish-nugetorg.yml b/.azure-pipelines/windows-release/stage-publish-nugetorg.yml
index d5edf44ef5..38f6772afc 100644
--- a/.azure-pipelines/windows-release/stage-publish-nugetorg.yml
+++ b/.azure-pipelines/windows-release/stage-publish-nugetorg.yml
@@ -1,10 +1,13 @@
+parameters:
+  BuildToPublish: ''
+
 jobs:
 - job: Publish_Nuget
   displayName: Publish Nuget packages
   condition: and(succeeded(), eq(variables['DoNuget'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
@@ -12,24 +15,25 @@ jobs:
   steps:
   - checkout: none
 
-  - task: DownloadBuildArtifacts@0
-    displayName: 'Download artifact: nuget'
-    condition: and(succeeded(), not(variables['BuildToPublish']))
-    inputs:
-      artifactName: nuget
-      downloadPath: $(Build.BinariesDirectory)
+  - ${{ if parameters.BuildToPublish }}:
+    - task: DownloadBuildArtifacts@0
+      displayName: 'Download artifact from ${{ parameters.BuildToPublish }}'
+      inputs:
+        artifactName: nuget
+        downloadPath: $(Build.BinariesDirectory)
+        buildType: specific
+        project: $(System.TeamProject)
+        pipeline: $(Build.DefinitionName)
+        buildVersionToDownload: specific
+        buildId: ${{ parameters.BuildToPublish }}
+
+  - ${{ else }}:
+    - task: DownloadBuildArtifacts@0
+      displayName: 'Download artifact: nuget'
+      inputs:
+        artifactName: nuget
+        downloadPath: $(Build.BinariesDirectory)
 
-  - task: DownloadBuildArtifacts@0
-    displayName: 'Download artifact: nuget'
-    condition: and(succeeded(), variables['BuildToPublish'])
-    inputs:
-      artifactName: nuget
-      downloadPath: $(Build.BinariesDirectory)
-      buildType: specific
-      project: cpython
-      pipeline: Windows-Release
-      buildVersionToDownload: specific
-      buildId: $(BuildToPublish)
 
   - powershell: 'gci pythonarm*.nupkg | %{ Write-Host "Not publishing: $($_.Name)"; gi $_ } | del'
     displayName: 'Prevent publishing ARM/ARM64 packages'
diff --git a/.azure-pipelines/windows-release/stage-publish-pythonorg.yml b/.azure-pipelines/windows-release/stage-publish-pythonorg.yml
index 4b88bdebf8..ef95572f7d 100644
--- a/.azure-pipelines/windows-release/stage-publish-pythonorg.yml
+++ b/.azure-pipelines/windows-release/stage-publish-pythonorg.yml
@@ -1,10 +1,13 @@
+parameters:
+  BuildToPublish: ''
+
 jobs:
 - job: Publish_Python
   displayName: Publish python.org packages
   condition: and(succeeded(), and(eq(variables['DoMSI'], 'true'), eq(variables['DoEmbed'], 'true')))
 
   pool:
-    #vmImage: windows-2019
+    #vmImage: windows-2022
     name: 'Windows Release'
 
   workspace:
@@ -18,62 +21,61 @@ jobs:
     inputs:
       versionSpec: '>=3.6'
 
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: Doc'
-    condition: and(succeeded(), not(variables['BuildToPublish']))
-    inputs:
-      artifactName: Doc
-      targetPath: $(Build.BinariesDirectory)\Doc
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: msi'
-    condition: and(succeeded(), not(variables['BuildToPublish']))
-    inputs:
-      artifactName: msi
-      targetPath: $(Build.BinariesDirectory)\msi
+  - ${{ if parameters.BuildToPublish }}:
+    - task: DownloadPipelineArtifact@1
+      displayName: 'Download artifact from ${{ parameters.BuildToPublish }}: Doc'
+      inputs:
+        artifactName: Doc
+        targetPath: $(Build.BinariesDirectory)\Doc
+        buildType: specific
+        project: $(System.TeamProject)
+        pipeline: $(Build.DefinitionName)
+        buildVersionToDownload: specific
+        buildId: ${{ parameters.BuildToPublish }}
+
+    - task: DownloadPipelineArtifact@1
+      displayName: 'Download artifact from ${{ parameters.BuildToPublish }}: msi'
+      inputs:
+        artifactName: msi
+        targetPath: $(Build.BinariesDirectory)\msi
+        buildType: specific
+        project: $(System.TeamProject)
+        pipeline: $(Build.DefinitionName)
+        buildVersionToDownload: specific
+        buildId: ${{ parameters.BuildToPublish }}
+
+    # Note that embed is a 'build' artifact, not a 'pipeline' artifact
+    - task: DownloadBuildArtifacts@0
+      displayName: 'Download artifact from ${{ parameters.BuildToPublish }}: embed'
+      inputs:
+        artifactName: embed
+        downloadPath: $(Build.BinariesDirectory)
+        buildType: specific
+        project: $(System.TeamProject)
+        pipeline: $(Build.DefinitionName)
+        buildVersionToDownload: specific
+        buildId: ${{ parameters.BuildToPublish }}
+
+  - ${{ else }}:
+    - task: DownloadPipelineArtifact@1
+      displayName: 'Download artifact: Doc'
+      inputs:
+        artifactName: Doc
+        targetPath: $(Build.BinariesDirectory)\Doc
+
+    - task: DownloadPipelineArtifact@1
+      displayName: 'Download artifact: msi'
+      inputs:
+        artifactName: msi
+        targetPath: $(Build.BinariesDirectory)\msi
+
+    # Note that embed is a 'build' artifact, not a 'pipeline' artifact
+    - task: DownloadBuildArtifacts@0
+      displayName: 'Download artifact: embed'
+      inputs:
+        artifactName: embed
+        downloadPath: $(Build.BinariesDirectory)
 
-  - task: DownloadBuildArtifacts@0
-    displayName: 'Download artifact: embed'
-    condition: and(succeeded(), not(variables['BuildToPublish']))
-    inputs:
-      artifactName: embed
-      downloadPath: $(Build.BinariesDirectory)
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact from $(BuildToPublish): Doc'
-    condition: and(succeeded(), variables['BuildToPublish'])
-    inputs:
-      artifactName: Doc
-      targetPath: $(Build.BinariesDirectory)\Doc
-      buildType: specific
-      project: cpython
-      pipeline: 21
-      buildVersionToDownload: specific
-      buildId: $(BuildToPublish)
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact from $(BuildToPublish): msi'
-    condition: and(succeeded(), variables['BuildToPublish'])
-    inputs:
-      artifactName: msi
-      targetPath: $(Build.BinariesDirectory)\msi
-      buildType: specific
-      project: cpython
-      pipeline: 21
-      buildVersionToDownload: specific
-      buildId: $(BuildToPublish)
-
-  - task: DownloadBuildArtifacts@0
-    displayName: 'Download artifact from $(BuildToPublish): embed'
-    condition: and(succeeded(), variables['BuildToPublish'])
-    inputs:
-      artifactName: embed
-      downloadPath: $(Build.BinariesDirectory)
-      buildType: specific
-      project: cpython
-      pipeline: Windows-Release
-      buildVersionToDownload: specific
-      buildId: $(BuildToPublish)
 
   - powershell: 'gci *embed-arm*.zip | %{ Write-Host "Not publishing: $($_.Name)"; gi $_ } | del'
     displayName: 'Prevent publishing ARM/ARM64 packages'
@@ -105,6 +107,7 @@ jobs:
       "$(Build.SourcesDirectory)\Tools\msi\purge.py"
       (gci msi\*\python-*.exe | %{ $_.Name -replace 'python-(.+?)(-|\.exe).+', '$1' } | select -First 1)
     workingDirectory: $(Build.BinariesDirectory)
+    condition: and(succeeded(), eq(variables['SigningCertificate'], variables['__RealSigningCertificate']))
     displayName: 'Purge CDN'
 
   - powershell: |
@@ -124,7 +127,7 @@ jobs:
         Write-Error "Failed to validate $failures installers"
         exit 1
       }
-    #condition: and(succeeded(), eq(variables['SigningCertificate'], variables['__RealSigningCertificate']))
+    condition: and(succeeded(), eq(variables['SigningCertificate'], variables['__RealSigningCertificate']))
     workingDirectory: $(Build.BinariesDirectory)
     displayName: 'Test layouts'
 
diff --git a/.azure-pipelines/windows-release/stage-publish-store.yml b/.azure-pipelines/windows-release/stage-publish-store.yml
index e0512b95f2..f3d4c80be9 100644
--- a/.azure-pipelines/windows-release/stage-publish-store.yml
+++ b/.azure-pipelines/windows-release/stage-publish-store.yml
@@ -1,10 +1,13 @@
+parameters:
+  BuildToPublish: ''
+
 jobs:
 - job: Publish_Store
   displayName: Publish Store packages
   condition: and(succeeded(), eq(variables['DoMSIX'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
@@ -12,24 +15,24 @@ jobs:
   steps:
   - checkout: none
 
-  - task: DownloadBuildArtifacts@0
-    displayName: 'Download artifact: msixupload'
-    condition: and(succeeded(), not(variables['BuildToPublish']))
-    inputs:
-      artifactName: msixupload
-      downloadPath: $(Build.BinariesDirectory)
+  - ${{ if parameters.BuildToPublish }}:
+    - task: DownloadBuildArtifacts@0
+      displayName: 'Download artifact: msixupload'
+      inputs:
+        artifactName: msixupload
+        downloadPath: $(Build.BinariesDirectory)
+        buildType: specific
+        project: cpython
+        pipeline: Windows-Release
+        buildVersionToDownload: specific
+        buildId: ${{ parameters.BuildToPublish }}
 
-  - task: DownloadBuildArtifacts@0
-    displayName: 'Download artifact: msixupload'
-    condition: and(succeeded(), variables['BuildToPublish'])
-    inputs:
-      artifactName: msixupload
-      downloadPath: $(Build.BinariesDirectory)
-      buildType: specific
-      project: cpython
-      pipeline: Windows-Release
-      buildVersionToDownload: specific
-      buildId: $(BuildToPublish)
+  - ${{ else }}:
+    - task: DownloadBuildArtifacts@0
+      displayName: 'Download artifact: msixupload'
+      inputs:
+        artifactName: msixupload
+        downloadPath: $(Build.BinariesDirectory)
 
   # TODO: eq(variables['SigningCertificate'], variables['__RealSigningCertificate'])
   # If we are not real-signed, DO NOT PUBLISH
diff --git a/.azure-pipelines/windows-release/stage-sign.yml b/.azure-pipelines/windows-release/stage-sign.yml
index d43e077186..4481aa86ed 100644
--- a/.azure-pipelines/windows-release/stage-sign.yml
+++ b/.azure-pipelines/windows-release/stage-sign.yml
@@ -120,7 +120,7 @@ jobs:
   condition: and(succeeded(), not(variables['SigningCertificate']))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   steps:
   - checkout: none
diff --git a/.azure-pipelines/windows-release/stage-test-embed.yml b/.azure-pipelines/windows-release/stage-test-embed.yml
index d99bd74722..252db95993 100644
--- a/.azure-pipelines/windows-release/stage-test-embed.yml
+++ b/.azure-pipelines/windows-release/stage-test-embed.yml
@@ -4,7 +4,7 @@ jobs:
   condition: and(succeeded(), eq(variables['DoEmbed'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
diff --git a/.azure-pipelines/windows-release/stage-test-msi.yml b/.azure-pipelines/windows-release/stage-test-msi.yml
index 21e38c3959..4b02f478ce 100644
--- a/.azure-pipelines/windows-release/stage-test-msi.yml
+++ b/.azure-pipelines/windows-release/stage-test-msi.yml
@@ -3,7 +3,7 @@ jobs:
   displayName: Test MSI
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all
diff --git a/.azure-pipelines/windows-release/stage-test-nuget.yml b/.azure-pipelines/windows-release/stage-test-nuget.yml
index 94d815e952..c500baf29b 100644
--- a/.azure-pipelines/windows-release/stage-test-nuget.yml
+++ b/.azure-pipelines/windows-release/stage-test-nuget.yml
@@ -4,7 +4,7 @@ jobs:
   condition: and(succeeded(), eq(variables['DoNuget'], 'true'))
 
   pool:
-    vmImage: windows-2019
+    vmImage: windows-2022
 
   workspace:
     clean: all