4d2deb1098
The elevated sandbox ships two exes * one for elevated setup of the sandbox * one to actually run commands under the sandbox user. This PR adds them to the windows signing step
57 lines
2.2 KiB
YAML
57 lines
2.2 KiB
YAML
name: windows-code-sign
|
|
description: Sign Windows binaries with Azure Trusted Signing.
|
|
inputs:
|
|
target:
|
|
description: Target triple for the artifacts to sign.
|
|
required: true
|
|
client-id:
|
|
description: Azure Trusted Signing client ID.
|
|
required: true
|
|
tenant-id:
|
|
description: Azure tenant ID for Trusted Signing.
|
|
required: true
|
|
subscription-id:
|
|
description: Azure subscription ID for Trusted Signing.
|
|
required: true
|
|
endpoint:
|
|
description: Azure Trusted Signing endpoint.
|
|
required: true
|
|
account-name:
|
|
description: Azure Trusted Signing account name.
|
|
required: true
|
|
certificate-profile-name:
|
|
description: Certificate profile name for signing.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Azure login for Trusted Signing (OIDC)
|
|
uses: azure/login@v2
|
|
with:
|
|
client-id: ${{ inputs.client-id }}
|
|
tenant-id: ${{ inputs.tenant-id }}
|
|
subscription-id: ${{ inputs.subscription-id }}
|
|
|
|
- name: Sign Windows binaries with Azure Trusted Signing
|
|
uses: azure/trusted-signing-action@v0
|
|
with:
|
|
endpoint: ${{ inputs.endpoint }}
|
|
trusted-signing-account-name: ${{ inputs.account-name }}
|
|
certificate-profile-name: ${{ inputs.certificate-profile-name }}
|
|
exclude-environment-credential: true
|
|
exclude-workload-identity-credential: true
|
|
exclude-managed-identity-credential: true
|
|
exclude-shared-token-cache-credential: true
|
|
exclude-visual-studio-credential: true
|
|
exclude-visual-studio-code-credential: true
|
|
exclude-azure-cli-credential: false
|
|
exclude-azure-powershell-credential: true
|
|
exclude-azure-developer-cli-credential: true
|
|
exclude-interactive-browser-credential: true
|
|
cache-dependencies: false
|
|
files: |
|
|
${{ github.workspace }}/codex-rs/target/${{ inputs.target }}/release/codex.exe
|
|
${{ github.workspace }}/codex-rs/target/${{ inputs.target }}/release/codex-responses-api-proxy.exe
|
|
${{ github.workspace }}/codex-rs/target/${{ inputs.target }}/release/codex-windows-sandbox-setup.exe
|
|
${{ github.workspace }}/codex-rs/target/${{ inputs.target }}/release/codex-command-runner.exe
|