Skip to content

Commit 3c26d6f

Browse files
turbobobbytraykovturbobobbytraykov
authored
Reworking the code signing mechanism. work in progress.
Added workflow dispatch inputs for versioning and build configuration. Updated build and signing steps to use environment variables and Azure Key Vault for signing.
1 parent 16eadab commit 3c26d6f

1 file changed

Lines changed: 86 additions & 18 deletions

File tree

‎.github/workflows/publish.yml‎

Lines changed: 86 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,30 @@ name: Publish NuGet Package
33
on:
44
release:
55
types: [created]
6+
workflow_dispatch:
7+
inputs:
8+
version:
9+
description: "default: 0.7.2-alpha.0"
10+
required: false
11+
default: ""
12+
angular_regular_version:
13+
description: "Angular regular version | default: 21.2.0 (leave empty to skip)"
14+
required: false
15+
default: ""
616

717
env:
8-
VERSION: ${{ github.ref_name }}
18+
VERSION: ${{ inputs.version || github.ref_name }}
19+
BUILD_CONFIGURATION: Release
920

1021
jobs:
1122
publish:
1223
runs-on: ubuntu-latest
1324
environment: NuGet Deploy
1425
permissions:
1526
id-token: write # enable GitHub OIDC token issuance for this job
27+
contents: read
28+
attestations: write
29+
1630

1731
steps:
1832
- uses: actions/checkout@v4
@@ -37,35 +51,89 @@ jobs:
3751
run: dotnet restore src/IgniteUI.Blazor.GridLite/IgniteUI.Blazor.GridLite.csproj
3852

3953
- name: Build
40-
run: dotnet build src/IgniteUI.Blazor.GridLite/IgniteUI.Blazor.GridLite.csproj --configuration Release -p:Version=${VERSION} -p:RunNodeBuild=false -p:GeneratePackageOnBuild=false
54+
run: dotnet build src/IgniteUI.Blazor.GridLite/IgniteUI.Blazor.GridLite.csproj --configuration {{ env.BUILD_CONFIGURATION }} -p:Version=${VERSION} -p:RunNodeBuild=false -p:GeneratePackageOnBuild=false
4155

42-
- name: Pack NuGet package
43-
run: dotnet pack src/IgniteUI.Blazor.GridLite/IgniteUI.Blazor.GridLite.csproj --configuration Release --no-build --no-restore -p:PackageVersion=${VERSION} -o ./artifacts
56+
- name: Install Sign CLI
57+
run: dotnet tool install --tool-path ./sign --prerelease sign
4458

45-
# sign package:
46-
- name: Restore signing certificate
47-
env:
48-
SIGNING_CERTIFICATE_2023_2026: ${{ secrets.SIGNING_CERTIFICATE_2023_2026 }}
59+
- name: Authenticate to Azure
60+
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
61+
with:
62+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
63+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
64+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
65+
66+
- name: Sign DLLs
67+
shell: pwsh
68+
run: >
69+
./sign/sign code azure-key-vault "src/IgniteUI.Blazor.GridLite/**/*.dll"
70+
--base-directory "${{ github.workspace }}/bin/${{ env.BUILD_CONFIGURATION }}"
71+
--azure-key-vault-url "${{ secrets.AZURE_KEYVAULT_URL }}"
72+
--azure-key-vault-certificate "${{ secrets.AZURE_KEYVAULT_CERTIFICATE }}"
73+
74+
- name: Validate DLL signatures
75+
shell: pwsh
4976
run: |
50-
echo $SIGNING_CERTIFICATE_2023_2026 | base64 --decode > signingcert.pfx
77+
$dlls = Get-ChildItem -Path "${{ github.workspace }}\bin\${{ env.BUILD_CONFIGURATION }}" -Filter "*.dll" -Recurse
78+
$failed = @()
79+
foreach ($dll in $dlls) {
80+
$sig = Get-AuthenticodeSignature $dll.FullName
81+
if ($sig.Status -ne 'Valid') {
82+
$failed += $dll.FullName
83+
}
84+
}
85+
if ($failed.Count -gt 0) {
86+
Write-Error "Unsigned DLLs found:`n$($failed -join "`n")"
87+
exit 1
88+
}
89+
Write-Host "All DLLs signed successfully."
90+
91+
- name: Pack NuGet package
92+
run: dotnet pack src/IgniteUI.Blazor.GridLite/IgniteUI.Blazor.GridLite.csproj --configuration {{ env.BUILD_CONFIGURATION }} --no-build --no-restore -p:PackageVersion=${VERSION} -o ./artifacts
5193

5294
- name: Sign NuGet package
53-
env:
54-
SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.SIGNING_CERTIFICATE_PASSWORD }}
55-
SIGNING_CERTIFICATE_TIMESTAMP_URL: ${{ vars.SIGNING_CERTIFICATE_TIMESTAMP_URL }}
56-
run: |
57-
dotnet nuget sign "./artifacts/*.nupkg" \
58-
--certificate-path signingcert.pfx \
59-
--certificate-password "${SIGNING_CERTIFICATE_PASSWORD}" \
60-
--timestamper "${SIGNING_CERTIFICATE_TIMESTAMP_URL}"
95+
shell: pwsh
96+
run: >
97+
./sign/sign code azure-key-vault "*.nupkg"
98+
--base-directory "${{ github.workspace }}/artifacts"
99+
--azure-key-vault-url "${{ secrets.AZURE_KEYVAULT_URL }}"
100+
--azure-key-vault-certificate "${{ secrets.AZURE_KEYVAULT_CERTIFICATE }}"
101+
102+
- name: Validate NuGet package signature
103+
run: dotnet nuget verify "${{ github.workspace }}/artifacts/IgniteUI.Blazor.GridLite.${{ env.VERSION }}.nupkg"
104+
105+
# sign package:
106+
# - name: Restore signing certificate
107+
# env:
108+
# SIGNING_CERTIFICATE_2023_2026: ${{ secrets.SIGNING_CERTIFICATE_2023_2026 }}
109+
# run: |
110+
# echo $SIGNING_CERTIFICATE_2023_2026 | base64 --decode > signingcert.pfx
111+
112+
# - name: Sign NuGet package
113+
# env:
114+
# SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.SIGNING_CERTIFICATE_PASSWORD }}
115+
# SIGNING_CERTIFICATE_TIMESTAMP_URL: ${{ vars.SIGNING_CERTIFICATE_TIMESTAMP_URL }}
116+
# run: |
117+
# dotnet nuget sign "./artifacts/*.nupkg" \
118+
# --certificate-path signingcert.pfx \
119+
# --certificate-password "${SIGNING_CERTIFICATE_PASSWORD}" \
120+
# --timestamper "${SIGNING_CERTIFICATE_TIMESTAMP_URL}"
61121

122+
- name: Upload artifact
123+
uses: actions/upload-artifact@v7.0.1
124+
with:
125+
name: Generated NuGet Package
126+
path: ${{ github.workspace }}/artifacts
127+
retention-days: 1
128+
62129
# Get a short-lived NuGet API key
63130
- name: NuGet login (OIDC → temp API key)
64-
uses: NuGet/login@v1
131+
uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
65132
id: login
66133
with:
67134
user: ${{ secrets.INFRAGISTICS_NUGET_ORG_USER }}
68135

69136
# Push the package
70137
- name: NuGet push
138+
if: false # temp disable while working in the branch
71139
run: dotnet nuget push artifacts/IgniteUI.Blazor.GridLite.${VERSION}.nupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --source "https://api.nuget.org/v3/index.json"

0 commit comments

Comments
 (0)