Oliver Kieselbach 60a41e9778 CI: signing jobs run in the release environment ...

The code-signing identity trusts only environment:release now, so build-agent
release, build-msi sign-loader and release, and publish-scripts publish run in it.
Every job that federates to Azure carries an environment; the ref is no longer a
trusted subject. Help texts of the storage and endpoint helpers follow: the local
build publishes nothing since D-354.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-20 18:30:02 +02:00

..

Assert-HostsFromRegistry.ps1

CI: one endpoint registry for every host the workflows use

2026-10-10 21:32:36 +02:00

Get-Endpoints.ps1

CI: signing jobs run in the release environment

2026-10-20 18:30:02 +02:00

Get-StorageAuthHeaders.ps1

CI: signing jobs run in the release environment

2026-10-20 18:30:02 +02:00

Publish-BootstrapScripts.ps1

CI: one endpoint registry for every host the workflows use

2026-10-10 21:32:36 +02:00

Request-BuildNumber.ps1

ci: workflows authorize Azure Storage with the federated identity, not SAS secrets (D-222)

2026-09-08 17:38:14 +02:00