Integrate with Azure Pipelines

Azure Pipelines can automatically protect your applications during every build by integrating Dotfuscator into your build process. This approach enables you to produce protected assemblies as part of your continuous integration (CI) or continuous delivery (CD) pipeline without requiring manual steps.

This article explains how to configure Dotfuscator using the NuGet package on Azure Pipelines, including Microsoft-hosted macOS build agents.

Important: The process described in this article uses YAML Pipelines in Azure DevOps (AzDO). 

Before You Begin

Before configuring your pipeline, make sure you have:

• An existing Xamarin.iOS build
• A valid Dotfuscator license.

Host the Dotfuscator NuGet Package

Before integrating Dotfuscator into our build, you need to host the Dotfuscator NuGet package on a private feed.

1. Go to Dotfuscator Downloads.
2. Download the Dotfuscator 6 Beta NuGet Package. 
3. Publish the package to a private package feed, such as Azure DevOps Artifacts.
4. Verify that the package is available to your build pipeline.

If you successfully push the package, it shows up in your list of packages.

 For more information, see Azure Artifacts.

Configure the Project

Before configuring Azure Pipelines, integrate Dotfuscator into your project. For more information, see Protect Your App with MSBuild and Protecting Xamarin Applications.

Configure macOS for Dotfuscator 6 Beta

Dotfuscator Beta 6 cross-platform support requires .NET Core 3.x SDK. Install the required .NET SDK with the following command near the start of your build:

curl -sSL https://dot.net/v1/dotnet-install.sh | bash

AzDO images default to an older version of Mono, which is not supported by the current Dotfuscator beta. Run the following command to ensure a newer version of Mono is used by default:

echo "##vso[task.prependpath]/Library/Frameworks/Mono.framework/Versions/6.4.0/bin"

Run these commands in a single step near the start of your pipeline as follows:

- task: Bash@3
  inputs:
    targetType: 'inline'
    script: |
      curl -sSL https://dot.net/v1/dotnet-install.sh | bash
      echo 
"##vso[task.prependpath]/Library/Frameworks/Mono.framework/Versions/6.4.0/bin"

Install Dotfuscator As Part of the Build

You must install the Dotfuscator NuGet package before restoring packages or building the solution:

- task: NuGetCommand@2
  inputs:
    command: 'custom'
    arguments: 'install PreEmptive.Protection.Dotfuscator.Pro -OutputDirectory $(Agent.TempDirectory) -PreRelease -x -Source https://pkgs.dev.azure.com/[AzDO Org]/[AzDO Project]/_packaging/[AzDO Feed]/nuget/v3/index.json'

Note the use of the -PreRelease option (since this is a beta package), as well as the -x option to exclude the version name from the directory where Dotfuscator is installed.

Configure the Dotfuscator License

Create a secret pipeline variable named: Dotfuscator_License. Set its value to your Dotfuscator license key.
 

Azure DevOps stores secret variables securely and masks them in build logs. For more information, see Secret variables.

Set Environment and MSBuild Properties

Because Dotfuscator is installed into a temporary directory during the build, NuGet must know where to locate the Dotfuscator MSBuild targets.

During a NuGet restore, NuGet can use the environment variable NUGET_RESTORE_MSBUILD_ARGS to define additional arguments. Update any NuGet restore calls to use the env tag like so:

- task: NuGetCommand@2
  inputs:
    command: 'restore'
    restoreSolution: '**/*.sln'
  env: { "NUGET_RESTORE_MSBUILD_ARGS": '/p:DotfuscatorMSBuildDir="$(Agent.TempDirectory)/PreEmptive.Protection.Dotfuscator.Pro/tools/msbuilddir"' }

Any calls to MSBuild should likewise be updated to define DotfuscatorMSBuildDir and to pass in the Dotfuscator license key using the variable defined above:

- task: XamarinAndroid@1
  inputs:
    projectFile: '**/*droid*.csproj'
    outputDirectory: '$(outputDirectory)'
    configuration: '$(buildConfiguration)'
    msbuildArguments: '/p:DotfuscatorMSBuildDir="$(Agent.TempDirectory)/PreEmptive.Protection.Dotfuscator.Pro/tools/msbuilddir" /p:DotfuscatorLicense="$(Dotfuscator_License)"'
    jdkOption: 'JDKVersion'

Verify the Build

Given the above steps and settings, you should be able to run the pipeline and see Dotfuscator protecting your application. After the pipeline completes, verify that:

• Dotfuscator runs successfully.
• Protected assemblies are generated.
• The build output contains the expected Dotfuscator reports.

AppCenter Build

AppCenter requires less configuration because the build environment already includes the required .NET SDK and Mono version. Instead, use a post-clone script and set environment variables to configure the build as necessary.

Configure Environment Variables

Define the following environment variables in your AppCenter build.

When you configure the environment variables, they should look as follows: 

Post Clone Script

Create or update the appcenter-post-clone.sh script to include the following command:

#!/bin/bash
nuget install PreEmptive.Protection.Dotfuscator.Pro -OutputDirectory $APPCENTER_SOURCE_DIRECTORY  -PreRelease -x -Source $NUGET_FEED_URL

After the package is installed, run the Build. 

Related Articles

• Use Dotfuscator on Build Agents
• Protect Your App with MSBuild
• Protect Your App Using the Command Line Interface
• Integrate with Docker