nuget-sign-cert.yml

name: Nuget Code Signing
on:
  push:
    branches: [ '*' ]
    tags: [ '*' ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run automatically at 8AM PST Monday-Friday
    - cron: '0 15 * * 1-5'
  workflow_dispatch:

jobs:
  code-signing:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v2
      - run: make install
        
      - name: Code signing with Software Trust Manager
        id: SSMClientToolSetup
        uses: digicert/ssm-code-signing@v0.0.2

      - name: NuGet Install
        uses: NuGet/setup-nuget@v1.0.5
        with:
          nuget-version: latest

      - name: Set up certificate
        run: |
          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
          cat  /d/Certificate_pkcs12.p12
        shell: bash

      - name: Set variables
        id: variables
        run: |
          dir
          echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
          echo "::set-output name=KEYPAIR_NAME::gt-standard-keypair"
          echo "::set-output name=CERTIFICATE_NAME::gt-certificate"
          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
        shell: bash
        
      - run: echo “The config file path ${{ steps.SSMClientToolSetup.outputs.PKCS11_CONFIG }}”

      - name: Setup Keylocker KSP on windows
        run: |
          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi 
          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
          smksp_registrar.exe list 
          smctl.exe keypair ls 
          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
        shell: cmd

      - name: Certificates Sync
        run: |
          smctl windows certsync
        shell: cmd

      - name: Create Signed Directory
        run: |
          mkdir D:\a\stm-github-action-demo\stm-github-action-demo\dist\
        shell: cmd

      - name: Signing using Nuget
        run: |
          make release
          copy **/*.nupkg D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg
          nuget sign "D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg" -Timestamper http://timestamp.digicert.com -outputdirectory "D:\a\stm-github-action-demo\stm-github-action-demo\dist\NugetSigned" -CertificateFingerprint ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} -HashAlgorithm SHA256 -Verbosity detailed -Overwrite
          nuget verify -All "D:\a\stm-github-action-demo\stm-github-action-demo\dist\NugetSigned\*"
          nuget push "D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg" -k ${{ secrets.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: windows-latest
          path: |
            dist