name: Sign artifacts
description: >
  Signs files via azure/artifact-signing-action with up to three attempts.
  The Microsoft timestamp server (timestamp.acs.microsoft.com) fails
  intermittently; re-signing already-signed files is safe because signtool
  replaces existing signatures, so failed batches can simply be retried.

inputs:
  azure-tenant-id:
    description: Azure tenant id used for authentication.
    required: true
  azure-client-id:
    description: Azure client id used for authentication.
    required: true
  azure-client-secret:
    description: Azure client secret used for authentication.
    required: true
  files:
    description: Newline-separated list of files to sign.
    required: false
    default: ''
  files-folder:
    description: Folder containing the files to sign.
    required: false
    default: ''
  files-folder-filter:
    description: Comma-separated file extensions to sign within files-folder.
    required: false
    default: ''
  files-folder-recurse:
    description: Whether to search files-folder recursively.
    required: false
    default: 'false'
  endpoint:
    description: Artifact Signing endpoint.
    required: false
    default: https://weu.codesigning.azure.net/
  signing-account-name:
    description: Artifact Signing account name.
    required: false
    default: CentronCodesigning
  certificate-profile-name:
    description: Certificate profile name.
    required: false
    default: centroncert

runs:
  using: composite
  steps:
    - name: Sign (attempt 1)
      id: attempt1
      continue-on-error: true
      uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
      with:
        azure-tenant-id: ${{ inputs.azure-tenant-id }}
        azure-client-id: ${{ inputs.azure-client-id }}
        azure-client-secret: ${{ inputs.azure-client-secret }}
        endpoint: ${{ inputs.endpoint }}
        signing-account-name: ${{ inputs.signing-account-name }}
        certificate-profile-name: ${{ inputs.certificate-profile-name }}
        files: ${{ inputs.files }}
        files-folder: ${{ inputs.files-folder }}
        files-folder-filter: ${{ inputs.files-folder-filter }}
        files-folder-recurse: ${{ inputs.files-folder-recurse }}
        file-digest: SHA256
        timestamp-rfc3161: http://timestamp.acs.microsoft.com
        timestamp-digest: SHA256
        exclude-environment-credential: false
        exclude-workload-identity-credential: true
        exclude-managed-identity-credential: true
        exclude-shared-token-cache-credential: true
        exclude-visual-studio-credential: true
        exclude-visual-studio-code-credential: true
        exclude-azure-cli-credential: true
        exclude-azure-powershell-credential: true
        exclude-azure-developer-cli-credential: true
        exclude-interactive-browser-credential: true

    - name: Wait before retry (attempt 2)
      if: steps.attempt1.outcome == 'failure'
      shell: pwsh
      run: |
        Write-Host 'Signing failed, retrying in 30 seconds...'
        Start-Sleep -Seconds 30

    - name: Sign (attempt 2)
      id: attempt2
      if: steps.attempt1.outcome == 'failure'
      continue-on-error: true
      uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
      with:
        azure-tenant-id: ${{ inputs.azure-tenant-id }}
        azure-client-id: ${{ inputs.azure-client-id }}
        azure-client-secret: ${{ inputs.azure-client-secret }}
        endpoint: ${{ inputs.endpoint }}
        signing-account-name: ${{ inputs.signing-account-name }}
        certificate-profile-name: ${{ inputs.certificate-profile-name }}
        files: ${{ inputs.files }}
        files-folder: ${{ inputs.files-folder }}
        files-folder-filter: ${{ inputs.files-folder-filter }}
        files-folder-recurse: ${{ inputs.files-folder-recurse }}
        file-digest: SHA256
        timestamp-rfc3161: http://timestamp.acs.microsoft.com
        timestamp-digest: SHA256
        exclude-environment-credential: false
        exclude-workload-identity-credential: true
        exclude-managed-identity-credential: true
        exclude-shared-token-cache-credential: true
        exclude-visual-studio-credential: true
        exclude-visual-studio-code-credential: true
        exclude-azure-cli-credential: true
        exclude-azure-powershell-credential: true
        exclude-azure-developer-cli-credential: true
        exclude-interactive-browser-credential: true

    - name: Wait before retry (attempt 3)
      if: steps.attempt1.outcome == 'failure' && steps.attempt2.outcome == 'failure'
      shell: pwsh
      run: |
        Write-Host 'Signing failed again, retrying in 90 seconds...'
        Start-Sleep -Seconds 90

    - name: Sign (attempt 3)
      if: steps.attempt1.outcome == 'failure' && steps.attempt2.outcome == 'failure'
      uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
      with:
        azure-tenant-id: ${{ inputs.azure-tenant-id }}
        azure-client-id: ${{ inputs.azure-client-id }}
        azure-client-secret: ${{ inputs.azure-client-secret }}
        endpoint: ${{ inputs.endpoint }}
        signing-account-name: ${{ inputs.signing-account-name }}
        certificate-profile-name: ${{ inputs.certificate-profile-name }}
        files: ${{ inputs.files }}
        files-folder: ${{ inputs.files-folder }}
        files-folder-filter: ${{ inputs.files-folder-filter }}
        files-folder-recurse: ${{ inputs.files-folder-recurse }}
        file-digest: SHA256
        timestamp-rfc3161: http://timestamp.acs.microsoft.com
        timestamp-digest: SHA256
        exclude-environment-credential: false
        exclude-workload-identity-credential: true
        exclude-managed-identity-credential: true
        exclude-shared-token-cache-credential: true
        exclude-visual-studio-credential: true
        exclude-visual-studio-code-credential: true
        exclude-azure-cli-credential: true
        exclude-azure-powershell-credential: true
        exclude-azure-developer-cli-credential: true
        exclude-interactive-browser-credential: true