Add code signing in release-obfuscator-cli.yml (#30)

* Update runner to windows-latest * Add code signing in release-obfuscator-cli.yml * Update README.md
sql-bi · Mar 14, 2024 · 63004ce · 63004ce
1 parent 7571dba
commit 63004ce
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 3 deletions.
diff --git a/.github/workflows/release-obfuscator-cli.yml b/.github/workflows/release-obfuscator-cli.yml
@@ -5,7 +5,7 @@ env:
   PROJECT: Dax.Vpax.Obfuscator.CLI
 jobs:
   publish-release:
-    runs-on: ubuntu-latest
+    runs-on: windows-latest # windows is required for code signing (AzureSignTool)
     permissions:
       contents: write
     steps:
@@ -24,8 +24,19 @@ jobs:
         path: src/${{ env.PROJECT }}
     - name: dotnet publish
       run: dotnet publish 'src/${{ env.PROJECT }}/${{ env.PROJECT }}.csproj' -o . -c Release -r win-x86 --sc -p:PublishSingleFile=true
+    - name: dotnet tool install AzureSignTool
+      run: dotnet tool install --no-cache --global AzureSignTool
     - name: code signing
-      run: echo "::warning::(TODO) code signing."
+      shell: cmd
+      run: |
+        azuresigntool sign ^
+          -kvu "${{ secrets.CODESIGNING_VAULT_URL }}" ^
+          -kvt "${{ secrets.CODESIGNING_TENANT_ID }}" ^
+          -kvi "${{ secrets.CODESIGNING_CLIENT_ID }}" ^
+          -kvs "${{ secrets.CODESIGNING_CLIENT_SECRET }}" ^
+          -kvc "${{ secrets.CODESIGNING_CERTIFICATE }}" ^
+          -tr "http://timestamp.digicert.com" ^
+          -v "vpax-obfuscator.exe"
     - name: git tag
       run: |
         git config user.name github-actions[bot]
@@ -35,6 +46,7 @@ jobs:
       env:
         RELEASE_TAG: ${{ env.PROJECT }}_${{ steps.nbgv.outputs.SemVer2 }}
     - name: gh release create
+      shell: bash
       run: |
         PRERELEASE_FLAG=$([[ "${{ steps.nbgv.outputs.PrereleaseVersion }}" != "" ]] && echo "--prerelease" || echo "")
         gh release create ${{ env.RELEASE_TAG }} 'vpax-obfuscator.exe#Obfuscator CLI x86 net6.0' --title ${{ env.RELEASE_TAG }} --generate-notes --draft $PRERELEASE_FLAG

diff --git a/README.md b/README.md
@@ -42,7 +42,7 @@ C:\> vpax-obfuscator.exe [command] [options]
 
 For usage and help content for any command, pass in the `-h` parameter, for example:
 
-```bash
+```cmd
 C:\> vpax-obfuscator.exe obfuscate -h
 
 Description:
-Original file line number
+Diff line change
@@ Expand Up / @@ -42,7 +42,7 @@ C:\> vpax-obfuscator.exe [command] [options] @@
     For usage and help content for any command, pass in the `-h` parameter, for example:
-    ```bash
+    ```cmd
     C:\> vpax-obfuscator.exe obfuscate -h
     Description:
@@ Expand Down @@