T-Gander/Sunshine
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

build(windows): sign windows executables (#4829)

Browse Source
This commit is contained in:
David Lane
2026-03-10 21:54:59 -04:00
committed by GitHub
parent 60158b4712
commit 977045cc88
2 changed files with 70 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
.github/workflows/ci-windows.yml vendored
View File

@@ -5,12 +5,41 @@ permissions: {}
on:
workflow_call:
inputs:
# Azure Artifact Signing account name
azure_signing_account:
required: false
type: string
default: ''
# Azure Artifact Signing certificate profile name
azure_signing_cert_profile:
required: false
type: string
default: ''
# Azure Artifact Signing account endpoint
# e.g. https://<region>.codesigning.azure.net
azure_signing_endpoint:
required: false
type: string
default: ''
publish_release:
required: true
type: string
release_commit:
required: true
type: string
release_version:
required: true
type: string
secrets:
# Azure Client ID (App Registration) for Artifact Signing
AZURE_CLIENT_ID:
required: false
# Azure Client Secret for Artifact Signing
AZURE_CLIENT_SECRET:
required: false
# Azure Tenant ID for Artifact Signing
AZURE_TENANT_ID:
required: false
jobs:
build_windows:
@@ -217,6 +246,25 @@ jobs:
ninja -C build
echo "::remove-matcher owner=gcc::"
- name: Sign Windows executables
if: inputs.publish_release == 'true' && inputs.azure_signing_account != ''
uses: azure/trusted-signing-action@87c2e83e6868da99d3380aa309851b32ed9a8346 # v1.1.0
with:
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
certificate-profile-name: ${{ inputs.azure_signing_cert_profile }}
endpoint: ${{ inputs.azure_signing_endpoint }}
files: |
${{ github.workspace }}/build/sunshine.exe
${{ github.workspace }}/build/tools/audio-info.exe
${{ github.workspace }}/build/tools/dxgi-info.exe
${{ github.workspace }}/build/tools/sunshinesvc.exe
files-folder: src_assets/windows
files-folder-filter: ps1
files-folder-recurse: true
signing-account-name: ${{ inputs.azure_signing_account }}
- name: Package Windows
shell: msys2 {0}
run: |
@@ -233,6 +281,20 @@ jobs:
mv ./cpack_artifacts/Sunshine.msi ../artifacts/Sunshine-${{ matrix.name }}-installer.msi
mv ./cpack_artifacts/Sunshine.zip ../artifacts/Sunshine-${{ matrix.name }}-portable.zip
- name: Sign Windows installers
if: inputs.publish_release == 'true' && inputs.azure_signing_account != ''
uses: azure/trusted-signing-action@87c2e83e6868da99d3380aa309851b32ed9a8346 # v1.1.0
with:
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
certificate-profile-name: ${{ inputs.azure_signing_cert_profile }}
endpoint: ${{ inputs.azure_signing_endpoint }}
files-folder: artifacts
files-folder-filter: exe,msi
files-folder-recurse: false
signing-account-name: ${{ inputs.azure_signing_account }}
- name: Debug nsis
if: always()
shell: msys2 {0}

8
.github/workflows/ci.yml vendored
View File

@@ -158,8 +158,16 @@ jobs:
contents: read
uses: ./.github/workflows/ci-windows.yml
with:
azure_signing_account: ${{ vars.AZURE_SIGNING_ACCOUNT }}
azure_signing_cert_profile: ${{ vars.AZURE_SIGNING_CERT_PROFILE }}
azure_signing_endpoint: ${{ vars.AZURE_SIGNING_ENDPOINT }}
publish_release: ${{ needs.release-setup.outputs.publish_release }}
release_commit: ${{ needs.release-setup.outputs.release_commit }}
release_version: ${{ needs.release-setup.outputs.release_version }}
secrets:
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
bundle-analysis:
name: Bundle Analysis