From 42f76f83af37287b91d68902d8c2f25502731d8b Mon Sep 17 00:00:00 2001
From: Beq Janus <beqjanus@gmail.com>
Date: Wed, 22 Jan 2025 01:30:34 +0000
Subject: [PATCH] Update sign.yml for azure codesigning tests

---
 .github/workflows/sign.yml | 60 +++++++++++++++++++++++++-------------
 1 file changed, 40 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/sign.yml b/.github/workflows/sign.yml
index 6cdc719a7b..c49ab0d1a5 100644
--- a/.github/workflows/sign.yml
+++ b/.github/workflows/sign.yml
@@ -93,28 +93,48 @@ jobs:
         run: |
           mkdir -p to_sign
           cp "setup_exe_files/${{ matrix.file }}" to_sign/
-      - name: Upload unsigned artifact
+      # - name: Upload unsigned artifact
+      #   id: upload-unsigned-artifact
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: unsigned-artifact-${{ matrix.file }}
+      #     path: to_sign/${{ matrix.file }}          
+
+      # - name: sign the file
+        # uses: signpath/github-action-submit-signing-request@v1
+        # env:
+        #     SIGNPATH_SIGNING_POLICY_SLUG: ${{ github.event.inputs.policy == 'Test' && vars.SIGNPATH_SIGNING_POLICY_SLUG_TEST || vars.SIGNPATH_SIGNING_POLICY_SLUG_RELEASE }}
+        # with:
+        #   api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+        #   organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
+        #   project-slug: '${{ vars.SIGNPATH_PROJECT_SLUG }}'
+        #   signing-policy-slug:  '${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}'
+        #   github-artifact-id:  "${{steps.upload-unsigned-artifact.outputs.artifact-id}}"
+        #   wait-for-completion: true
+        #   output-artifact-directory: 'application-signed'
+      - name: Azure Trusted Signing
+        uses: azure/trusted-signing-action@v0.3.16
+        with:
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+          endpoint: ${{ secrets.AZURE_ENDPOINT }}
+          trusted-signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
+        
+          # Sign all exes inside the folder
+          files-folder: to_sign
+          files-folder-filter: exe
+          
+      # - name: Upload signed artifact
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: signed-artifact-${{ matrix.file }}
+      #     path: ./application-signed
+            # - name: Upload unsigned artifact
+      - name: Upload signed artifact
         id: upload-unsigned-artifact
         uses: actions/upload-artifact@v4
         with:
           name: unsigned-artifact-${{ matrix.file }}
           path: to_sign/${{ matrix.file }}          
-
-      - name: sign the file
-        uses: signpath/github-action-submit-signing-request@v1
-        env:
-            SIGNPATH_SIGNING_POLICY_SLUG: ${{ github.event.inputs.policy == 'Test' && vars.SIGNPATH_SIGNING_POLICY_SLUG_TEST || vars.SIGNPATH_SIGNING_POLICY_SLUG_RELEASE }}
-        with:
-          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
-          organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
-          project-slug: '${{ vars.SIGNPATH_PROJECT_SLUG }}'
-          signing-policy-slug:  '${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}'
-          github-artifact-id:  "${{steps.upload-unsigned-artifact.outputs.artifact-id}}"
-          wait-for-completion: true
-          output-artifact-directory: 'application-signed'
-
-      - name: Upload signed artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: signed-artifact-${{ matrix.file }}
-          path: ./application-signed
\ No newline at end of file