Christoph Schwörer
f045b99a25
QuellCode/CentronERP war nur als Gitlink (Submodul-Referenz auf 79c1142) getrackt, ohne .gitmodules und ohne erreichbares Remote. Der Untersuchungsgegenstand der Versuchsreihe war damit nicht reproduzierbar gesichert: Ein Klon haette ein leeres Verzeichnis erhalten, und die Belege der 3.287 Anforderungen waeren nicht ueberpruefbar gewesen. Umstellung: - Historie nach c:\DEV\CentronERP_git_snapshot_79c1142 ausgelagert (vollstaendig lesbar, enthaelt 79c1142 und Vorgaenger 89ccfd6) - Gitlink aus dem Index entfernt - Dateiinhalt aufgenommen: 24.557 Dateien, rund 333 MB Die verschachtelte .gitignore der Codebasis gilt weiter, Build-Artefakte bleiben ausgeschlossen. Details in Versuche/Versuch_01/_Codebasis-Nachweis.md
150 lines
6.0 KiB
YAML
150 lines
6.0 KiB
YAML
name: Sign artifacts
|
|
description: >
|
|
Signs files via azure/artifact-signing-action with up to three attempts.
|
|
The Microsoft timestamp server (timestamp.acs.microsoft.com) fails
|
|
intermittently; re-signing already-signed files is safe because signtool
|
|
replaces existing signatures, so failed batches can simply be retried.
|
|
|
|
inputs:
|
|
azure-tenant-id:
|
|
description: Azure tenant id used for authentication.
|
|
required: true
|
|
azure-client-id:
|
|
description: Azure client id used for authentication.
|
|
required: true
|
|
azure-client-secret:
|
|
description: Azure client secret used for authentication.
|
|
required: true
|
|
files:
|
|
description: Newline-separated list of files to sign.
|
|
required: false
|
|
default: ''
|
|
files-folder:
|
|
description: Folder containing the files to sign.
|
|
required: false
|
|
default: ''
|
|
files-folder-filter:
|
|
description: Comma-separated file extensions to sign within files-folder.
|
|
required: false
|
|
default: ''
|
|
files-folder-recurse:
|
|
description: Whether to search files-folder recursively.
|
|
required: false
|
|
default: 'false'
|
|
endpoint:
|
|
description: Artifact Signing endpoint.
|
|
required: false
|
|
default: https://weu.codesigning.azure.net/
|
|
signing-account-name:
|
|
description: Artifact Signing account name.
|
|
required: false
|
|
default: CentronCodesigning
|
|
certificate-profile-name:
|
|
description: Certificate profile name.
|
|
required: false
|
|
default: centroncert
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Sign (attempt 1)
|
|
id: attempt1
|
|
continue-on-error: true
|
|
uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
|
|
with:
|
|
azure-tenant-id: ${{ inputs.azure-tenant-id }}
|
|
azure-client-id: ${{ inputs.azure-client-id }}
|
|
azure-client-secret: ${{ inputs.azure-client-secret }}
|
|
endpoint: ${{ inputs.endpoint }}
|
|
signing-account-name: ${{ inputs.signing-account-name }}
|
|
certificate-profile-name: ${{ inputs.certificate-profile-name }}
|
|
files: ${{ inputs.files }}
|
|
files-folder: ${{ inputs.files-folder }}
|
|
files-folder-filter: ${{ inputs.files-folder-filter }}
|
|
files-folder-recurse: ${{ inputs.files-folder-recurse }}
|
|
file-digest: SHA256
|
|
timestamp-rfc3161: http://timestamp.acs.microsoft.com
|
|
timestamp-digest: SHA256
|
|
exclude-environment-credential: false
|
|
exclude-workload-identity-credential: true
|
|
exclude-managed-identity-credential: true
|
|
exclude-shared-token-cache-credential: true
|
|
exclude-visual-studio-credential: true
|
|
exclude-visual-studio-code-credential: true
|
|
exclude-azure-cli-credential: true
|
|
exclude-azure-powershell-credential: true
|
|
exclude-azure-developer-cli-credential: true
|
|
exclude-interactive-browser-credential: true
|
|
|
|
- name: Wait before retry (attempt 2)
|
|
if: steps.attempt1.outcome == 'failure'
|
|
shell: pwsh
|
|
run: |
|
|
Write-Host 'Signing failed, retrying in 30 seconds...'
|
|
Start-Sleep -Seconds 30
|
|
|
|
- name: Sign (attempt 2)
|
|
id: attempt2
|
|
if: steps.attempt1.outcome == 'failure'
|
|
continue-on-error: true
|
|
uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
|
|
with:
|
|
azure-tenant-id: ${{ inputs.azure-tenant-id }}
|
|
azure-client-id: ${{ inputs.azure-client-id }}
|
|
azure-client-secret: ${{ inputs.azure-client-secret }}
|
|
endpoint: ${{ inputs.endpoint }}
|
|
signing-account-name: ${{ inputs.signing-account-name }}
|
|
certificate-profile-name: ${{ inputs.certificate-profile-name }}
|
|
files: ${{ inputs.files }}
|
|
files-folder: ${{ inputs.files-folder }}
|
|
files-folder-filter: ${{ inputs.files-folder-filter }}
|
|
files-folder-recurse: ${{ inputs.files-folder-recurse }}
|
|
file-digest: SHA256
|
|
timestamp-rfc3161: http://timestamp.acs.microsoft.com
|
|
timestamp-digest: SHA256
|
|
exclude-environment-credential: false
|
|
exclude-workload-identity-credential: true
|
|
exclude-managed-identity-credential: true
|
|
exclude-shared-token-cache-credential: true
|
|
exclude-visual-studio-credential: true
|
|
exclude-visual-studio-code-credential: true
|
|
exclude-azure-cli-credential: true
|
|
exclude-azure-powershell-credential: true
|
|
exclude-azure-developer-cli-credential: true
|
|
exclude-interactive-browser-credential: true
|
|
|
|
- name: Wait before retry (attempt 3)
|
|
if: steps.attempt1.outcome == 'failure' && steps.attempt2.outcome == 'failure'
|
|
shell: pwsh
|
|
run: |
|
|
Write-Host 'Signing failed again, retrying in 90 seconds...'
|
|
Start-Sleep -Seconds 90
|
|
|
|
- name: Sign (attempt 3)
|
|
if: steps.attempt1.outcome == 'failure' && steps.attempt2.outcome == 'failure'
|
|
uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
|
|
with:
|
|
azure-tenant-id: ${{ inputs.azure-tenant-id }}
|
|
azure-client-id: ${{ inputs.azure-client-id }}
|
|
azure-client-secret: ${{ inputs.azure-client-secret }}
|
|
endpoint: ${{ inputs.endpoint }}
|
|
signing-account-name: ${{ inputs.signing-account-name }}
|
|
certificate-profile-name: ${{ inputs.certificate-profile-name }}
|
|
files: ${{ inputs.files }}
|
|
files-folder: ${{ inputs.files-folder }}
|
|
files-folder-filter: ${{ inputs.files-folder-filter }}
|
|
files-folder-recurse: ${{ inputs.files-folder-recurse }}
|
|
file-digest: SHA256
|
|
timestamp-rfc3161: http://timestamp.acs.microsoft.com
|
|
timestamp-digest: SHA256
|
|
exclude-environment-credential: false
|
|
exclude-workload-identity-credential: true
|
|
exclude-managed-identity-credential: true
|
|
exclude-shared-token-cache-credential: true
|
|
exclude-visual-studio-credential: true
|
|
exclude-visual-studio-code-credential: true
|
|
exclude-azure-cli-credential: true
|
|
exclude-azure-powershell-credential: true
|
|
exclude-azure-developer-cli-credential: true
|
|
exclude-interactive-browser-credential: true
|