Skip to content

Commit c33cd29

Browse files
svivesaerosvivesaero
committed
updating trunk errors
1 parent e404ba7 commit c33cd29

File tree

1 file changed

+131
-127
lines changed

1 file changed

+131
-127
lines changed

‎.github/workflows/sign-nuget-package.yaml‎

Lines changed: 131 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -2,138 +2,142 @@ name: Sign NuGet Package
22

33
on:
44
workflow_run:
5-
workflows: ["Build My Package"]
5+
workflows: [Build My Package]
66
types: [completed]
77
branches: [main, release]
88

9+
permissions:
10+
contents: read
11+
actions: read
12+
913
jobs:
1014
sign:
1115
runs-on: ubuntu-latest
1216
if: ${{ github.event.workflow_run.conclusion == 'success' }}
13-
17+
1418
steps:
15-
- name: Checkout code
16-
uses: actions/checkout@v4
17-
18-
- name: Download build artifacts
19-
uses: actions/download-artifact@v4
20-
continue-on-error: true
21-
with:
22-
name: nuget-package
23-
path: artifacts
24-
25-
- name: Check if artifacts were downloaded
26-
id: check-artifacts
27-
run: |
28-
if [ -d "artifacts" ] && [ "$(ls -A artifacts 2>/dev/null)" ]; then
29-
echo "artifacts_found=true" >> $GITHUB_OUTPUT
30-
echo "✅ Artifacts found and downloaded successfully"
31-
else
32-
echo "artifacts_found=false" >> $GITHUB_OUTPUT
33-
echo "⚠️ No artifacts found, attempting to build locally"
34-
fi
35-
36-
- name: Build locally if no artifacts found
37-
if: steps.check-artifacts.outputs.artifacts_found == 'false'
38-
run: |
39-
echo "Building package locally as fallback..."
40-
41-
# Setup .NET if not already available
42-
if ! command -v dotnet &> /dev/null; then
43-
echo "Installing .NET..."
44-
# This would need to be handled by the runner environment
45-
fi
46-
47-
# Find and build the project
48-
PROJECT_FILE=$(find . -name "*.csproj" -type f | head -1)
49-
if [ -n "$PROJECT_FILE" ]; then
50-
echo "Building project: $PROJECT_FILE"
51-
dotnet restore "$PROJECT_FILE"
52-
dotnet build "$PROJECT_FILE" --configuration Release --no-restore
53-
dotnet pack "$PROJECT_FILE" --configuration Release --output ./artifacts --no-build
54-
echo "✅ Local build completed"
55-
else
56-
echo "❌ No .csproj file found for local build"
57-
exit 1
58-
fi
59-
60-
- name: List artifacts
61-
run: |
62-
echo "Available artifacts:"
63-
if [ -d "artifacts" ]; then
64-
ls -la artifacts/
65-
else
66-
echo "No artifacts directory found"
67-
exit 1
68-
fi
69-
70-
- name: Find NuGet package
71-
id: find-package
72-
run: |
73-
# Find the .nupkg file in artifacts directory
74-
PACKAGE_FILE=$(find artifacts -name "*.nupkg" -type f | head -1)
75-
if [ -n "$PACKAGE_FILE" ]; then
76-
echo "package_file=$PACKAGE_FILE" >> $GITHUB_OUTPUT
77-
echo "Found package: $PACKAGE_FILE"
78-
else
79-
echo "No .nupkg files found in artifacts directory."
80-
echo "Available files in artifacts:"
81-
ls -la artifacts/
82-
exit 1
83-
fi
84-
85-
- name: Sign NuGet Package with CodeSignTool
86-
uses: sslcom/esigner-codesign@a272724cb13abe0abc579c6c40f7899969b6942b
87-
with:
88-
command: sign
89-
username: ${{secrets.ES_USERNAME}}
90-
password: ${{secrets.ES_PASSWORD}}
91-
credential_id: ${{secrets.CREDENTIAL_ID}}
92-
totp_secret: ${{secrets.ES_TOTP_SECRET}}
93-
file_path: ${{ steps.find-package.outputs.package_file }}
94-
output_path: ${{github.workspace}}/signed-artifacts
95-
malware_block: false
96-
override: false
97-
environment_name: PROD
98-
clean_logs: true
99-
jvm_max_memory: 1024M
100-
signing_method: v1
101-
102-
- name: Upload signed artifacts
103-
uses: actions/upload-artifact@v4
104-
with:
105-
name: signed-nuget-package
106-
path: signed-artifacts/
107-
retention-days: 1
108-
109-
- name: Verify signed package
110-
run: |
111-
echo "Verifying signed package..."
112-
ls -la signed-artifacts/
113-
114-
# Get the signed package name
115-
SIGNED_PACKAGE=$(find signed-artifacts/ -name "*.nupkg" -type f | head -1)
116-
if [ -z "$SIGNED_PACKAGE" ]; then
117-
echo "❌ No signed package found in signed-artifacts/"
118-
exit 1
119-
fi
120-
121-
echo "Verifying: $SIGNED_PACKAGE"
122-
123-
# Verify the signed package using .NET CLI
124-
echo "Verifying package signature using .NET CLI..."
125-
dotnet nuget verify "$SIGNED_PACKAGE" --all
126-
127-
# Check for signature file in package
128-
echo "Checking package contents for signature..."
129-
unzip -l "$SIGNED_PACKAGE" | grep -i signature || echo "No signature file found in package"
130-
131-
# Production verification summary
132-
echo ""
133-
echo "=== PRODUCTION SIGNING VERIFICATION SUMMARY ==="
134-
echo "✅ Package was successfully signed by production certificate"
135-
echo "✅ Signature file (.signature.p7s) found in package"
136-
echo "✅ Certificate chain validation passed"
137-
echo "✅ Package structure is intact and valid"
138-
echo ""
139-
echo "Production signing verification completed successfully!"
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
22+
- name: Download build artifacts
23+
uses: actions/download-artifact@v4
24+
continue-on-error: true
25+
with:
26+
name: nuget-package
27+
path: artifacts
28+
29+
- name: Check if artifacts were downloaded
30+
id: check-artifacts
31+
run: |
32+
if [ -d "artifacts" ] && [ "$(ls -A artifacts 2>/dev/null)" ]; then
33+
echo "artifacts_found=true" >> $GITHUB_OUTPUT
34+
echo "✅ Artifacts found and downloaded successfully"
35+
else
36+
echo "artifacts_found=false" >> $GITHUB_OUTPUT
37+
echo "⚠️ No artifacts found, attempting to build locally"
38+
fi
39+
40+
- name: Build locally if no artifacts found
41+
if: steps.check-artifacts.outputs.artifacts_found == 'false'
42+
run: |
43+
echo "Building package locally as fallback..."
44+
45+
# Setup .NET if not already available
46+
if ! command -v dotnet &> /dev/null; then
47+
echo "Installing .NET..."
48+
# This would need to be handled by the runner environment
49+
fi
50+
51+
# Find and build the project
52+
PROJECT_FILE=$(find . -name "*.csproj" -type f | head -1)
53+
if [ -n "$PROJECT_FILE" ]; then
54+
echo "Building project: $PROJECT_FILE"
55+
dotnet restore "$PROJECT_FILE"
56+
dotnet build "$PROJECT_FILE" --configuration Release --no-restore
57+
dotnet pack "$PROJECT_FILE" --configuration Release --output ./artifacts --no-build
58+
echo "✅ Local build completed"
59+
else
60+
echo "❌ No .csproj file found for local build"
61+
exit 1
62+
fi
63+
64+
- name: List artifacts
65+
run: |
66+
echo "Available artifacts:"
67+
if [ -d "artifacts" ]; then
68+
ls -la artifacts/
69+
else
70+
echo "No artifacts directory found"
71+
exit 1
72+
fi
73+
74+
- name: Find NuGet package
75+
id: find-package
76+
run: |
77+
# Find the .nupkg file in artifacts directory
78+
PACKAGE_FILE=$(find artifacts -name "*.nupkg" -type f | head -1)
79+
if [ -n "$PACKAGE_FILE" ]; then
80+
echo "package_file=$PACKAGE_FILE" >> $GITHUB_OUTPUT
81+
echo "Found package: $PACKAGE_FILE"
82+
else
83+
echo "No .nupkg files found in artifacts directory."
84+
echo "Available files in artifacts:"
85+
ls -la artifacts/
86+
exit 1
87+
fi
88+
89+
- name: Sign NuGet Package with CodeSignTool
90+
uses: sslcom/esigner-codesign@a272724cb13abe0abc579c6c40f7899969b6942b
91+
with:
92+
command: sign
93+
username: ${{secrets.ES_USERNAME}}
94+
password: ${{secrets.ES_PASSWORD}}
95+
credential_id: ${{secrets.CREDENTIAL_ID}}
96+
totp_secret: ${{secrets.ES_TOTP_SECRET}}
97+
file_path: ${{ steps.find-package.outputs.package_file }}
98+
output_path: ${{github.workspace}}/signed-artifacts
99+
malware_block: false
100+
override: false
101+
environment_name: PROD
102+
clean_logs: true
103+
jvm_max_memory: 1024M
104+
signing_method: v1
105+
106+
- name: Upload signed artifacts
107+
uses: actions/upload-artifact@v4
108+
with:
109+
name: signed-nuget-package
110+
path: signed-artifacts/
111+
retention-days: 1
112+
113+
- name: Verify signed package
114+
run: |
115+
echo "Verifying signed package..."
116+
ls -la signed-artifacts/
117+
118+
# Get the signed package name
119+
SIGNED_PACKAGE=$(find signed-artifacts/ -name "*.nupkg" -type f | head -1)
120+
if [ -z "$SIGNED_PACKAGE" ]; then
121+
echo "❌ No signed package found in signed-artifacts/"
122+
exit 1
123+
fi
124+
125+
echo "Verifying: $SIGNED_PACKAGE"
126+
127+
# Verify the signed package using .NET CLI
128+
echo "Verifying package signature using .NET CLI..."
129+
dotnet nuget verify "$SIGNED_PACKAGE" --all
130+
131+
# Check for signature file in package
132+
echo "Checking package contents for signature..."
133+
unzip -l "$SIGNED_PACKAGE" | grep -i signature || echo "No signature file found in package"
134+
135+
# Production verification summary
136+
echo ""
137+
echo "=== PRODUCTION SIGNING VERIFICATION SUMMARY ==="
138+
echo "✅ Package was successfully signed by production certificate"
139+
echo "✅ Signature file (.signature.p7s) found in package"
140+
echo "✅ Certificate chain validation passed"
141+
echo "✅ Package structure is intact and valid"
142+
echo ""
143+
echo "Production signing verification completed successfully!"

0 commit comments

Comments
 (0)