livie
/
phoenix-firestorm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update sign.yml for azure codesigning tests

master
Beq Janus 2025-01-22 01:30:34 +00:00 committed by GitHub
parent 96a2f7e6d5
commit 42f76f83af
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 40 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
.github/workflows/sign.yml vendored
View File

@ -93,28 +93,48 @@ jobs:
run: |
mkdir -p to_sign
cp "setup_exe_files/${{ matrix.file }}" to_sign/
- name: Upload unsigned artifact
# - name: Upload unsigned artifact
# id: upload-unsigned-artifact
# uses: actions/upload-artifact@v4
# with:
# name: unsigned-artifact-${{ matrix.file }}
# path: to_sign/${{ matrix.file }}
# - name: sign the file
# uses: signpath/github-action-submit-signing-request@v1
# env:
# SIGNPATH_SIGNING_POLICY_SLUG: ${{ github.event.inputs.policy == 'Test' && vars.SIGNPATH_SIGNING_POLICY_SLUG_TEST || vars.SIGNPATH_SIGNING_POLICY_SLUG_RELEASE }}
# with:
# api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
# organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
# project-slug: '${{ vars.SIGNPATH_PROJECT_SLUG }}'
# signing-policy-slug: '${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}'
# github-artifact-id: "${{steps.upload-unsigned-artifact.outputs.artifact-id}}"
# wait-for-completion: true
# output-artifact-directory: 'application-signed'
- name: Azure Trusted Signing
uses: azure/trusted-signing-action@v0.3.16
with:
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
endpoint: ${{ secrets.AZURE_ENDPOINT }}
trusted-signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
# Sign all exes inside the folder
files-folder: to_sign
files-folder-filter: exe
# - name: Upload signed artifact
# uses: actions/upload-artifact@v4
# with:
# name: signed-artifact-${{ matrix.file }}
# path: ./application-signed
# - name: Upload unsigned artifact
- name: Upload signed artifact
id: upload-unsigned-artifact
uses: actions/upload-artifact@v4
with:
name: unsigned-artifact-${{ matrix.file }}
path: to_sign/${{ matrix.file }}
- name: sign the file
uses: signpath/github-action-submit-signing-request@v1
env:
SIGNPATH_SIGNING_POLICY_SLUG: ${{ github.event.inputs.policy == 'Test' && vars.SIGNPATH_SIGNING_POLICY_SLUG_TEST || vars.SIGNPATH_SIGNING_POLICY_SLUG_RELEASE }}
with:
api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
project-slug: '${{ vars.SIGNPATH_PROJECT_SLUG }}'
signing-policy-slug: '${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}'
github-artifact-id: "${{steps.upload-unsigned-artifact.outputs.artifact-id}}"
wait-for-completion: true
output-artifact-directory: 'application-signed'
- name: Upload signed artifact
uses: actions/upload-artifact@v4
with:
name: signed-artifact-${{ matrix.file }}
path: ./application-signed