ci: Sign Windows release artifacts#112
Open
MichalBerner wants to merge 1 commit intomainfrom
Open
Conversation
Split release builds from packaging so Windows executables can be signed before archives and checksums are created. The release workflow now builds raw binaries, signs Windows artifacts with Azure Artifact Signing via GitHub Actions OIDC, verifies Authenticode signatures, packages the signed binaries, and publishes checksums for the final archives. Document the required release-signing environment, Azure secrets, workflow variables, and certificate profile role.
There was a problem hiding this comment.
Pull request overview
This PR updates the release pipeline to Authenticode-sign Windows executables before packaging, so published .zip artifacts contain signed binaries and checksums can be produced from the final release archives.
Changes:
- Split release workflow into build → Windows signing (Azure OIDC) → package/release stages.
- Split packaging/checksum generation out of
scripts/build.shinto a newscripts/package.sh(withSKIP_PACKAGE=1support). - Document the required
release-signingGitHub environment and Azure configuration inRELEASING.md.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
.github/workflows/release.yml |
Separates build/sign/package jobs; adds Azure Artifact Signing + signature verification before creating release artifacts. |
scripts/build.sh |
Adds strict bash mode and delegates packaging to scripts/package.sh, with optional SKIP_PACKAGE=1. |
scripts/package.sh |
New script to create archives and generate checksums after packaging. |
RELEASING.md |
Documents Windows signing setup (environment, secrets/vars, federated credential subject) and updates the release checklist/process. |
| (cd "$BUILD_DIR" && zip "${PACKAGE_NAME}-${VERSION}-windows-amd64.zip" "${BINARY_NAME}-${VERSION}-windows-amd64.exe") | ||
| (cd "$BUILD_DIR" && zip "${PACKAGE_NAME}-${VERSION}-windows-386.zip" "${BINARY_NAME}-${VERSION}-windows-386.exe") | ||
| else | ||
| echo "Warning: zip command not found, skipping Windows archives" |
Comment on lines
1
to
+14
| name: Release | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - 'v*' | ||
|
|
||
| jobs: | ||
| build: | ||
| name: Build and Release | ||
| name: Build binaries | ||
| runs-on: ubuntu-latest | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
Comment on lines
9
to
+12
| build: | ||
| name: Build and Release | ||
| name: Build binaries | ||
| runs-on: ubuntu-latest | ||
|
|
||
| permissions: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signs Windows release executables before packaging so published
.zipartifacts contain Authenticode-signed binaries.The release workflow now separates raw binary builds from packaging, uploads unsigned build outputs, signs Windows
.exefiles with Azure Artifact Signing through GitHub Actions OIDC, verifies the resulting signatures, then packages the signed artifacts and generates checksums from the final archives.scripts/build.shcan now skip packaging viaSKIP_PACKAGE=1, while the newscripts/package.showns archive and checksum creation.RELEASING.mddocuments the requiredrelease-signingenvironment, Azure secrets, workflow variables, and certificate profile role.Resolves #75
Remarks
v*tag pushes.Review focus:
.github/workflows/release.yml- build/sign/package job split and Azure signing setupscripts/build.shandscripts/package.sh- packaging split and checksum generationRELEASING.md- required release-signing setup documentation