Skip to content

fix: use env context for SignPath secret check in release workflows #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
samueltuyizere merged 6 commits into from
Jul 23, 2026
Merged

fix: use env context for SignPath secret check in release workflows #129

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8160b58
fix: use env context for SignPath secret check in release workflows
samueltuyizere Jul 23, 2026
e7fecc3
fix: scope SignPath token to signing steps and pin go-winres
samueltuyizere Jul 23, 2026
a8a6ea1
fix: correct SignPath action usage with upload-artifact
samueltuyizere Jul 23, 2026
ce08f42
ci: gate Windows signing on USE_SIGNPATH flag
samueltuyizere Jul 23, 2026
8bb967f
ci: read USE_SIGNPATH from vars context instead of secrets
samueltuyizere Jul 23, 2026
aee9161
fix: correct quoting in changelog fallback git log command
samueltuyizere Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 23 additions & 12 deletions .github/workflows/beta-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,12 @@ jobs:
go-version: "1.25"
cache: true

- name: Check signing availability
id: signing
env:
USE_SIGNPATH: ${{ vars.USE_SIGNPATH }}
run: echo "enabled=$([ "$USE_SIGNPATH" = "true" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

- name: Get versions
id: version
run: |
Expand All @@ -73,7 +79,7 @@ jobs:
env:
VERSION: ${{ steps.version.outputs.version }}
run: |
go install github.com/tc-hib/go-winres@latest
go install github.com/tc-hib/go-winres@v0.3.3

# Parse version components (e.g., "0.5.3-beta.1" → "0.5.3.0")
CLEAN_VER=$(echo "$VERSION" | sed 's/-.*//')
Expand Down Expand Up @@ -125,36 +131,41 @@ jobs:
echo "Built binaries:"
ls -lh dist/

- name: Package Windows binaries for signing
if: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
- name: Stage Windows binaries for signing
if: ${{ steps.signing.outputs.enabled == 'true' }}
run: |
mkdir -p signing
cp dist/routatic-proxy_windows-amd64.exe signing/
cp dist/routatic-proxy_windows-arm64.exe signing/
cd signing && zip ../windows-binaries.zip *.exe

- name: Upload unsigned Windows binaries
id: upload-unsigned
if: ${{ steps.signing.outputs.enabled == 'true' }}
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: windows-binaries-unsigned
path: signing/

- name: Sign Windows binaries (SignPath)
if: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
if: ${{ steps.signing.outputs.enabled == 'true' }}
uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1
with:
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
organization-id: '5c4d4e48-c428-4e10-ab07-8db7f46cbec9'
project-slug: 'routatic-proxy'
signing-policy-slug: 'release-signing'
artifact-configuration-slug: 'windows-exe'
github-artifact-id: 'windows-binaries'
input-artifact-path: 'windows-binaries.zip'
output-artifact-path: 'windows-binaries-signed.zip'
github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}'
wait-for-completion: true
output-artifact-directory: 'signed'
wait-for-completion-timeout-in-seconds: 300

- name: Replace with signed Windows binaries
if: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
if: ${{ steps.signing.outputs.enabled == 'true' }}
run: |
unzip -o windows-binaries-signed.zip -d signed/
cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe
cp signed/routatic-proxy_windows-arm64.exe dist/routatic-proxy_windows-arm64.exe
rm -rf signing signed windows-binaries.zip windows-binaries-signed.zip
rm -rf signing signed

- name: Generate checksums
run: |
Expand Down Expand Up @@ -255,7 +266,7 @@ jobs:
if [ -z "$CHANGELOG" ] || [ "$CHANGELOG" = "null" ]; then
echo "Warning: AI changelog generation failed, using commit list instead" >&2
echo "API response: $RESPONSE" >&2
CHANGELOG="## Commits\n\n$(git log \"${PREVIOUS_TAG}..HEAD\" --pretty=format:'- %s')"
CHANGELOG="## Commits\n\n$(git log "${PREVIOUS_TAG}..HEAD" --pretty=format:'- %s')"
fi
else
echo "No previous tag found, using commit list"
Expand Down
35 changes: 23 additions & 12 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,12 @@ jobs:
go-version: "1.25"
cache: true

- name: Check signing availability
id: signing
env:
USE_SIGNPATH: ${{ vars.USE_SIGNPATH }}
run: echo "enabled=$([ "$USE_SIGNPATH" = "true" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

- name: Determine version
id: version
run: |
Expand All @@ -72,7 +78,7 @@ jobs:
env:
VERSION: ${{ steps.version.outputs.version }}
run: |
go install github.com/tc-hib/go-winres@latest
go install github.com/tc-hib/go-winres@v0.3.3

# Parse version components (e.g., "0.5.3" → "0.5.3.0")
MAJOR=$(echo "$VERSION" | cut -d. -f1)
Expand Down Expand Up @@ -123,36 +129,41 @@ jobs:
echo "Built binaries:"
ls -lh dist/

- name: Package Windows binaries for signing
if: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
- name: Stage Windows binaries for signing
if: ${{ steps.signing.outputs.enabled == 'true' }}
run: |
mkdir -p signing
cp dist/routatic-proxy_windows-amd64.exe signing/
cp dist/routatic-proxy_windows-arm64.exe signing/
cd signing && zip ../windows-binaries.zip *.exe

- name: Upload unsigned Windows binaries
id: upload-unsigned
if: ${{ steps.signing.outputs.enabled == 'true' }}
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: windows-binaries-unsigned
path: signing/

- name: Sign Windows binaries (SignPath)
if: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
if: ${{ steps.signing.outputs.enabled == 'true' }}
uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1
with:
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
organization-id: '5c4d4e48-c428-4e10-ab07-8db7f46cbec9'
project-slug: 'routatic-proxy'
signing-policy-slug: 'release-signing'
artifact-configuration-slug: 'windows-exe'
github-artifact-id: 'windows-binaries'
input-artifact-path: 'windows-binaries.zip'
output-artifact-path: 'windows-binaries-signed.zip'
github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}'
wait-for-completion: true
output-artifact-directory: 'signed'
wait-for-completion-timeout-in-seconds: 300

- name: Replace with signed Windows binaries
if: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
if: ${{ steps.signing.outputs.enabled == 'true' }}
run: |
unzip -o windows-binaries-signed.zip -d signed/
cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe
cp signed/routatic-proxy_windows-arm64.exe dist/routatic-proxy_windows-arm64.exe
rm -rf signing signed windows-binaries.zip windows-binaries-signed.zip
rm -rf signing signed

- name: Generate checksums
run: |
Expand Down Expand Up @@ -258,7 +269,7 @@ jobs:
if [ -z "$CHANGELOG" ] || [ "$CHANGELOG" = "null" ]; then
echo "Warning: AI changelog generation failed, using commit list instead" >&2
echo "API response: $RESPONSE" >&2
CHANGELOG="## Commits\n\n$(git log \"${PREVIOUS_TAG}..HEAD\" --pretty=format:'- %s')"
CHANGELOG="## Commits\n\n$(git log "${PREVIOUS_TAG}..HEAD" --pretty=format:'- %s')"
fi
else
echo "No previous tag found, using commit list"
Expand Down
Loading