| 1 | name: Certum signing smoke test |
| 2 | |
| 3 | on: |
| 4 | workflow_dispatch: |
| 5 | |
| 6 | permissions: |
| 7 | contents: read |
| 8 | |
| 9 | concurrency: |
| 10 | group: certum-signing |
| 11 | cancel-in-progress: false |
| 12 | |
| 13 | jobs: |
| 14 | sign: |
| 15 | if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/main-v2' && github.ref_protected |
| 16 | runs-on: windows-2022 |
| 17 | environment: release |
| 18 | timeout-minutes: 20 |
| 19 | steps: |
| 20 | - uses: actions/checkout@v7 |
| 21 | with: |
| 22 | ref: ${{ github.workflow_sha }} |
| 23 | persist-credentials: false |
| 24 | - uses: actions/setup-go@v7 |
| 25 | with: |
| 26 | go-version-file: go.mod |
| 27 | cache: false |
| 28 | - name: Check signing configuration |
| 29 | shell: pwsh |
| 30 | env: |
| 31 | CERTUM_USERNAME: ${{ secrets.CERTUM_USERNAME }} |
| 32 | CERTUM_OTP_URI: ${{ secrets.CERTUM_OTP_URI }} |
| 33 | CERTUM_KEY_ID: ${{ secrets.CERTUM_KEY_ID }} |
| 34 | run: | |
| 35 | $ErrorActionPreference = 'Stop' |
| 36 | if ([string]::IsNullOrWhiteSpace($env:CERTUM_USERNAME)) { throw 'Missing CERTUM_USERNAME' } |
| 37 | if ($env:CERTUM_OTP_URI -notmatch '^otpauth://totp/') { throw 'CERTUM_OTP_URI must be a complete TOTP URI' } |
| 38 | if ($env:CERTUM_KEY_ID -notmatch '^[0-9a-fA-F]{40}$') { throw 'CERTUM_KEY_ID must be the 40-character SHA-1 certificate thumbprint' } |
| 39 | |
| 40 | - name: Build open-source signing probes |
| 41 | shell: pwsh |
| 42 | run: | |
| 43 | $ErrorActionPreference = 'Stop' |
| 44 | # This minimal probe is covered by the repository's MIT license. |
| 45 | New-Item -ItemType Directory payload | Out-Null |
| 46 | 'package main; func main() { println("Reasonix Certum signing probe") }' | Set-Content probe.go |
| 47 | $env:GOOS = 'windows' |
| 48 | $env:CGO_ENABLED = '0' |
| 49 | foreach ($arch in @('amd64', 'arm64')) { |
| 50 | $env:GOARCH = $arch |
| 51 | go build -trimpath -o "payload/probe-$arch.exe" probe.go |
| 52 | if ($LASTEXITCODE -ne 0) { throw 'Probe compilation failed' } |
| 53 | } |
| 54 | @('probe-amd64.exe', 'probe-arm64.exe') | Set-Content payload/signing-files.txt |
| 55 | Copy-Item payload/probe-amd64.exe installer-probe.exe |
| 56 | |
| 57 | - name: Connect to SimplySign cloud certificate |
| 58 | uses: ./.github/actions/setup-certum |
| 59 | with: |
| 60 | username: ${{ secrets.CERTUM_USERNAME }} |
| 61 | otp-uri: ${{ secrets.CERTUM_OTP_URI }} |
| 62 | thumbprint: ${{ secrets.CERTUM_KEY_ID }} |
| 63 | |
| 64 | - name: Sign and verify payload and installer probes |
| 65 | shell: pwsh |
| 66 | env: |
| 67 | CERTUM_KEY_ID: ${{ secrets.CERTUM_KEY_ID }} |
| 68 | run: | |
| 69 | ./scripts/sign-certum.ps1 -PayloadDirectory payload |
| 70 | ./scripts/sign-certum.ps1 -FilePath installer-probe.exe |
| 71 | 'Certum x64/ARM64 payload and installer signing, expected signer, trust, and timestamps passed.' >> $env:GITHUB_STEP_SUMMARY |
| 72 |