From 6f2a615334486375c40d4837f85ddcf05e91ed42 Mon Sep 17 00:00:00 2001 From: pauline ramon Date: Thu, 6 Aug 2026 10:43:50 +0200 Subject: [PATCH 1/2] feat(ci): add reusable workflow for Azure Trusted Signing Signs Windows artifacts (exe/dll) via azure/artifact-signing-action@v2. Inputs: - files-folder (required): path to files to sign - files-folder-filter: extension filter, default 'exe' - artifact-name: upload signed files as artifact if set - endpoint: Azure Trusted Signing endpoint - signing-account-name (required): Azure account name - certificate-profile-name (required): certificate profile Secrets (required): AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET --- .github/workflows/sign-windows-artifacts.yml | 68 ++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 .github/workflows/sign-windows-artifacts.yml diff --git a/.github/workflows/sign-windows-artifacts.yml b/.github/workflows/sign-windows-artifacts.yml new file mode 100644 index 0000000..1ad7ae1 --- /dev/null +++ b/.github/workflows/sign-windows-artifacts.yml @@ -0,0 +1,68 @@ +--- +name: Sign Windows Artifacts (Azure Trusted Signing) + +on: + workflow_call: + inputs: + files-folder: + description: Path to the folder containing files to sign (relative to workspace root) + required: true + type: string + files-folder-filter: + description: Comma-separated list of file extensions to sign + required: false + type: string + default: exe + artifact-name: + description: Name for the uploaded signed artifact (leave empty to skip upload) + required: false + type: string + default: "" + endpoint: + description: Azure Trusted Signing endpoint URL + required: false + type: string + default: https://weu.codesigning.azure.net/ + signing-account-name: + description: Azure Trusted Signing account name + required: true + type: string + certificate-profile-name: + description: Azure Trusted Signing certificate profile name + required: true + type: string + secrets: + AZURE_TENANT_ID: + required: true + AZURE_CLIENT_ID: + required: true + AZURE_CLIENT_SECRET: + required: true + +jobs: + sign: + name: Sign with Azure Trusted Signing + runs-on: windows-latest + steps: + - name: Sign files + uses: azure/artifact-signing-action@v2 + with: + azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} + azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} + azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }} + endpoint: ${{ inputs.endpoint }} + signing-account-name: ${{ inputs.signing-account-name }} + certificate-profile-name: ${{ inputs.certificate-profile-name }} + files-folder: ${{ inputs.files-folder }} + files-folder-filter: ${{ inputs.files-folder-filter }} + file-digest: SHA256 + timestamp-rfc3161: http://timestamp.acs.microsoft.com + timestamp-digest: SHA256 + + - name: Upload signed artifacts + if: inputs.artifact-name != '' + uses: actions/upload-artifact@v4 + with: + name: ${{ inputs.artifact-name }} + path: ${{ inputs.files-folder }} + if-no-files-found: error From 0e483aea9e14f9d9ded556d6b9068d5deeac7d98 Mon Sep 17 00:00:00 2001 From: pauline ramon Date: Thu, 6 Aug 2026 11:58:12 +0200 Subject: [PATCH 2/2] feat(ci): add artifact download input and test caller workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sign-windows-artifacts.yml: add artifact-to-download input — downloads a GHA artifact into files-folder before signing (optional, default empty). test-sign.yml: workflow_dispatch test — copies cmd.exe as dummy binary, uploads as artifact, then calls the reusable signing workflow. --- .github/workflows/sign-windows-artifacts.yml | 12 ++++++ .github/workflows/test-sign.yml | 40 ++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 .github/workflows/test-sign.yml diff --git a/.github/workflows/sign-windows-artifacts.yml b/.github/workflows/sign-windows-artifacts.yml index 1ad7ae1..d76cced 100644 --- a/.github/workflows/sign-windows-artifacts.yml +++ b/.github/workflows/sign-windows-artifacts.yml @@ -31,6 +31,11 @@ on: description: Azure Trusted Signing certificate profile name required: true type: string + artifact-to-download: + description: Name of a GitHub Actions artifact to download before signing (leave empty to skip) + required: false + type: string + default: "" secrets: AZURE_TENANT_ID: required: true @@ -44,6 +49,13 @@ jobs: name: Sign with Azure Trusted Signing runs-on: windows-latest steps: + - name: Download artifact to sign + if: inputs.artifact-to-download != '' + uses: actions/download-artifact@v4 + with: + name: ${{ inputs.artifact-to-download }} + path: ${{ inputs.files-folder }} + - name: Sign files uses: azure/artifact-signing-action@v2 with: diff --git a/.github/workflows/test-sign.yml b/.github/workflows/test-sign.yml new file mode 100644 index 0000000..39487c7 --- /dev/null +++ b/.github/workflows/test-sign.yml @@ -0,0 +1,40 @@ +name: Test - Azure Trusted Signing + +on: + workflow_dispatch: + +jobs: + prepare: + name: Build test binary + runs-on: windows-latest + steps: + - name: Create dummy EXE for signing + shell: pwsh + run: | + New-Item -ItemType Directory -Force -Path to-sign + # Minimal valid PE header so Azure Trusted Signing accepts it + $bytes = [System.IO.File]::ReadAllBytes("C:\Windows\System32\cmd.exe") + [System.IO.File]::WriteAllBytes("to-sign\test.exe", $bytes) + Write-Host "Prepared to-sign\test.exe ($($bytes.Length) bytes)" + + - name: Upload test binary + uses: actions/upload-artifact@v4 + with: + name: test-binary + path: to-sign/ + if-no-files-found: error + + sign: + needs: prepare + uses: ./.github/workflows/sign-windows-artifacts.yml + with: + artifact-to-download: test-binary + files-folder: to-sign + files-folder-filter: exe + signing-account-name: cosmian-codesigning-test + certificate-profile-name: cosmian-test-profile + artifact-name: test-signed + secrets: + AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID_POC }} + AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID_POC }} + AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET_POC }}