From 69e155fd4900762268eae21f9aee03b20436dd58 Mon Sep 17 00:00:00 2001 From: Olha Kramarenko Date: Mon, 13 Jul 2026 17:38:55 +0300 Subject: [PATCH 1/4] draft signing to retrieve a public signature --- .github/workflows/config.yml | 45 +++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 21 deletions(-) diff --git a/.github/workflows/config.yml b/.github/workflows/config.yml index ca2ad932b..1af6d5723 100644 --- a/.github/workflows/config.yml +++ b/.github/workflows/config.yml @@ -15,6 +15,9 @@ env: LICENSE_KEY: ${{ secrets.LICENSE_KEY }} SQL_USER_PASSWORD: ${{ secrets.SQL_USER_PASSWORD }} S2MS_API_KEY: ${{ secrets.S2MS_API_KEY }} + AZURE_TRUSTED_SIGNING_ACCOUNT: SingleStore + AZURE_TRUSTED_SIGNING_PROFILE: ConnectorsReleaseProfile + AZURE_TRUSTED_SIGNING_ENDPOINT: https://eus.codesigning.azure.net/ jobs: fetch-s2-versions: @@ -212,6 +215,18 @@ jobs: name: efcore-provider path: efcore_provider/ + # Authenticate to Azure via OIDC (using your App Registration) + - name: Azure Login + uses: azure/login@v2 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Install Microsoft's unified Sign tool + - name: Install .NET Sign CLI Tool + run: dotnet tool install -g --prerelease sign + # Get a short-lived NuGet API key - name: NuGet login (OIDC → temp API key) uses: NuGet/login@v1 @@ -219,25 +234,13 @@ jobs: with: user: ${{ secrets.NUGET_USER }} - # Push the package - - name: NuGet push - run: > - dotnet nuget push "efcore_provider/*.nupkg" - --api-key ${{steps.login.outputs.NUGET_API_KEY}} - --source https://api.nuget.org/v3/index.json + # Sign the .nupkg file directly + - name: Sign NuGet Package with Artifact Signing + run: | + sign code artifact-signing ` + --artifact-signing-endpoint "${{ env.AZURE_TRUSTED_SIGNING_ENDPOINT }}" ` + --artifact-signing-account "${{ env.AZURE_TRUSTED_SIGNING_ACCOUNT }}" ` + --artifact-signing-certificate-profile "${{ env.AZURE_TRUSTED_SIGNING_PROFILE }}" ` + --timestamp-url "http://timestamp.acs.microsoft.com" ` + "efcore_provider/*.nupkg" - - name: Create draft GitHub Release - uses: softprops/action-gh-release@v2 - with: - name: Release ${{ github.ref_name }} - body: | - ## EntityFrameworkCore.SingleStore ${{ github.ref_name }} - - This is a draft release for EntityFrameworkCore.SingleStore. - - Please review and complete the release notes before publishing this GitHub Release. - draft: true - prerelease: false - generate_release_notes: true - files: | - efcore_provider/*.nupkg From c207184c7267e3379f51f1c693029648fb42eb0c Mon Sep 17 00:00:00 2001 From: Olha Kramarenko Date: Mon, 13 Jul 2026 17:41:35 +0300 Subject: [PATCH 2/4] changes for publish to run --- .github/workflows/config.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/config.yml b/.github/workflows/config.yml index 1af6d5723..2b0058328 100644 --- a/.github/workflows/config.yml +++ b/.github/workflows/config.yml @@ -4,9 +4,6 @@ on: pull_request: types: [opened, synchronize, reopened] push: - branches: [master] - tags: - - 'v[0-9]*.[0-9]*.[0-9]*' workflow_call: workflow_dispatch: @@ -189,8 +186,6 @@ jobs: publish: runs-on: windows-latest - needs: [test-ubuntu, test-windows] - if: startsWith(github.ref, 'refs/tags/v') permissions: id-token: write contents: write From f5ca63b03782140953e8d14863c06db8afd6db32 Mon Sep 17 00:00:00 2001 From: Olha Kramarenko Date: Mon, 13 Jul 2026 18:19:40 +0300 Subject: [PATCH 3/4] change the order --- .github/workflows/config.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/config.yml b/.github/workflows/config.yml index 2b0058328..263c9979c 100644 --- a/.github/workflows/config.yml +++ b/.github/workflows/config.yml @@ -204,12 +204,6 @@ jobs: - name: Pack NuGet run: dotnet pack .\src\EFCore.SingleStore\EFCore.SingleStore.csproj -c Release -o efcore_provider - - name: Upload Artifact - uses: actions/upload-artifact@v4 - with: - name: efcore-provider - path: efcore_provider/ - # Authenticate to Azure via OIDC (using your App Registration) - name: Azure Login uses: azure/login@v2 @@ -239,3 +233,8 @@ jobs: --timestamp-url "http://timestamp.acs.microsoft.com" ` "efcore_provider/*.nupkg" + - name: Upload Artifact + uses: actions/upload-artifact@v4 + with: + name: efcore-provider + path: efcore_provider/ From 70ecbf9bb542fa6627edf590b7c4b597018b0548 Mon Sep 17 00:00:00 2001 From: Olha Kramarenko Date: Mon, 13 Jul 2026 18:38:04 +0300 Subject: [PATCH 4/4] get back to base settings --- .github/workflows/config.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.github/workflows/config.yml b/.github/workflows/config.yml index 263c9979c..50752350b 100644 --- a/.github/workflows/config.yml +++ b/.github/workflows/config.yml @@ -4,6 +4,9 @@ on: pull_request: types: [opened, synchronize, reopened] push: + branches: [master] + tags: + - 'v[0-9]*.[0-9]*.[0-9]*' workflow_call: workflow_dispatch: @@ -186,6 +189,8 @@ jobs: publish: runs-on: windows-latest + needs: [test-ubuntu, test-windows] + if: startsWith(github.ref, 'refs/tags/v') permissions: id-token: write contents: write @@ -238,3 +243,25 @@ jobs: with: name: efcore-provider path: efcore_provider/ + + - name: NuGet push + run: > + dotnet nuget push "efcore_provider/*.nupkg" + --api-key ${{steps.login.outputs.NUGET_API_KEY}} + --source https://api.nuget.org/v3/index.json + + - name: Create draft GitHub Release + uses: softprops/action-gh-release@v2 + with: + name: Release ${{ github.ref_name }} + body: | + ## EntityFrameworkCore.SingleStore ${{ github.ref_name }} + + This is a draft release for EntityFrameworkCore.SingleStore. + + Please review and complete the release notes before publishing this GitHub Release. + draft: true + prerelease: false + generate_release_notes: true + files: | + efcore_provider/*.nupkg