chore: added code-signing-workflow #718
Conversation
| @@ -121,6 +97,71 @@ jobs: | |||
| uses: sendgrid/dx-automator/actions/datadog-release-metric@main | |||
| env: | |||
| DD_API_KEY: ${{ secrets.DATADOG_API_KEY }} | |||
|
|
|||
| code-signing: | |||
There was a problem hiding this comment.
What I understand is; we dont need a separate step to import the certificate now, where are we storing the certificate then?
| echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV" | ||
| echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV" | ||
| echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV" | ||
| echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV" |
There was a problem hiding this comment.
Will this print "****" in the logs? If yes, why do we need to print it? If no, lets not print it at all. :)
There was a problem hiding this comment.
These lines will just set env variables and won't print anything, you can check the run here
| id: SSMClientToolSetup | ||
| uses: digicert/ssm-code-signing@v0.0.2 | ||
| env: | ||
| SM_API_KEY: ${{ env.SM_API_KEY }} |
There was a problem hiding this comment.
Rather than setting the API_Key in env var , can we use it from Github secrets? I see from line 127 that its originally retrieved from secrets.
Also, please make sure that you add details and values of these secrets in 1pass vault.
There was a problem hiding this comment.
Actually, I tried using SM_API_KEY from secrets but here it reads env variables only, so for that we need to set the env variable. See "x-api-key:%SM_API_KEY%"
| - name: Signing using Nuget | ||
| run: | | ||
| dotnet pack -c Release | ||
| nuget sign **/*.nupkg -Timestamper http://timestamp.digicert.com -outputdirectory .\NugetSigned -CertificateFingerprint ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} -HashAlgorithm SHA256 -Verbosity detailed -Overwrite |
There was a problem hiding this comment.
I am confused with the deploy step above (line#90) it has the same pack+sign+push step with secrets.CERTIFICATE_PASSWORD. How does that work in sync with this?
There was a problem hiding this comment.
Oh right, that step needs to be removed now. I will do it right away
|
Here is a successful run of this workflow |
|
Fixes
Added code-signing-workflow
Checklist
If you have questions, please file a support ticket, or create a GitHub Issue in this repository.