fix: use env context for SignPath secret check in release workflows#129
Conversation
The 'secrets' context cannot be used in step-level if: conditions, which made the Release workflow fail to parse on workflow_dispatch. Map the secret to a job-level env var and check that instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Code Review Roast 🔥Verdict: No Issues Found | Recommendation: Merge Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything. 📊 Overall: Like finding a unicorn in production — I didn't think clean PRs existed anymore, but here we are. Files Reviewed (2 files)
Reply with Previous Review Summaries (3 snapshots, latest commit 8bb967f)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 8bb967f)Verdict: No Issues Found | Recommendation: Merge Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything. 📊 Overall: Like finding a unicorn in production — I didn't think clean PRs existed anymore, but here we are. Files Reviewed (2 files)
Reply with Previous review (commit a8a6ea1)Verdict: No Issues Found | Recommendation: Merge Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything. 📊 Overall: Like finding a unicorn in production — I didn't think clean PRs existed anymore, but here we are. Files Reviewed (2 files)
Reply with Previous review (commit 8160b58)Verdict: No Issues Found | Recommendation: Merge Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything. 📊 Overall: Like finding a unicorn in production — I didn't think clean PRs existed anymore, but here we are. Files Reviewed (2 files)
Reply with Reviewed by step-3.7-flash · Input: 67.3K · Output: 7.5K · Cached: 141.2K Review guidance: REVIEW.md from base branch |
Address security review: replace job-level SIGNPATH_API_TOKEN env (which exposed the secret to all steps including the AI changelog) with a preliminary boolean-check step. The token is now referenced only in the check step and the SignPath action's with: block. Pin go-winres to v0.3.3 instead of @latest for supply-chain safety. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The submit-signing-request action does not accept input/output-artifact-path. It requires the artifact uploaded via actions/upload-artifact (yielding a numeric artifact-id) and writes signed output to output-artifact-directory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Switch the signing gate from secret presence to an explicit USE_SIGNPATH flag, so releases skip signing entirely while the SignPath certificate is still pending. Set USE_SIGNPATH=true to enable once the cert is issued. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
USE_SIGNPATH is configured as a repository variable, not a secret. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The fallback path escaped the quotes around the revision range, passing
literal quotes to git ('"v0.6.1..HEAD"') and failing with exit 128 when
the AI changelog generation returned empty. Use normal shell quoting.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
The 'secrets' context cannot be used in step-level if: conditions, which made the Release workflow fail to parse on workflow_dispatch. Map the secret to a job-level env var and check that instead.