Turn in-build signing on (#43838)

Also clean up some cruft from the YAML

.azure/pipelines/ci.yml

@@ -41,16 +41,14 @@ variables:
   value: true
 - name: _TeamName
   value:  AspNetCore
-- name: _DotNetPublishToBlobFeed
-  value: true
 - name: _PublishUsingPipelines
   value: true
-- name: _DotNetArtifactsCategory
-  value: .NETCORE
-- name: _DotNetValidationArtifactsCategory
-  value: .NETCORE
-- name: PostBuildSign
-  value: true
+- ${{ if or(startswith(variables['Build.SourceBranch'], 'refs/heads/release/'), startswith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'), notin(variables['Build.Reason'], 'Manual')) }}:
+  - name: PostBuildSign
+    value: false
+- ${{ else }}:
+  - name: PostBuildSign
+    value: true
 - name: _UseHelixOpenQueues
   value: ${{ ne(variables['System.TeamProject'], 'internal') }}
 - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
@@ -61,17 +59,12 @@ variables:
            /p:PostBuildSign=$(PostBuildSign)
   # DotNet-Blob-Feed provides: dotnetfeed-storage-access-key-1
   # Publish-Build-Assets provides: MaestroAccessToken, BotAccount-dotnet-maestro-bot-PAT
-  - group: DotNet-Blob-Feed
   - group: Publish-Build-Assets
   # The following extra properties are not set when testing. Use with final build.[cmd,sh] of asset-producing jobs.
   - name: _PublishArgs
     value: /p:Publish=true
            /p:GenerateChecksums=true
-           /p:DotNetPublishBlobFeedKey=$(dotnetfeed-storage-access-key-1)
-           /p:DotNetPublishBlobFeedUrl=https://dotnetfeed.blob.core.windows.net/dotnet-core/index.json
-           /p:DotNetPublishToBlobFeed=$(_DotNetPublishToBlobFeed)
            /p:DotNetPublishUsingPipelines=$(_PublishUsingPipelines)
-           /p:DotNetArtifactsCategory=$(_DotNetArtifactsCategory)
   # Variables for source indexing afterBuild step and job.
   - name: sourceIndexPackageVersion
     value: 1.0.1-20210614.1