fix(releases): bootstrap verified Artifact Signing dependency #44

2026-10-12T20:49:45Z

KofTwentyTwo commented

2026-10-12 20:49:45 +00:00

(Migrated from github.com)

The MarkdownViewr dev release reaches Azure OIDC successfully but the official Artifact Signing action fails bootstrapping its pinned Sign CLI: --add-source is incompatible with the caller's NuGet package source mapping.

Prestage the exact action dependency from nuget.org with a fixed SHA256 and dotnet nuget verify --all. The official action then finds the genuine package in its normal dependency directory. Caller NuGet policy, OIDC trust, signing inputs, ownership catalog and final signature/distributed-byte gates stay intact. Existing dependency directories are preserved and rejected rather than replaced.

Fixes #43.

Validation: reproduced the hosted error locally; executed the actual new workflow step with Microsoft's real signed package and launched its CLI; all 40 signing regression tests pass (zero skips); full configured PowerShell analysis, actionlint and zizmor pass. Five added tests cover valid staging, changed download, invalid signature, existing directory and missing executable. No production signing or publication claimed yet.

Substantial AI assistance: implemented with Codex GPT-6. Maintainer review required by K22-AI-01 before merge.

The MarkdownViewr dev release reaches Azure OIDC successfully but the official Artifact Signing action fails bootstrapping its pinned Sign CLI: `--add-source` is incompatible with the caller's NuGet package source mapping. Prestage the exact action dependency from nuget.org with a fixed SHA256 and `dotnet nuget verify --all`. The official action then finds the genuine package in its normal dependency directory. Caller NuGet policy, OIDC trust, signing inputs, ownership catalog and final signature/distributed-byte gates stay intact. Existing dependency directories are preserved and rejected rather than replaced. Fixes #43. Validation: reproduced the hosted error locally; executed the actual new workflow step with Microsoft's real signed package and launched its CLI; all 40 signing regression tests pass (zero skips); full configured PowerShell analysis, actionlint and zizmor pass. Five added tests cover valid staging, changed download, invalid signature, existing directory and missing executable. No production signing or publication claimed yet. Substantial AI assistance: implemented with Codex GPT-6. Maintainer review required by K22-AI-01 before merge.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#44