KofTwentyTwo/standards
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

fix(releases): Artifact Signing dependency conflicts with NuGet source mapping #43

New Issue
Closed
opened 2026-10-12 20:49:14 +00:00 by KofTwentyTwo · 0 comments
KofTwentyTwo commented 2026-10-12 20:49:14 +00:00 (Migrated from github.com)
Copy link
Copy source

The protected MarkdownViewr dev release reaches Azure through OIDC, then the official Artifact Signing v2 action fails installing its pinned Sign CLI because dotnet tool install --add-source cannot be combined with the caller NuGet.Config package source mapping.

Keep the caller package source policy intact. Prestage the exact official action dependency from nuget.org with a pinned SHA256 and NuGet signature verification; retain official action signing, publisher checks and final distributed-byte verification.

Evidence: https://github.com/KofTwentyTwo/MarkdownViewr.Windows/actions/runs/38299469062
Local reproduction matches the hosted error; real verified-package bootstrap succeeds. Regression boundaries cover changed downloads, invalid signatures, existing directories and missing executables.

The protected MarkdownViewr dev release reaches Azure through OIDC, then the official Artifact Signing v2 action fails installing its pinned Sign CLI because `dotnet tool install --add-source` cannot be combined with the caller NuGet.Config package source mapping. Keep the caller package source policy intact. Prestage the exact official action dependency from nuget.org with a pinned SHA256 and NuGet signature verification; retain official action signing, publisher checks and final distributed-byte verification. Evidence: https://github.com/KofTwentyTwo/MarkdownViewr.Windows/actions/runs/38299469062 Local reproduction matches the hosted error; real verified-package bootstrap succeeds. Regression boundaries cover changed downloads, invalid signatures, existing directories and missing executables.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 autorelease: failed
Reserved version tag; no published release
 autorelease: pending
autorelease: tagged
breaking
Incompatible new mandatory standards; requires a MAJOR release
 bug
Something isn't working
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 release: failed
Reserved release tag failed before public publication; preserved for audit.
 release: ready
Maintainer-approved release preflight
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#43