Skip to content

Commit 2f0500a

Browse files
TimHessTimHess
committed
package signing updates from other PR, first attempt at dev feed publish
1 parent e400433 commit 2f0500a

1 file changed

Lines changed: 67 additions & 93 deletions

File tree

‎.github/workflows/package.yml‎

Lines changed: 67 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,19 @@ name: Package
22

33
on:
44
workflow_dispatch:
5+
inputs:
6+
deployToDevFeed:
7+
description: 'Deploy to Dev Feed?'
8+
required: false
9+
default: 'false'
10+
type: choice
11+
options: [ 'false', 'true' ]
12+
deployToNuGet:
13+
description: 'Deploy to NuGet.org?'
14+
required: false
15+
default: 'false'
16+
type: choice
17+
options: [ 'false', 'true' ]
518
push:
619
branches:
720
- main
@@ -18,6 +31,7 @@ permissions:
1831
# pull-requests: write
1932

2033
env:
34+
AZURE_ARTIFACTS_FEED_URL: https://pkgs.dev.azure.com/dotnet/Steeltoe/_packaging/dev/nuget/v3/index.json
2135
DOTNET_CLI_TELEMETRY_OPTOUT: 1
2236
DOTNET_NOLOGO: true
2337
SOLUTION_FILE: 'src/Steeltoe.All.sln'
@@ -56,15 +70,17 @@ jobs:
5670
- name: Upload packages
5771
uses: actions/upload-artifact@v4
5872
with:
59-
name: packages
73+
if-no-files-found: error
74+
name: unsigned-packages
6075
path: ${{ github.workspace }}/packages/**/*.nupkg
61-
76+
retention-days: 7
6277

6378
sign:
6479
needs: build
6580
runs-on: windows-latest
66-
# if: ${{ github.ref == 'refs/heads/main' }} # Only run this job on pushes to the main branch
67-
# if: ${{ github.event_name != 'pull_request' }}
81+
# if: ${{ github.ref == 'refs/heads/main' }} # Only run this job on pushes to the main branch
82+
# if: ${{ github.event_name != 'pull_request' }}
83+
environment: Production
6884
permissions:
6985
id-token: write
7086

@@ -85,107 +101,65 @@ jobs:
85101
- name: Install code signing tool
86102
run: dotnet tool install --global sign --prerelease
87103

88-
# From documentation workflow
89-
- name: Log into Azure CLI with service principal
104+
- name: 'Az CLI login'
90105
uses: azure/login@v2
91106
with:
92-
creds: ${{ secrets.AZURE_CREDENTIALS }}
93-
allow-no-subscriptions: true
94-
95-
# - name: Azure login
96-
# uses: azure/login@v2
97-
# with:
98-
# allow-no-subscriptions: true
99-
# client-id: ${{ secrets.AZURE_CLIENT_ID }}
100-
# tenant-id: ${{ secrets.AZURE_TENANT_ID }}
101-
# subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
102-
103-
# sign code azure-key-vault "**/*.nupkg"
104-
# --base-directory "${{ github.workspace }}/packages"
105-
# --azure-key-vault-url "${{ secrets.AZURE_KEY_VAULT_URL }}"
106-
# --azure-key-vault-tenant-id "${{ secrets.AZURE_KEY_VAULT_TENANT_ID }}"
107-
# --azure-key-vault-client-id "${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }}"
108-
# --azure-key-vault-client-secret "${{ secrets.AZURE_KEY_VAULT_CLIENT_SECRET }}"
109-
# --azure-key-vault-certificate "${{ secrets.AZURE_KEY_VAULT_CERTIFICATE }}"
110-
# --publisher-name "Steeltoe"
111-
# --description "Steeltoe"
112-
# --description-url "https://github.com/SteeltoeOSS"
113-
114-
# - name: Sign packages
115-
# shell: pwsh
116-
# run: >-
117-
# sign code azure-key-vault "**/*.nupkg"
118-
# --base-directory "${{ github.workspace }}/packages"
119-
# --azure-key-vault-url "${{ secrets.AZURE_KEY_VAULT_URL }}"
120-
# --azure-key-vault-tenant-id "${{ secrets.AZURE_KEY_VAULT_TENANT_ID }}"
121-
# --azure-key-vault-client-id "${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }}"
122-
# --azure-key-vault-client-secret "${{ secrets.AZURE_KEY_VAULT_CLIENT_SECRET }}"
123-
# --azure-key-vault-certificate "${{ secrets.AZURE_KEY_VAULT_CERTIFICATE_ID }}"
124-
# --description "SteeltoeSC"
125-
# --description-url "https://github.com/SteeltoeOSS"
107+
client-id: ${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }}
108+
tenant-id: ${{ secrets.AZURE_KEY_VAULT_TENANT_ID }}
109+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
126110

127111
- name: Sign packages
128112
shell: pwsh
129113
run: >-
130-
sign code azure-key-vault
131-
**/*.nupkg
132-
--base-directory "${{ github.workspace }}/packages"
133-
--publisher-name "Steeltoe"
134-
--description "Steeltoe"
135-
--description-url "https://github.com/SteeltoeOSS"
114+
sign code azure-key-vault "**/*.nupkg"
115+
--base-directory "${{ github.workspace }}"
136116
--azure-key-vault-managed-identity true
117+
--azure-credential-type "azure-cli"
137118
--azure-key-vault-url "${{ secrets.AZURE_KEY_VAULT_URL }}"
138119
--azure-key-vault-certificate "${{ secrets.AZURE_KEY_VAULT_CERTIFICATE_ID }}"
120+
--description "Steeltoe"
139121
140-
- name: "TEMP: Upload signed packages"
122+
- name: "Upload signed packages"
141123
uses: actions/upload-artifact@v4
142124
with:
143125
name: signed-packages
144126
path: ${{ github.workspace }}/packages/**/*.nupkg
145127

146-
147-
148-
149-
# - task: PowerShell@2
150-
# displayName: Set package version
151-
# env:
152-
# PackageVersionOverride: $(PackageVersionOverride)
153-
# inputs:
154-
# targetType: 'inline'
155-
# script: |
156-
# if ($env:PackageVersionOverride) {
157-
# Write-Host "Overriding package version with: $env:PackageVersionOverride"
158-
# Write-Warning "Always provide a 4-segment version (such as 1.2.3.0 or 1.2.3.0-rc1), to prevent an increment in patch number."
159-
# Write-Warning "The commit hash may still be added to the version, depending on the source branch or PR being built."
160-
# nbgv set-version $env:PackageVersionOverride
161-
#
162-
# Write-Host "Contents of version.json after update:"
163-
# get-content version.json
164-
#
165-
# git config --global user.email "cibuild@steeltoe.io"
166-
# git config --global user.name "steeltoe-cibuild"
167-
# git commit --allow-empty -m "Activating version override by locally committing changes to version.json."
168-
# }
169-
#
170-
# nbgv cloud
171-
172-
173-
# TODO: Rename secrets
174-
#source: https://dev.azure.com/SteeltoeOSS/Steeltoe/_library?itemType=VariableGroups&view=VariableGroupView&variableGroupId=1&path=PackageSigningSecrets
175-
#SignClientId
176-
#SignClientSecret
177-
#SignClientUser
178-
#SignKeyVaultCertificate
179-
#SignKeyVaultUrl
180-
#SignTenantId
181-
182-
183-
184-
# - publish: $(Build.ArtifactStagingDirectory)/packages
185-
# condition: succeeded()
186-
# displayName: Publish build artifacts
187-
# artifact: Packages
188-
189-
# TODO: Delete old yaml file.
190-
191-
# https://github.com/dotnet/sign/blob/main/docs/gh-build-and-sign.yml
128+
az-artifacts-build-and-deploy:
129+
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deployToDevFeed == 'true' }}
130+
# if: ${{ github.ref == 'refs/heads/main' }}
131+
needs: sign
132+
runs-on: ubuntu-latest
133+
steps:
134+
- uses: actions/setup-dotnet@v4
135+
with:
136+
dotnet-version: '8.0.x'
137+
source-url: ${{ env.AZURE_ARTIFACTS_FEED_URL }}
138+
env:
139+
NUGET_AUTH_TOKEN: ${{ secrets.DEV_FEED_PERSONAL_TOKEN }}
140+
- name: Download signed packages
141+
uses: actions/download-artifact@v4
142+
with:
143+
name: signed-packages
144+
path: packages
145+
# this approach won't work until a managed identity is authorized
146+
# - name: Azure CLI Login
147+
# uses: azure/login@v2
148+
# with:
149+
# client-id: ${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }}
150+
# tenant-id: ${{ secrets.AZURE_KEY_VAULT_TENANT_ID }}
151+
# subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
152+
# - name: Install credential provider for Azure Artifacts
153+
# run: sh -c "$(curl -fsSL https://aka.ms/install-artifacts-credprovider.sh)"
154+
# - name: Extract access token
155+
# run: |
156+
# # no idea what the guid is for, came from this link:
157+
# # https://learn.microsoft.com/en-us/azure/devops/artifacts/quickstarts/github-actions?view=azure-devops&pivots=managed-identity#assign-permissions-to-your-managed-identity-in-azure-devops
158+
# accessToken=$(az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv)
159+
# echo "::add-mask::$accessToken"
160+
# echo "ACCESS_TOKEN=$accessToken" >> $GITHUB_ENV
161+
# - name: Configure authentication provider to use Azure DevOps token
162+
# run: echo "VSS_NUGET_ACCESSTOKEN=$ACCESS_TOKEN" >> $GITHUB_ENV
163+
164+
- name: 'Publish the package to Azure Artifacts'
165+
run: dotnet nuget push packages/*.nupkg --api-key AzureDevOps --source ${{ env.AZURE_ARTIFACTS_FEED_URL }}

0 commit comments

Comments
 (0)