feat: windows codesign with Azure trusted signing #7675
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - if: ${{ contains(matrix.target, 'windows') }} | ||
| name: Sign Windows binaries with Azure Trusted Signing | ||
| uses: ./.github/actions/windows-code-sign | ||
| with: | ||
| target: ${{ matrix.target }} |
There was a problem hiding this comment.
The new Windows signing step runs for every Windows matrix entry in PRs (conditional only on contains(matrix.target, 'windows')), yet the step immediately consumes repository secrets (AZURE_TRUSTED_SIGNING_*). Forked pull requests do not receive these secrets, so azure/login@v2 will fail before the build completes, breaking all forked PRs on Windows. Mirror the Linux signing guard (skip when github.event.pull_request.head.repo.fork is true) so contributors’ PRs continue to build.
Useful? React with 👍 / 👎.
shijie-oai
force-pushed
the
shijie/windows-codesigning
branch
from
afba26b to
9646eca
Compare
Summary
Set up codesign for windows dist with Azure trusted signing and its github action integration.