Skip to content

Commit a542129

Browse files
svivesaerosvivesaero
committed
feat: extract nuget signing workflow from reusable workflow
- Create dedicated nuget-sign-artifacts.yaml workflow for NuGet package signing - Remove NuGet-specific functionality from reusable_sign-artifacts.yaml - Update secret names to match existing team workflows (ES_USERNAME, ES_PASSWORD, etc.) - Use batch_sign command and dir_path/output_path parameters for compatibility - Add malware-block and override configuration options - Fix YAML formatting issues in reusable workflow - Maintain backward compatibility for existing GPG signing workflows
1 parent 71ff744 commit a542129

File tree

2 files changed

+119
-70
lines changed

2 files changed

+119
-70
lines changed

‎.github/workflows/nuget-sign-artifacts.yaml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
name: Sign NuGet Artifacts
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
artifact-glob:
7+
description: Directory path containing NuGet packages to sign (e.g. ./sign or ./artifacts)
8+
required: true
9+
type: string
10+
output-path:
11+
description: Output directory for signed packages (e.g. ./artifacts)
12+
required: false
13+
type: string
14+
default: ${{ github.workspace }}
15+
artifact-name:
16+
description: Name for the uploaded artifacts
17+
required: false
18+
type: string
19+
default: signed-nuget-artifacts
20+
retention-days:
21+
description: Retention days for the artifacts
22+
required: false
23+
type: number
24+
default: 7
25+
nuget-environment:
26+
description: SSL.com environment name for NuGet signing
27+
required: false
28+
type: string
29+
default: PROD
30+
jvm-max-memory:
31+
description: Maximum JVM memory for NuGet signing process
32+
required: false
33+
type: string
34+
default: 1024M
35+
malware-block:
36+
description: Enable malware blocking during signing
37+
required: false
38+
type: boolean
39+
default: false
40+
override:
41+
description: Override existing signatures
42+
required: false
43+
type: boolean
44+
default: false
45+
runs-on:
46+
description: The runner to use for the build
47+
required: false
48+
type: string
49+
default: ubuntu-latest
50+
secrets:
51+
ES_USERNAME:
52+
description: SSL.com username for NuGet signing
53+
required: true
54+
ES_PASSWORD:
55+
description: SSL.com password for NuGet signing
56+
required: true
57+
CREDENTIAL_ID:
58+
description: SSL.com credential ID for NuGet signing
59+
required: true
60+
ES_TOTP_SECRET:
61+
description: SSL.com TOTP secret for NuGet signing
62+
required: true
63+
64+
permissions:
65+
contents: read
66+
packages: read
67+
68+
jobs:
69+
sign-nuget:
70+
runs-on: ${{ inputs.runs-on }}
71+
steps:
72+
- uses: actions/checkout@v4
73+
74+
- name: Check for NuGet packages
75+
run: |
76+
echo "Checking for NuGet packages..."
77+
NUGET_PACKAGES=$(find . -name "*.nupkg" -type f)
78+
if [ -n "$NUGET_PACKAGES" ]; then
79+
echo "Found NuGet packages:"
80+
echo "$NUGET_PACKAGES"
81+
else
82+
echo "No NuGet packages found"
83+
exit 1
84+
fi
85+
86+
- name: Sign NuGet Packages with SSL.com
87+
uses: sslcom/esigner-codesign@a272724cb13abe0abc579c6c40f7899969b6942b
88+
with:
89+
command: batch_sign
90+
username: ${{secrets.ES_USERNAME}}
91+
password: ${{secrets.ES_PASSWORD}}
92+
credential_id: ${{secrets.CREDENTIAL_ID}}
93+
totp_secret: ${{secrets.ES_TOTP_SECRET}}
94+
dir_path: ${{ inputs.artifact-glob }}
95+
output_path: ${{ inputs.output-path || github.workspace }}
96+
malware_block: ${{ inputs.malware-block || false }}
97+
override: ${{ inputs.override || false }}
98+
environment_name: ${{ inputs.nuget-environment }}
99+
clean_logs: true
100+
jvm_max_memory: ${{ inputs.jvm-max-memory }}
101+
signing_method: v1
102+
103+
- name: Verify NuGet Packages
104+
run: |
105+
echo "Verifying signed NuGet packages..."
106+
OUTPUT_DIR="${{ inputs.output-path || github.workspace }}"
107+
if [ -d "$OUTPUT_DIR" ]; then
108+
find "$OUTPUT_DIR" -name "*.nupkg" -type f | while read -r file; do
109+
echo "Verifying: $file"
110+
dotnet nuget verify "$file" --all || echo "Warning: Could not verify $file"
111+
done
112+
fi
113+
114+
- name: Upload Signed NuGet Artifacts
115+
uses: actions/upload-artifact@v4
116+
with:
117+
name: ${{ inputs.artifact-name }}
118+
path: ${{ inputs.output-path || github.workspace }}
119+
retention-days: ${{ inputs.retention-days }}

‎.github/workflows/reusable_sign-artifacts.yaml‎

Lines changed: 0 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,6 @@ on:
1717
required: false
1818
type: number
1919
default: 7
20-
enable-nuget-signing:
21-
description: Enable SSL.com signing for NuGet packages
22-
required: false
23-
type: boolean
24-
default: false
25-
nuget-environment:
26-
description: SSL.com environment name for NuGet signing
27-
required: false
28-
type: string
29-
default: PROD
30-
jvm-max-memory:
31-
description: Maximum JVM memory for NuGet signing process
32-
required: false
33-
type: string
34-
default: 1024M
3520
artifactory-url:
3621
required: false
3722
description: JFrog Artifactory URL
@@ -59,18 +44,6 @@ on:
5944
required: true
6045
gpg-key-pass:
6146
required: true
62-
es-username:
63-
description: SSL.com username for NuGet signing
64-
required: false
65-
es-password:
66-
description: SSL.com password for NuGet signing
67-
required: false
68-
credential-id:
69-
description: SSL.com credential ID for NuGet signing
70-
required: false
71-
es-totp-secret:
72-
description: SSL.com TOTP secret for NuGet signing
73-
required: false
7447

7548
permissions:
7649
contents: read
@@ -98,49 +71,6 @@ jobs:
9871
chmod +x ${{ github.workspace }}/.github/workflows/sign-artifacts/entrypoint.sh
9972
${{ github.workspace }}/.github/workflows/sign-artifacts/entrypoint.sh "${{ inputs.artifact-glob }}" "${{ inputs.artifact-name }}"
10073
101-
- name: Check for NuGet packages and sign if enabled
102-
if: inputs.enable-nuget-signing
103-
run: |
104-
echo "Checking for NuGet packages..."
105-
NUGET_PACKAGES=$(find "${{ inputs.artifact-name }}" -name "*.nupkg" -type f)
106-
if [ -n "$NUGET_PACKAGES" ]; then
107-
echo "Found NuGet packages, signing with SSL.com..."
108-
echo "$NUGET_PACKAGES" | while read -r file; do
109-
echo "Signing: $file"
110-
done
111-
else
112-
echo "No NuGet packages found"
113-
fi
114-
115-
- name: Sign NuGet Packages with SSL.com
116-
if: inputs.enable-nuget-signing
117-
uses: sslcom/esigner-codesign@a272724cb13abe0abc579c6c40f7899969b6942b
118-
with:
119-
command: sign
120-
username: ${{secrets.es-username}}
121-
password: ${{secrets.es-password}}
122-
credential_id: ${{secrets.credential-id}}
123-
totp_secret: ${{secrets.es-totp-secret}}
124-
file_path: ${{ inputs.artifact-name }}/**/*.nupkg
125-
output_path: ${{github.workspace}}/${{ inputs.artifact-name }}
126-
malware_block: false
127-
override: false
128-
environment_name: ${{ inputs.nuget-environment }}
129-
clean_logs: true
130-
jvm_max_memory: ${{ inputs.jvm-max-memory }}
131-
signing_method: v1
132-
133-
- name: Verify NuGet Packages (if NuGet signing was performed)
134-
if: inputs.enable-nuget-signing
135-
run: |
136-
echo "Verifying signed NuGet packages..."
137-
if [ -d "${{ inputs.artifact-name }}" ]; then
138-
find "${{ inputs.artifact-name }}" -name "*.nupkg" -type f | while read -r file; do
139-
echo "Verifying: $file"
140-
dotnet nuget verify "$file" --all || echo "Warning: Could not verify $file"
141-
done
142-
fi
143-
14474
- name: Upload Artifacts
14575
uses: actions/upload-artifact@v4
14676
with:

0 commit comments

Comments
 (0)