From 8160b5877cb91222801525588054617296c2f0f8 Mon Sep 17 00:00:00 2001 From: TUYIZERE Samuel Date: Thu, 23 Jul 2026 15:58:10 +0200 Subject: [PATCH 1/6] fix: use env context for SignPath secret check in release workflows The 'secrets' context cannot be used in step-level if: conditions, which made the Release workflow fail to parse on workflow_dispatch. Map the secret to a job-level env var and check that instead. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/beta-release.yml | 8 +++++--- .github/workflows/release.yml | 8 +++++--- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index dcdd4d3..edad20b 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -36,6 +36,8 @@ jobs: name: Build & Release needs: validate runs-on: macos-latest + env: + SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} outputs: beta_tag: ${{ steps.version.outputs.beta_tag }} prod_version: ${{ steps.version.outputs.prod_version }} @@ -126,7 +128,7 @@ jobs: ls -lh dist/ - name: Package Windows binaries for signing - if: ${{ secrets.SIGNPATH_API_TOKEN != '' }} + if: ${{ env.SIGNPATH_API_TOKEN != '' }} run: | mkdir -p signing cp dist/routatic-proxy_windows-amd64.exe signing/ @@ -134,7 +136,7 @@ jobs: cd signing && zip ../windows-binaries.zip *.exe - name: Sign Windows binaries (SignPath) - if: ${{ secrets.SIGNPATH_API_TOKEN != '' }} + if: ${{ env.SIGNPATH_API_TOKEN != '' }} uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1 with: api-token: ${{ secrets.SIGNPATH_API_TOKEN }} @@ -149,7 +151,7 @@ jobs: wait-for-completion-timeout-in-seconds: 300 - name: Replace with signed Windows binaries - if: ${{ secrets.SIGNPATH_API_TOKEN != '' }} + if: ${{ env.SIGNPATH_API_TOKEN != '' }} run: | unzip -o windows-binaries-signed.zip -d signed/ cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 575b4c4..1f18b6d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,6 +40,8 @@ jobs: name: Build & Release needs: validate runs-on: macos-latest + env: + SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} outputs: tag: ${{ steps.version.outputs.tag }} steps: @@ -124,7 +126,7 @@ jobs: ls -lh dist/ - name: Package Windows binaries for signing - if: ${{ secrets.SIGNPATH_API_TOKEN != '' }} + if: ${{ env.SIGNPATH_API_TOKEN != '' }} run: | mkdir -p signing cp dist/routatic-proxy_windows-amd64.exe signing/ @@ -132,7 +134,7 @@ jobs: cd signing && zip ../windows-binaries.zip *.exe - name: Sign Windows binaries (SignPath) - if: ${{ secrets.SIGNPATH_API_TOKEN != '' }} + if: ${{ env.SIGNPATH_API_TOKEN != '' }} uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1 with: api-token: ${{ secrets.SIGNPATH_API_TOKEN }} @@ -147,7 +149,7 @@ jobs: wait-for-completion-timeout-in-seconds: 300 - name: Replace with signed Windows binaries - if: ${{ secrets.SIGNPATH_API_TOKEN != '' }} + if: ${{ env.SIGNPATH_API_TOKEN != '' }} run: | unzip -o windows-binaries-signed.zip -d signed/ cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe From e7fecc388306d45ebfc203efe94cdc0890b37d76 Mon Sep 17 00:00:00 2001 From: TUYIZERE Samuel Date: Thu, 23 Jul 2026 16:02:58 +0200 Subject: [PATCH 2/6] fix: scope SignPath token to signing steps and pin go-winres Address security review: replace job-level SIGNPATH_API_TOKEN env (which exposed the secret to all steps including the AI changelog) with a preliminary boolean-check step. The token is now referenced only in the check step and the SignPath action's with: block. Pin go-winres to v0.3.3 instead of @latest for supply-chain safety. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/beta-release.yml | 16 ++++++++++------ .github/workflows/release.yml | 16 ++++++++++------ 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index edad20b..5b5a622 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -36,8 +36,6 @@ jobs: name: Build & Release needs: validate runs-on: macos-latest - env: - SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} outputs: beta_tag: ${{ steps.version.outputs.beta_tag }} prod_version: ${{ steps.version.outputs.prod_version }} @@ -51,6 +49,12 @@ jobs: go-version: "1.25" cache: true + - name: Check signing availability + id: signing + env: + SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} + run: echo "enabled=$([ -n "$SIGNPATH_API_TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" + - name: Get versions id: version run: | @@ -75,7 +79,7 @@ jobs: env: VERSION: ${{ steps.version.outputs.version }} run: | - go install github.com/tc-hib/go-winres@latest + go install github.com/tc-hib/go-winres@v0.3.3 # Parse version components (e.g., "0.5.3-beta.1" → "0.5.3.0") CLEAN_VER=$(echo "$VERSION" | sed 's/-.*//') @@ -128,7 +132,7 @@ jobs: ls -lh dist/ - name: Package Windows binaries for signing - if: ${{ env.SIGNPATH_API_TOKEN != '' }} + if: ${{ steps.signing.outputs.enabled == 'true' }} run: | mkdir -p signing cp dist/routatic-proxy_windows-amd64.exe signing/ @@ -136,7 +140,7 @@ jobs: cd signing && zip ../windows-binaries.zip *.exe - name: Sign Windows binaries (SignPath) - if: ${{ env.SIGNPATH_API_TOKEN != '' }} + if: ${{ steps.signing.outputs.enabled == 'true' }} uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1 with: api-token: ${{ secrets.SIGNPATH_API_TOKEN }} @@ -151,7 +155,7 @@ jobs: wait-for-completion-timeout-in-seconds: 300 - name: Replace with signed Windows binaries - if: ${{ env.SIGNPATH_API_TOKEN != '' }} + if: ${{ steps.signing.outputs.enabled == 'true' }} run: | unzip -o windows-binaries-signed.zip -d signed/ cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1f18b6d..b85d9a8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,8 +40,6 @@ jobs: name: Build & Release needs: validate runs-on: macos-latest - env: - SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} outputs: tag: ${{ steps.version.outputs.tag }} steps: @@ -54,6 +52,12 @@ jobs: go-version: "1.25" cache: true + - name: Check signing availability + id: signing + env: + SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} + run: echo "enabled=$([ -n "$SIGNPATH_API_TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" + - name: Determine version id: version run: | @@ -74,7 +78,7 @@ jobs: env: VERSION: ${{ steps.version.outputs.version }} run: | - go install github.com/tc-hib/go-winres@latest + go install github.com/tc-hib/go-winres@v0.3.3 # Parse version components (e.g., "0.5.3" → "0.5.3.0") MAJOR=$(echo "$VERSION" | cut -d. -f1) @@ -126,7 +130,7 @@ jobs: ls -lh dist/ - name: Package Windows binaries for signing - if: ${{ env.SIGNPATH_API_TOKEN != '' }} + if: ${{ steps.signing.outputs.enabled == 'true' }} run: | mkdir -p signing cp dist/routatic-proxy_windows-amd64.exe signing/ @@ -134,7 +138,7 @@ jobs: cd signing && zip ../windows-binaries.zip *.exe - name: Sign Windows binaries (SignPath) - if: ${{ env.SIGNPATH_API_TOKEN != '' }} + if: ${{ steps.signing.outputs.enabled == 'true' }} uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1 with: api-token: ${{ secrets.SIGNPATH_API_TOKEN }} @@ -149,7 +153,7 @@ jobs: wait-for-completion-timeout-in-seconds: 300 - name: Replace with signed Windows binaries - if: ${{ env.SIGNPATH_API_TOKEN != '' }} + if: ${{ steps.signing.outputs.enabled == 'true' }} run: | unzip -o windows-binaries-signed.zip -d signed/ cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe From a8a6ea13c22be51f81fd7523597ef937045d9ac6 Mon Sep 17 00:00:00 2001 From: TUYIZERE Samuel Date: Thu, 23 Jul 2026 16:04:47 +0200 Subject: [PATCH 3/6] fix: correct SignPath action usage with upload-artifact The submit-signing-request action does not accept input/output-artifact-path. It requires the artifact uploaded via actions/upload-artifact (yielding a numeric artifact-id) and writes signed output to output-artifact-directory. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/beta-release.yml | 19 ++++++++++++------- .github/workflows/release.yml | 19 ++++++++++++------- 2 files changed, 24 insertions(+), 14 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index 5b5a622..e29c961 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -131,13 +131,20 @@ jobs: echo "Built binaries:" ls -lh dist/ - - name: Package Windows binaries for signing + - name: Stage Windows binaries for signing if: ${{ steps.signing.outputs.enabled == 'true' }} run: | mkdir -p signing cp dist/routatic-proxy_windows-amd64.exe signing/ cp dist/routatic-proxy_windows-arm64.exe signing/ - cd signing && zip ../windows-binaries.zip *.exe + + - name: Upload unsigned Windows binaries + id: upload-unsigned + if: ${{ steps.signing.outputs.enabled == 'true' }} + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: windows-binaries-unsigned + path: signing/ - name: Sign Windows binaries (SignPath) if: ${{ steps.signing.outputs.enabled == 'true' }} @@ -148,19 +155,17 @@ jobs: project-slug: 'routatic-proxy' signing-policy-slug: 'release-signing' artifact-configuration-slug: 'windows-exe' - github-artifact-id: 'windows-binaries' - input-artifact-path: 'windows-binaries.zip' - output-artifact-path: 'windows-binaries-signed.zip' + github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}' wait-for-completion: true + output-artifact-directory: 'signed' wait-for-completion-timeout-in-seconds: 300 - name: Replace with signed Windows binaries if: ${{ steps.signing.outputs.enabled == 'true' }} run: | - unzip -o windows-binaries-signed.zip -d signed/ cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe cp signed/routatic-proxy_windows-arm64.exe dist/routatic-proxy_windows-arm64.exe - rm -rf signing signed windows-binaries.zip windows-binaries-signed.zip + rm -rf signing signed - name: Generate checksums run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b85d9a8..4e85d48 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -129,13 +129,20 @@ jobs: echo "Built binaries:" ls -lh dist/ - - name: Package Windows binaries for signing + - name: Stage Windows binaries for signing if: ${{ steps.signing.outputs.enabled == 'true' }} run: | mkdir -p signing cp dist/routatic-proxy_windows-amd64.exe signing/ cp dist/routatic-proxy_windows-arm64.exe signing/ - cd signing && zip ../windows-binaries.zip *.exe + + - name: Upload unsigned Windows binaries + id: upload-unsigned + if: ${{ steps.signing.outputs.enabled == 'true' }} + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: windows-binaries-unsigned + path: signing/ - name: Sign Windows binaries (SignPath) if: ${{ steps.signing.outputs.enabled == 'true' }} @@ -146,19 +153,17 @@ jobs: project-slug: 'routatic-proxy' signing-policy-slug: 'release-signing' artifact-configuration-slug: 'windows-exe' - github-artifact-id: 'windows-binaries' - input-artifact-path: 'windows-binaries.zip' - output-artifact-path: 'windows-binaries-signed.zip' + github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}' wait-for-completion: true + output-artifact-directory: 'signed' wait-for-completion-timeout-in-seconds: 300 - name: Replace with signed Windows binaries if: ${{ steps.signing.outputs.enabled == 'true' }} run: | - unzip -o windows-binaries-signed.zip -d signed/ cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe cp signed/routatic-proxy_windows-arm64.exe dist/routatic-proxy_windows-arm64.exe - rm -rf signing signed windows-binaries.zip windows-binaries-signed.zip + rm -rf signing signed - name: Generate checksums run: | From ce08f420e0f1a06d7c1632548b02a93ef3d1a633 Mon Sep 17 00:00:00 2001 From: TUYIZERE Samuel Date: Thu, 23 Jul 2026 16:24:50 +0200 Subject: [PATCH 4/6] ci: gate Windows signing on USE_SIGNPATH flag Switch the signing gate from secret presence to an explicit USE_SIGNPATH flag, so releases skip signing entirely while the SignPath certificate is still pending. Set USE_SIGNPATH=true to enable once the cert is issued. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/beta-release.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index e29c961..57ca569 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -52,8 +52,8 @@ jobs: - name: Check signing availability id: signing env: - SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} - run: echo "enabled=$([ -n "$SIGNPATH_API_TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" + USE_SIGNPATH: ${{ secrets.USE_SIGNPATH }} + run: echo "enabled=$([ "$USE_SIGNPATH" = "true" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" - name: Get versions id: version diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4e85d48..69c5991 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,8 +55,8 @@ jobs: - name: Check signing availability id: signing env: - SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} - run: echo "enabled=$([ -n "$SIGNPATH_API_TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" + USE_SIGNPATH: ${{ secrets.USE_SIGNPATH }} + run: echo "enabled=$([ "$USE_SIGNPATH" = "true" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" - name: Determine version id: version From 8bb967fdc7947e004c4ba5f579db7b1c836bd2a3 Mon Sep 17 00:00:00 2001 From: TUYIZERE Samuel Date: Thu, 23 Jul 2026 16:26:42 +0200 Subject: [PATCH 5/6] ci: read USE_SIGNPATH from vars context instead of secrets USE_SIGNPATH is configured as a repository variable, not a secret. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/beta-release.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index 57ca569..cf215f2 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -52,7 +52,7 @@ jobs: - name: Check signing availability id: signing env: - USE_SIGNPATH: ${{ secrets.USE_SIGNPATH }} + USE_SIGNPATH: ${{ vars.USE_SIGNPATH }} run: echo "enabled=$([ "$USE_SIGNPATH" = "true" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" - name: Get versions diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 69c5991..19b8355 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,7 +55,7 @@ jobs: - name: Check signing availability id: signing env: - USE_SIGNPATH: ${{ secrets.USE_SIGNPATH }} + USE_SIGNPATH: ${{ vars.USE_SIGNPATH }} run: echo "enabled=$([ "$USE_SIGNPATH" = "true" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" - name: Determine version From aee91611fa42c5ecb6ccf46ec8d1c1990c39b8e9 Mon Sep 17 00:00:00 2001 From: TUYIZERE Samuel Date: Thu, 23 Jul 2026 16:34:11 +0200 Subject: [PATCH 6/6] fix: correct quoting in changelog fallback git log command The fallback path escaped the quotes around the revision range, passing literal quotes to git ('"v0.6.1..HEAD"') and failing with exit 128 when the AI changelog generation returned empty. Use normal shell quoting. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/beta-release.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index cf215f2..92df5fe 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -266,7 +266,7 @@ jobs: if [ -z "$CHANGELOG" ] || [ "$CHANGELOG" = "null" ]; then echo "Warning: AI changelog generation failed, using commit list instead" >&2 echo "API response: $RESPONSE" >&2 - CHANGELOG="## Commits\n\n$(git log \"${PREVIOUS_TAG}..HEAD\" --pretty=format:'- %s')" + CHANGELOG="## Commits\n\n$(git log "${PREVIOUS_TAG}..HEAD" --pretty=format:'- %s')" fi else echo "No previous tag found, using commit list" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 19b8355..3bfefec 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -269,7 +269,7 @@ jobs: if [ -z "$CHANGELOG" ] || [ "$CHANGELOG" = "null" ]; then echo "Warning: AI changelog generation failed, using commit list instead" >&2 echo "API response: $RESPONSE" >&2 - CHANGELOG="## Commits\n\n$(git log \"${PREVIOUS_TAG}..HEAD\" --pretty=format:'- %s')" + CHANGELOG="## Commits\n\n$(git log "${PREVIOUS_TAG}..HEAD" --pretty=format:'- %s')" fi else echo "No previous tag found, using commit list"