Add SignPath package signing

[AArnott]

SignPath Foundation approved this project for OSS code signing, and test signing must be exercised before the release certificate is issued. This integrates SignPath into the existing artifact promotion flow while preserving GitHub-verified provenance.

Summary

• Test-sign NuGet deployables from Linux builds, including same-repository pull requests, and publish signed non-PR packages to the CI feeds.
• Verify that SignPath returns every input artifact and signs every NuGet package.
• Retain each non-PR test-signing request so publishing a GitHub Release can resubmit the exact tested artifact for manually approved release signing.
• Accept release candidates built from either main or v*.* branches, including prerelease packages built directly from main.
• Validate manually selected workflow runs before publishing and append the required code signing policy to GitHub Releases.
• Add the SignPath Foundation attribution, privacy statement, roles, and contributor setup documentation.

Repository configuration

Before merging, configure the SIGNPATH_API_TOKEN secret and the SIGNPATH_ORGANIZATION_ID and SIGNPATH_PROJECT_SLUG repository variables. The artifact configuration slug is intentionally hardcoded so future structural changes can use a new versioned configuration within the pull request that introduces them. The SignPath release-signing policy must allow origin verification from both main and v*.* branches and require manual approval.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR documents the repository’s code signing policy and updates CI/release workflows to test-sign NuGet packages in CI and re-sign the exact tested artifacts for official releases via SignPath.

Changes:

• Add “Code signing policy” sections to package READMEs and the root README.
• Update release process documentation to describe the new SignPath-based signing flow and required repo settings.
• Update GitHub Actions build/release workflows to produce a signing request artifact and resubmit it for release signing.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/Nerdbank.MessagePack/README.md	Adds a link to the repository code signing policy.
src/Nerdbank.MessagePack.SignalR/README.md	Adds a link to the repository code signing policy.
src/Nerdbank.MessagePack.Godot/README.md	Adds a link to the repository code signing policy.
src/Nerdbank.MessagePack.AspNetCoreMvcFormatter/README.md	Adds a link to the repository code signing policy.
README.md	Documents the repository’s code signing policy and roles.
CONTRIBUTING.md	Updates release instructions and documents the SignPath signing setup.
.github/workflows/release.yml	Re-signs tested artifacts for releases and amends release notes with signing policy text.
.github/workflows/build.yml	Produces signing request metadata, test-signs artifacts, and pushes signed CI packages.
.github/actions/publish-artifacts/action.yaml	Exposes the deployables artifact ID for downstream signing steps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

.github/workflows/build.yml:132

• The PR description says the repo must define SIGNPATH_ARTIFACT_CONFIGURATION_SLUG, but the workflow hardcodes artifact-configuration-slug: initial. This mismatch can confuse maintainers during setup (and SIGNPATH_ARTIFACT_CONFIGURATION_SLUG is currently unused). Either wire the workflow to ${{ vars.SIGNPATH_ARTIFACT_CONFIGURATION_SLUG }} (and update docs), or remove that variable from the PR’s merge/setup instructions.

        project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
        signing-policy-slug: test-signing
        artifact-configuration-slug: initial
        github-artifact-id: ${{ steps.publish-artifacts.outputs.deployables-artifact-id }}
        output-artifact-directory: ${{ runner.temp }}/_artifacts/test-signed-deployables

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/release.yml:65

• Same v*.* mismatch here: the eligible build filter only allows v<major> or v<major>.<minor>. This can cause releases to fail to find an otherwise valid build from a v1.2.3-style branch (which v*.* matches). Update the regex to allow multiple version segments.

            $_.event -eq 'push' -and $_.headBranch -match '^(?:main|v\d+(?:\.\d+)?)$'

.github/workflows/release.yml:68

• This filter is intended to detect release branches, but it only matches v<major> or v<major>.<minor>. If release branches can include patch segments (e.g. v1.2.3), this will incorrectly treat them as non-release branches and change the selection priority. Allow multiple dot-separated numeric segments.

            $_.headBranch -match '^v\d+(?:\.\d+)?$'

.github/workflows/release.yml:38

• The release workflow claims to accept builds from main or v*.* release branches, but this validation regex only allows v<major> or v<major>.<minor> (it rejects v1.2.3, which is matched by the build workflow trigger v*.*). Consider allowing any number of dot-separated numeric segments so the manual run selection matches the documented/triggered branch pattern.

This issue also appears in the following locations of the same file:

• line 65
• line 68

              -or $run.head_branch -notmatch '^(?:main|v\d+(?:\.\d+)?)$' `

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.31%. Comparing base (f4fa4eb) to head (028dfa7).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1035      +/-   ##
==========================================
+ Coverage   76.30%   76.31%   +0.01%     
==========================================
  Files         175      175              
  Lines       13382    13382              
  Branches     2709     2709              
==========================================
+ Hits        10211    10213       +2     
+ Misses       2293     2289       -4     
- Partials      878      880       +2     

Flag	Coverage Δ
Linux	75.26% <ø> (-0.02%)	⬇️
Windows	76.00% <ø> (+0.02%)	⬆️
macOS	75.24% <ø> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

[AArnott]

Superseded by #1043