Sign.yml

name: Code Sign App

on:
  workflow_dispatch:
    inputs:
      target:
        description: 'Target of Channel Name to Sign'
        required: true
        default: ''
        type: string

  workflow_call:
    inputs:
      target:
        description: 'Target of Channel Name to Sign'
        required: true
        default: ''
        type: string

jobs:

  Sign_Code:
    name: Sign ${{ inputs.target }} App
    permissions:
      id-token: write # Required for requesting the JWT
    runs-on: windows-latest

    steps:
    - name: Download ${{ inputs.target }} Artifacts
      uses: actions/download-artifact@v4
      with:
        name: ${{ inputs.target }}
        path: .\ToSign\${{ inputs.target }}

    - name: Download Build Artifacts
      uses: actions/download-artifact@v4
      with:
        name: BuildArtifacts
        path: .\BuildArtifacts

    - name: Setup .NET
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: |
          8.0.x
          9.0.x

    - name: Install Code Sign CLI tool
      # run: dotnet tool install --tool-path . sign --version 0.9.0-beta.23063.3
      run: dotnet tool install --tool-path . --prerelease sign

    - name: Azure Login
      uses: azure/login@v2
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

    - name: Run Code Signing CLI
      shell: pwsh
      run: >
        ./sign code azure-key-vault
        '**/*.{exe,zip,appxbundle,appinstaller}'
        --timestamp-url "http://timestamp.digicert.com"
        --base-directory "${{ github.workspace }}\ToSign"
        --file-list "${{ github.workspace }}\BuildArtifacts\Signing\filelist.txt"
        --publisher-name "Isaac Levin"
        --description "PresenceLight"
        --description-url "https://github.com/isaacrlevin/presencelight"
        --azure-key-vault-managed-identity true
        --azure-key-vault-url "${{ secrets.KEY_VAULT_URL }}"
        --azure-key-vault-certificate "${{ secrets.KEY_VAULT_CERTIFICATE_ID }}"
        --verbosity Trace

    - name: Publish Signed ${{ inputs.target }} Packages
      uses: actions/upload-artifact@v4
      with:
        path: .\ToSign\${{ inputs.target }}
        name: '${{ inputs.target }}_Signed'

    - name: Setup Tmate session
      if: ${{ failure() }}
      uses: mxschmitt/action-tmate@v3
      timeout-minutes: 15