Skip to content

Fix package signing #2631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
martincostello merged 7 commits into from
Jun 5, 2025
Merged

Fix package signing #2631

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ff6690b
Fix package signing
martincostello Jun 1, 2025
09382ee
Fix permissions
martincostello Jun 1, 2025
0e6da04
Skip Azure login
martincostello Jun 4, 2025
b8f359a
Restore Azure login
martincostello Jun 4, 2025
9d9ddbe
Update Azure authentication type
martincostello Jun 4, 2025
99a361b
Remove auth-type
martincostello Jun 4, 2025
144eaeb
Apply suggestions from code review
martincostello Jun 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,7 @@ env:
NUGET_XMLDOC_MODE: skip
TERM: xterm

permissions:
contents: read
permissions: {}

jobs:
build:
Expand All @@ -39,6 +38,9 @@ jobs:
package-names: ${{ steps.build.outputs.package-names }}
package-version: ${{ steps.build.outputs.package-version }}

permissions:
contents: read

strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -187,6 +189,9 @@ jobs:
github.event.repository.fork == false &&
startsWith(github.ref, 'refs/tags/')

permissions:
id-token: write

steps:

- name: Download unsigned packages
Expand All @@ -211,14 +216,18 @@ jobs:
DOTNET_SIGN_VERSION: ${{ needs.build.outputs.dotnet-sign-version }}
run: dotnet tool install --tool-path . sign --version ${env:DOTNET_SIGN_VERSION}

- name: Azure log in
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
with:
client-id: ${{ secrets.SIGN_CLI_APPLICATION_ID }}
subscription-id: ${{ secrets.SIGN_CLI_SUBSCRIPTION_ID }}
tenant-id: ${{ secrets.SIGN_CLI_TENANT_ID }}

- name: Sign artifacts
shell: pwsh
env:
AZURE_CLIENT_ID: ${{ secrets.SIGN_CLI_APPLICATION_ID }}
AZURE_CLIENT_SECRET: ${{ secrets.SIGN_CLI_SECRET }}
AZURE_KEY_VAULT_CERTIFICATE: ${{ secrets.SIGN_CLI_CERT_NAME }}
AZURE_KEY_VAULT_URL: ${{ secrets.SIGN_CLI_VAULT_URI }}
AZURE_TENANT_ID: ${{ secrets.SIGN_CLI_TENANT_ID }}
VERBOSITY: ${{ runner.debug == '1' && 'Debug' || 'Warning' }}
run: |
./sign code azure-key-vault `
Expand Down Expand Up @@ -247,6 +256,7 @@ jobs:
validate-signed-packages:
needs: [ build, sign ]
runs-on: windows-latest

steps:

- name: Download packages
Expand Down Expand Up @@ -337,6 +347,7 @@ jobs:
publish-nuget:
needs: [ build, validate-signed-packages ]
runs-on: ubuntu-latest

steps:

- name: Download signed packages
Expand Down