CI: update workflows to use Azure Trusted Signing

drakkan · drakkan · commit fedae8e8be77 · 2024-11-23T20:48:42.000+01:00
Signed-off-by: Nicola Murino &lt;nicola.murino@gmail.com&gt;
diff --git a/.github/workflows/development.yml b/.github/workflows/development.yml
@@ -5,6 +5,10 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  id-token: write
+  contents: read
+
 env:
   GO_VERSION: '1.23'
 
@@ -25,10 +29,7 @@ jobs:
 
       - name: Build
         run: |
-          sudo apt-get update -q -y
-          sudo apt-get install -q -y osslsigncode
           go install github.com/tc-hib/go-winres@latest
-
           GIT_COMMIT=`git describe --always --dirty`
           LATEST_TAG=$(git describe --tags $(git rev-list --tags --max-count=1))
           NUM_COMMITS_FROM_TAG=$(git rev-list ${LATEST_TAG}.. --count)
@@ -37,36 +38,73 @@ jobs:
 
           mkdir bin
           go-winres simply --arch amd64 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin pubsub" --product-name "SFTPGo plugin pubsub" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-pubsub-windows-x86_64.exe --icon res/icon.ico
-          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o sftpgo-plugin-pubsub-windows-x86_64.exe
+          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-windows-x86_64.exe
           go-winres simply --arch arm64 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin pubsub" --product-name "SFTPGo plugin pubsub" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-pubsub-windows-arm64.exe --icon res/icon.ico
-          CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o sftpgo-plugin-pubsub-windows-arm64.exe
+          CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-windows-arm64.exe
           go-winres simply --arch 386 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin pubsub" --product-name "SFTPGo plugin pubsub" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-pubsub-windows-x86.exe --icon res/icon.ico
-          CGO_ENABLED=0 GOOS=windows GOARCH=386 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o sftpgo-plugin-pubsub-windows-x86.exe
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            mv sftpgo-plugin-pubsub-windows-x86_64.exe bin/
-            mv sftpgo-plugin-pubsub-windows-arm64.exe bin/
-            mv sftpgo-plugin-pubsub-windows-x86.exe bin/
-          else
-            echo $CERT_DATA | base64 --decode > cert.pfx
-            osslsigncode sign -pkcs12 cert.pfx -pass $CERT_PASS -n "SFTPGo plugin pubsub" -i "https://github.com/sftpgo/sftpgo-plugin-pubsub" -ts "http://timestamp.sectigo.com" -h sha2 -in sftpgo-plugin-pubsub-windows-x86_64.exe -out bin/sftpgo-plugin-pubsub-windows-x86_64.exe
-            osslsigncode sign -pkcs12 cert.pfx -pass $CERT_PASS -n "SFTPGo plugin pubsub" -i "https://github.com/sftpgo/sftpgo-plugin-pubsub" -ts "http://timestamp.sectigo.com" -h sha2 -in sftpgo-plugin-pubsub-windows-arm64.exe -out bin/sftpgo-plugin-pubsub-windows-arm64.exe
-            osslsigncode sign -pkcs12 cert.pfx -pass $CERT_PASS -n "SFTPGo plugin pubsub" -i "https://github.com/sftpgo/sftpgo-plugin-pubsub" -ts "http://timestamp.sectigo.com" -h sha2 -in sftpgo-plugin-pubsub-windows-x86.exe -out bin/sftpgo-plugin-pubsub-windows-x86.exe
-            rm -f cert.pfx
-          fi
-
+          CGO_ENABLED=0 GOOS=windows GOARCH=386 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-windows-x86.exe
           CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-linux-amd64
           CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-linux-arm64
           CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-linux-armv7
           CGO_ENABLED=0 GOOS=linux GOARCH=ppc64le go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-linux-ppc64le
           CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-darwin-amd64
           CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-darwin-arm64
         shell: bash
-        env:
-          CERT_DATA: ${{ secrets.CERT_DATA }}
-          CERT_PASS: ${{ secrets.CERT_PASS }}
 
       - name: Upload build artifact
         uses: actions/upload-artifact@v4
         with:
           name: sftpgo-plugin-pubsub
           path: bin
+
+  sign-windows-binaries:
+    name: Sign Windows binaries
+    if: ${{ github.event_name != 'pull_request' }}
+    environment: signing
+    needs: [build]
+    runs-on: windows-latest
+
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: sftpgo-plugin-pubsub
+          path: ${{ github.workspace }}/bin
+
+      - name: Azure login
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Sign
+        uses: azure/trusted-signing-action@v0.5.0
+        with:
+          endpoint: https://eus.codesigning.azure.net/
+          trusted-signing-account-name: nicola
+          certificate-profile-name: SFTPGo
+          files: |
+            ${{ github.workspace }}\bin\sftpgo-plugin-pubsub-windows-x86_64.exe
+            ${{ github.workspace }}\bin\sftpgo-plugin-pubsub-windows-arm64.exe
+            ${{ github.workspace }}\bin\sftpgo-plugin-pubsub-windows-x86.exe
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+          exclude-environment-credential: true
+          exclude-workload-identity-credential: true
+          exclude-managed-identity-credential: true
+          exclude-shared-token-cache-credential: true
+          exclude-visual-studio-credential: true
+          exclude-visual-studio-code-credential: true
+          exclude-azure-cli-credential: false
+          exclude-azure-powershell-credential: true
+          exclude-azure-developer-cli-credential: true
+          exclude-interactive-browser-credential: true
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sftpgo-plugin-pubsub
+          path: bin
+          overwrite: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -4,6 +4,10 @@ on:
   push:
     tags: 'v*'
 
+permissions:
+  id-token: write
+  contents: write
+
 env:
   GO_VERSION: 1.23.3
 
@@ -24,26 +28,20 @@ jobs:
 
       - name: Build
         run: |
-          sudo apt-get update -q -y
-          sudo apt-get install -q -y osslsigncode
           go install github.com/tc-hib/go-winres@latest
 
           VERSION=${GITHUB_REF/refs\/tags\//}
           GIT_COMMIT=`git describe --always --dirty`
           FILE_VERSION=${VERSION:1}.0
 
           mkdir bin
+          mkdir win
           go-winres simply --arch amd64 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin pubsub" --product-name "SFTPGo plugin pubsub" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-pubsub-windows-x86_64.exe --icon res/icon.ico
-          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o sftpgo-plugin-pubsub-windows-x86_64.exe
+          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o win/sftpgo-plugin-pubsub-windows-x86_64.exe
           go-winres simply --arch arm64 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin pubsub" --product-name "SFTPGo plugin pubsub" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-pubsub-windows-arm64.exe --icon res/icon.ico
-          CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o sftpgo-plugin-pubsub-windows-arm64.exe
+          CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o win/sftpgo-plugin-pubsub-windows-arm64.exe
           go-winres simply --arch 386 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin pubsub" --product-name "SFTPGo plugin pubsub" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-pubsub-windows-x86.exe --icon res/icon.ico
-          CGO_ENABLED=0 GOOS=windows GOARCH=386 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o sftpgo-plugin-pubsub-windows-x86.exe
-          echo $CERT_DATA | base64 --decode > cert.pfx
-          osslsigncode sign -pkcs12 cert.pfx -pass $CERT_PASS -n "SFTPGo plugin pubsub" -i "https://github.com/sftpgo/sftpgo-plugin-pubsub" -ts "http://timestamp.sectigo.com" -h sha2 -in sftpgo-plugin-pubsub-windows-x86_64.exe -out bin/sftpgo-plugin-pubsub-windows-x86_64.exe
-          osslsigncode sign -pkcs12 cert.pfx -pass $CERT_PASS -n "SFTPGo plugin pubsub" -i "https://github.com/sftpgo/sftpgo-plugin-pubsub" -ts "http://timestamp.sectigo.com" -h sha2 -in sftpgo-plugin-pubsub-windows-arm64.exe -out bin/sftpgo-plugin-pubsub-windows-arm64.exe
-          osslsigncode sign -pkcs12 cert.pfx -pass $CERT_PASS -n "SFTPGo plugin pubsub" -i "https://github.com/sftpgo/sftpgo-plugin-pubsub" -ts "http://timestamp.sectigo.com" -h sha2 -in sftpgo-plugin-pubsub-windows-x86.exe -out bin/sftpgo-plugin-pubsub-windows-x86.exe
-          rm -f cert.pfx *.exe *.syso
+          CGO_ENABLED=0 GOOS=windows GOARCH=386 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o win/sftpgo-plugin-pubsub-windows-x86.exe
 
           CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-linux-amd64
           CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-linux-arm64
@@ -52,16 +50,20 @@ jobs:
           CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-darwin-amd64
           CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.commitHash=`git describe --always --dirty` -X main.date=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-pubsub-darwin-arm64
         shell: bash
-        env:
-          CERT_DATA: ${{ secrets.CERT_DATA }}
-          CERT_PASS: ${{ secrets.CERT_PASS }}
+
+      - name: Upload Windows artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: win
+          path: win
+          retention-days: 1
 
       - name: Prepare vendored sources
         run: |
           VERSION=${GITHUB_REF/refs\/tags\//}
           go mod vendor
           echo "${VERSION}" > VERSION.txt
-          tar --exclude=bin -cJvf sftpgo-plugin-pubsub_${VERSION}_src_with_deps.tar.xz *
+          tar --exclude=bin --exclude=win -cJvf sftpgo-plugin-pubsub_${VERSION}_src_with_deps.tar.xz *
 
       - name: Create release
         run: |
@@ -72,3 +74,61 @@ jobs:
           gh release view "${VERSION}"
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+  release-windows-binaries:
+    name: Release Windows binaries
+    environment: signing
+    needs: [build]
+    runs-on: windows-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: win
+
+      - name: Azure login
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Sign
+        uses: azure/trusted-signing-action@v0.5.0
+        with:
+          endpoint: https://eus.codesigning.azure.net/
+          trusted-signing-account-name: nicola
+          certificate-profile-name: SFTPGo
+          files: |
+            ${{ github.workspace }}\sftpgo-plugin-pubsub-windows-x86_64.exe
+            ${{ github.workspace }}\sftpgo-plugin-pubsub-windows-arm64.exe
+            ${{ github.workspace }}\sftpgo-plugin-pubsub-windows-x86.exe
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+          exclude-environment-credential: true
+          exclude-workload-identity-credential: true
+          exclude-managed-identity-credential: true
+          exclude-shared-token-cache-credential: true
+          exclude-visual-studio-credential: true
+          exclude-visual-studio-code-credential: true
+          exclude-azure-cli-credential: false
+          exclude-azure-powershell-credential: true
+          exclude-azure-developer-cli-credential: true
+          exclude-interactive-browser-credential: true
+
+      - name: Upload to release
+        run: |
+          VERSION=${GITHUB_REF/refs\/tags\//}
+          gh release upload "${VERSION}" sftpgo-plugin-pubsub-windows-x86_64.exe
+          gh release upload "${VERSION}" sftpgo-plugin-pubsub-windows-arm64.exe
+          gh release upload "${VERSION}" sftpgo-plugin-pubsub-windows-x86.exe
+          gh release view "${VERSION}"
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # SFTPGo Pub/Sub plugin
 
-![Build](https://github.com/sftpgo/sftpgo-plugin-pubsub/workflows/Build/badge.svg?branch=main&event=push)
+![Build](https://github.com/sftpgo/sftpgo-plugin-pubsub/workflows/Build/badge.svg)
 [![License: AGPL v3](https://img.shields.io/badge/License-AGPLv3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
 
 This plugin allows to send [SFTPGo](https://github.com/drakkan/sftpgo/) filesystem and provider events to publish/subscribe systems. It is not meant to react to `pre-*` events. It simply forwards the configured events to an external pub/sub system.
