test-azure-signing.yml

name: Test Azure Trusted Signing

on:
  workflow_dispatch:

permissions: {}

jobs:
  build:
    name: Build snapshot Windows binaries
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Extract version from source
        id: version
        run: |
          version=$(grep -m1 'Version.*=' internal/buildinfo/version.go | sed 's/.*"\(.*\)".*/\1/')
          if [ -z "$version" ]; then
            echo "::error::Could not extract Version from internal/buildinfo/version.go"
            exit 1
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod

      - name: Run GoReleaser (snapshot, no publish)
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          distribution: goreleaser
          version: latest
          args: release --snapshot --clean --skip=publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Stage Windows .exes with release-style names
        run: |
          set -euo pipefail
          version="${{ steps.version.outputs.version }}"
          mkdir -p staging

          find_one() {
            local result
            result=$(find dist -type f "$@" | head -1)
            if [ -z "$result" ] || [ ! -f "$result" ]; then
              echo "::error::No file matched: $*"
              find dist -type f
              exit 1
            fi
            printf '%s\n' "$result"
          }

          win_amd64_src=$(find_one -name 'stepsecurity-dev-machine-guard.exe' -path '*windows_amd64*')
          win_arm64_src=$(find_one -name 'stepsecurity-dev-machine-guard.exe' -path '*windows_arm64*')
          win_task_amd64_src=$(find_one -name 'stepsecurity-dev-machine-guard-task.exe' -path '*windows_amd64*')
          win_task_arm64_src=$(find_one -name 'stepsecurity-dev-machine-guard-task.exe' -path '*windows_arm64*')

          cp "$win_amd64_src"       "staging/stepsecurity-dev-machine-guard-${version}-windows_amd64.exe"
          cp "$win_arm64_src"       "staging/stepsecurity-dev-machine-guard-${version}-windows_arm64.exe"
          cp "$win_task_amd64_src"  "staging/stepsecurity-dev-machine-guard-task-${version}-windows_amd64.exe"
          cp "$win_task_arm64_src"  "staging/stepsecurity-dev-machine-guard-task-${version}-windows_arm64.exe"
          ls -la staging/

      - name: Upload Windows .exes
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: windows-exes
          path: |
            staging/stepsecurity-dev-machine-guard-*-windows_amd64.exe
            staging/stepsecurity-dev-machine-guard-*-windows_arm64.exe
            staging/stepsecurity-dev-machine-guard-task-*-windows_amd64.exe
            staging/stepsecurity-dev-machine-guard-task-*-windows_arm64.exe
          if-no-files-found: error

  sign-and-verify:
    name: Authenticode-sign & verify
    needs: build
    runs-on: windows-latest
    environment: release
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install WiX 4 + Util extension
        shell: pwsh
        run: |
          dotnet tool install --global wix --version 4.0.5
          wix --version
          wix extension add --global WixToolset.Util.wixext/4.0.5
          wix extension list --global

      - name: Download Windows .exes from build job
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: windows-exes
          path: dist

      - name: Resolve Windows binary paths
        id: paths
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $amd64     = Get-ChildItem dist -Filter "stepsecurity-dev-machine-guard-*-windows_amd64.exe" | Where-Object Name -NotLike '*-task-*' | Select-Object -First 1
          $arm64     = Get-ChildItem dist -Filter "stepsecurity-dev-machine-guard-*-windows_arm64.exe" | Where-Object Name -NotLike '*-task-*' | Select-Object -First 1
          $taskAmd64 = Get-ChildItem dist -Filter "stepsecurity-dev-machine-guard-task-*-windows_amd64.exe" | Select-Object -First 1
          $taskArm64 = Get-ChildItem dist -Filter "stepsecurity-dev-machine-guard-task-*-windows_arm64.exe" | Select-Object -First 1
          if (-not $amd64 -or -not $arm64 -or -not $taskAmd64 -or -not $taskArm64) {
            Write-Error "One or more Windows .exes missing under dist/"
            Get-ChildItem dist | Format-Table Name
            exit 1
          }
          "amd64=$($amd64.FullName)"         | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          "arm64=$($arm64.FullName)"         | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          "task_amd64=$($taskAmd64.FullName)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          "task_arm64=$($taskArm64.FullName)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8

      - name: Show pre-signing signature state (sanity)
        shell: pwsh
        run: |
          foreach ($f in @(
            '${{ steps.paths.outputs.amd64 }}',
            '${{ steps.paths.outputs.arm64 }}',
            '${{ steps.paths.outputs.task_amd64 }}',
            '${{ steps.paths.outputs.task_arm64 }}'
          )) {
            $sig = Get-AuthenticodeSignature $f
            Write-Host "$f -> $($sig.Status)"
            if ($sig.Status -eq 'Valid') {
              Write-Error "Pre-signing check: $f is already signed. Aborting so we don't mask a regression."
              exit 1
            }
          }

      - name: Azure login (OIDC)
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Authenticode-sign Windows .exes
        uses: Azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
        with:
          endpoint: ${{ secrets.AZURE_TS_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_TS_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_TS_CERT_PROFILE_NAME }}
          files: |
            ${{ steps.paths.outputs.amd64 }}
            ${{ steps.paths.outputs.arm64 }}
            ${{ steps.paths.outputs.task_amd64 }}
            ${{ steps.paths.outputs.task_arm64 }}
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Verify .exe signatures
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $failed = $false
          foreach ($f in @(
            '${{ steps.paths.outputs.amd64 }}',
            '${{ steps.paths.outputs.arm64 }}',
            '${{ steps.paths.outputs.task_amd64 }}',
            '${{ steps.paths.outputs.task_arm64 }}'
          )) {
            $sig = Get-AuthenticodeSignature $f
            $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '<none>' }
            $timeSubject = if ($sig.TimeStamperCertificate) { $sig.TimeStamperCertificate.Subject } else { '<none>' }
            Write-Host "$(Split-Path $f -Leaf):"
            Write-Host "  Status:      $($sig.Status)"
            Write-Host "  Signer:      $subject"
            Write-Host "  Timestamper: $timeSubject"
            if ($sig.Status -ne 'Valid') {
              Write-Host "::error::Signature status is $($sig.Status) (expected Valid)"
              $failed = $true
            }
            if ($subject -notmatch 'Step\s*Security') {
              Write-Host "::warning::Signer subject does not contain 'Step Security': $subject"
            }
            if (-not $sig.TimeStamperCertificate) {
              Write-Host "::error::No timestamp on $f — Authenticode signature will expire with the cert"
              $failed = $true
            }
          }
          if ($failed) { exit 1 }

      - name: Build MSIs from signed exes (x64 + arm64)
        id: msi
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $version = "${{ needs.build.outputs.version }}"

          wix build packaging/windows/Product.wxs `
            -arch x64 `
            -ext WixToolset.Util.wixext `
            -d Arch=x64 `
            -d "Version=$version" `
            -d "BinaryPath=${{ steps.paths.outputs.amd64 }}" `
            -d "LauncherPath=${{ steps.paths.outputs.task_amd64 }}" `
            -out "dist/stepsecurity-dev-machine-guard-$version-x64.msi"

          wix build packaging/windows/Product.wxs `
            -arch arm64 `
            -ext WixToolset.Util.wixext `
            -d Arch=arm64 `
            -d "Version=$version" `
            -d "BinaryPath=${{ steps.paths.outputs.arm64 }}" `
            -d "LauncherPath=${{ steps.paths.outputs.task_arm64 }}" `
            -out "dist/stepsecurity-dev-machine-guard-$version-arm64.msi"

          # trusted-signing-action v2 requires absolute (rooted) paths in `files:`.
          # Resolve to .FullName here so both the sign and verify steps below use
          # the same rooted path.
          $x64   = (Get-Item "dist/stepsecurity-dev-machine-guard-$version-x64.msi").FullName
          $arm64 = (Get-Item "dist/stepsecurity-dev-machine-guard-$version-arm64.msi").FullName
          "x64=$x64"     | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          "arm64=$arm64" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8

          Get-ChildItem dist -Filter "*.msi" | Format-Table Name, Length

      - name: Authenticode-sign MSIs
        uses: Azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
        with:
          endpoint: ${{ secrets.AZURE_TS_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_TS_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_TS_CERT_PROFILE_NAME }}
          files: |
            ${{ steps.msi.outputs.x64 }}
            ${{ steps.msi.outputs.arm64 }}
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Verify MSI signatures
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $version = "${{ needs.build.outputs.version }}"
          $failed = $false
          foreach ($msi in @(
            "dist/stepsecurity-dev-machine-guard-$version-x64.msi",
            "dist/stepsecurity-dev-machine-guard-$version-arm64.msi"
          )) {
            $sig = Get-AuthenticodeSignature $msi
            $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '<none>' }
            $timeSubject = if ($sig.TimeStamperCertificate) { $sig.TimeStamperCertificate.Subject } else { '<none>' }
            Write-Host "$(Split-Path $msi -Leaf):"
            Write-Host "  Status:      $($sig.Status)"
            Write-Host "  Signer:      $subject"
            Write-Host "  Timestamper: $timeSubject"
            if ($sig.Status -ne 'Valid') {
              Write-Host "::error::MSI signature status is $($sig.Status) (expected Valid)"
              $failed = $true
            }
            if (-not $sig.TimeStamperCertificate) {
              Write-Host "::error::No timestamp on $msi"
              $failed = $true
            }
          }
          if ($failed) { exit 1 }

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sigstore-sign one signed .exe and one signed .msi (smoke test)
        shell: bash
        run: |
          set -euo pipefail
          version="${{ needs.build.outputs.version }}"
          exe="dist/stepsecurity-dev-machine-guard-${version}-windows_amd64.exe"
          msi="dist/stepsecurity-dev-machine-guard-${version}-x64.msi"

          # Resolved path may differ from the staging copy; fall back to a find
          # if the literal path is missing.
          if [ ! -f "$exe" ]; then
            exe=$(find dist -type f -name "stepsecurity-dev-machine-guard-${version}-windows_amd64.exe" | head -1)
          fi
          test -f "$exe" || { echo "::error::Signed amd64 exe not found"; exit 1; }
          test -f "$msi" || { echo "::error::Signed x64 MSI not found"; exit 1; }

          cosign sign-blob "$exe" --bundle "${exe}.bundle" --yes
          cosign sign-blob "$msi" --bundle "${msi}.bundle" --yes

          test -s "${exe}.bundle" || { echo "::error::Empty cosign bundle for $exe"; exit 1; }
          test -s "${msi}.bundle" || { echo "::error::Empty cosign bundle for $msi"; exit 1; }
          echo "cosign bundles produced for post-Authenticode bytes."

      - name: Upload signed artifacts for inspection
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: signed-artifacts
          path: |
            dist/stepsecurity-dev-machine-guard-*-windows_amd64.exe
            dist/stepsecurity-dev-machine-guard-*-windows_arm64.exe
            dist/stepsecurity-dev-machine-guard-task-*-windows_amd64.exe
            dist/stepsecurity-dev-machine-guard-task-*-windows_arm64.exe
            dist/stepsecurity-dev-machine-guard-*-x64.msi
            dist/stepsecurity-dev-machine-guard-*-arm64.msi
            dist/*.bundle
          if-no-files-found: error