gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 02:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fail fast on missing native signing configuration

Browse Source
This commit is contained in:
rcourtman
2026-07-09 23:44:22 +01:00
parent 211b80717d
commit a3ef1226b7
3 changed files with 54 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-release-candidate.yml
+39 -2
View File
@@ -24,9 +24,45 @@ permissions:
contents: read
jobs:
signing-configuration:
name: Verify Native Signing Configuration
if: ${{ inputs.require_platform_signing }}
runs-on: ubuntu-24.04
timeout-minutes: 2
steps:
- name: Report missing signing secrets
env:
APPLE_DEVELOPER_ID_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_P12_BASE64 }}
APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD }}
APPLE_DEVELOPER_ID_APPLICATION_IDENTITY: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_IDENTITY }}
APPLE_NOTARY_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_KEY_P8_BASE64 }}
APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
WINDOWS_CODE_SIGNING_CERTIFICATE_PFX_BASE64: ${{ secrets.WINDOWS_CODE_SIGNING_CERTIFICATE_PFX_BASE64 }}
WINDOWS_CODE_SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CODE_SIGNING_CERTIFICATE_PASSWORD }}
run: |
set -euo pipefail
missing=0
for name in \
APPLE_DEVELOPER_ID_CERTIFICATE_P12_BASE64 \
APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD \
APPLE_DEVELOPER_ID_APPLICATION_IDENTITY \
APPLE_NOTARY_KEY_P8_BASE64 \
APPLE_NOTARY_KEY_ID \
APPLE_NOTARY_ISSUER_ID \
WINDOWS_CODE_SIGNING_CERTIFICATE_PFX_BASE64 \
WINDOWS_CODE_SIGNING_CERTIFICATE_PASSWORD; do
if [ -z "${!name:-}" ]; then
echo "::error::Missing required Actions secret ${name}."
missing=1
fi
done
exit "$missing"
sign-macos-agent:
name: Sign and Notarize macOS Agent
if: ${{ inputs.require_platform_signing }}
needs: signing-configuration
if: ${{ inputs.require_platform_signing && needs.signing-configuration.result == 'success' }}
runs-on: macos-15
timeout-minutes: 30
steps:
@@ -111,7 +147,8 @@ jobs:
sign-windows-agent:
name: Authenticode Sign Windows Agent
if: ${{ inputs.require_platform_signing }}
needs: signing-configuration
if: ${{ inputs.require_platform_signing && needs.signing-configuration.result == 'success' }}
runs-on: windows-2025
timeout-minutes: 25
steps:
docs/release-control/v6/internal/subsystems/deployment-installability.md
+2 -1
View File
@@ -341,7 +341,8 @@ TLS floor in the dynamic config.
A manually dispatched release rehearsal must activate the same signed
candidate build whenever its required `version` input is non-empty and must
require the same macOS notarization and Windows Authenticode lanes as a
publish run.
publish run. A cheap signing-configuration job must report every missing
repository secret before either platform runner is allocated.
Scheduled watchdog rehearsals omit that input and must skip candidate
signing while retaining the non-publish policy and integration checks.
Release-facing agent-paradigm blurbs under `docs/releases/` must describe
scripts/release_control/release_promotion_policy_test.py
+13
View File
@@ -621,6 +621,19 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
self.assertIn("PULSE_UPDATE_SIGNING_PUBLIC_KEY=${{ vars.PULSE_UPDATE_SIGNING_PUBLIC_KEY }}", content)
self.assertIn("Validate installer signing key pins", candidate_workflow)
self.assertIn("timeout-minutes: 60", candidate_workflow)
self.assertIn("Verify Native Signing Configuration", candidate_workflow)
self.assertEqual(candidate_workflow.count("needs: signing-configuration"), 2)
for signing_secret in (
"APPLE_DEVELOPER_ID_CERTIFICATE_P12_BASE64",
"APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD",
"APPLE_DEVELOPER_ID_APPLICATION_IDENTITY",
"APPLE_NOTARY_KEY_P8_BASE64",
"APPLE_NOTARY_KEY_ID",
"APPLE_NOTARY_ISSUER_ID",
"WINDOWS_CODE_SIGNING_CERTIFICATE_PFX_BASE64",
"WINDOWS_CODE_SIGNING_CERTIFICATE_PASSWORD",
):
self.assertIn(signing_secret, candidate_workflow)
self.assertIn('tar -xzf "$tarball" -C "$extract_dir" -- "$@"', release_validator)
self.assertNotIn('tar -xOf "$tarball" "$entry"', release_validator)
self.assertIn("go run ./scripts/release_update_key.go public-key-ssh", candidate_workflow)