Skip to content

Commit 7aaddb8

Browse files
opencode-agent[bot]opencode-agent[bot]
committed
Apply PR #15201: feat(ci): sign Windows CLI and desktop builds
2 parents 30b1016 + 9fd0275 commit 7aaddb8

File tree

11 files changed

+287
-61
lines changed

11 files changed

+287
-61
lines changed

‎.github/actions/windows-trusted-signing/action.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: "Azure Artifact Signing"
2+
description: "Set up Azure Trusted Signing and optionally sign Windows binaries"
3+
inputs:
4+
azure-client-id:
5+
description: "Azure client ID for OIDC login"
6+
required: true
7+
azure-tenant-id:
8+
description: "Azure tenant ID for OIDC login"
9+
required: true
10+
azure-subscription-id:
11+
description: "Azure subscription ID for OIDC login"
12+
required: true
13+
trusted-signing-account-name:
14+
description: "Azure Trusted Signing account name"
15+
required: true
16+
trusted-signing-certificate-profile:
17+
description: "Azure Trusted Signing certificate profile"
18+
required: true
19+
trusted-signing-endpoint:
20+
description: "Azure Trusted Signing endpoint"
21+
required: true
22+
files:
23+
description: "Optional newline-delimited list of files to sign and verify"
24+
required: false
25+
default: ""
26+
runs:
27+
using: "composite"
28+
steps:
29+
- uses: actions/setup-dotnet@v4
30+
with:
31+
dotnet-version: "10.0.x"
32+
33+
- name: Install sign tool
34+
shell: pwsh
35+
run: |
36+
dotnet tool install --tool-path "$env:RUNNER_TEMP\sign" --prerelease sign
37+
"$env:RUNNER_TEMP\sign" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
38+
39+
- uses: azure/login@v2
40+
with:
41+
client-id: ${{ inputs.azure-client-id }}
42+
tenant-id: ${{ inputs.azure-tenant-id }}
43+
subscription-id: ${{ inputs.azure-subscription-id }}
44+
45+
- name: Export Trusted Signing environment
46+
shell: pwsh
47+
run: |
48+
"AZURE_TRUSTED_SIGNING_ACCOUNT_NAME=${{ inputs.trusted-signing-account-name }}" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
49+
"AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE=${{ inputs.trusted-signing-certificate-profile }}" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
50+
"AZURE_TRUSTED_SIGNING_ENDPOINT=${{ inputs.trusted-signing-endpoint }}" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
51+
52+
- name: Sign files
53+
if: inputs.files != ''
54+
shell: pwsh
55+
env:
56+
INPUT_FILES: ${{ inputs.files }}
57+
run: |
58+
$files = $env:INPUT_FILES -split "`r?`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ }
59+
& ./script/sign-windows.ps1 @files
60+
61+
- name: Verify signatures
62+
if: inputs.files != ''
63+
shell: pwsh
64+
env:
65+
INPUT_FILES: ${{ inputs.files }}
66+
run: |
67+
$files = $env:INPUT_FILES -split "`r?`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ }
68+
foreach ($file in $files) {
69+
$sig = Get-AuthenticodeSignature $file
70+
if ($sig.Status -ne "Valid") {
71+
throw "Invalid signature for ${file}: $($sig.Status)"
72+
}
73+
}

‎.github/workflows/publish.yml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,9 +102,73 @@ jobs:
102102
outputs:
103103
version: ${{ needs.version.outputs.version }}
104104

105+
sign-cli-windows:
106+
needs:
107+
- build-cli
108+
- version
109+
runs-on: blacksmith-4vcpu-windows-2025
110+
if: github.repository == 'anomalyco/opencode'
111+
steps:
112+
- uses: actions/checkout@v3
113+
114+
- uses: actions/download-artifact@v4
115+
with:
116+
name: opencode-cli
117+
path: packages/opencode/dist
118+
119+
- name: Setup git committer
120+
id: committer
121+
uses: ./.github/actions/setup-git-committer
122+
with:
123+
opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
124+
opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
125+
126+
- uses: ./.github/actions/windows-trusted-signing
127+
with:
128+
azure-client-id: ${{ vars.AZURE_CLIENT_ID || secrets.AZURE_CLIENT_ID }}
129+
azure-tenant-id: ${{ vars.AZURE_TENANT_ID || secrets.AZURE_TENANT_ID }}
130+
azure-subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID || secrets.AZURE_SUBSCRIPTION_ID }}
131+
trusted-signing-account-name: ${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME || secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
132+
trusted-signing-certificate-profile: ${{ vars.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE || secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}
133+
trusted-signing-endpoint: ${{ vars.AZURE_TRUSTED_SIGNING_ENDPOINT || secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
134+
files: |
135+
${{ github.workspace }}\packages\opencode\dist\opencode-windows-arm64\bin\opencode.exe
136+
${{ github.workspace }}\packages\opencode\dist\opencode-windows-x64\bin\opencode.exe
137+
${{ github.workspace }}\packages\opencode\dist\opencode-windows-x64-baseline\bin\opencode.exe
138+
139+
- name: Repack Windows CLI archives
140+
working-directory: packages/opencode/dist
141+
shell: pwsh
142+
run: |
143+
Compress-Archive -Path "opencode-windows-arm64\bin\*" -DestinationPath "opencode-windows-arm64.zip" -Force
144+
Compress-Archive -Path "opencode-windows-x64\bin\*" -DestinationPath "opencode-windows-x64.zip" -Force
145+
Compress-Archive -Path "opencode-windows-x64-baseline\bin\*" -DestinationPath "opencode-windows-x64-baseline.zip" -Force
146+
147+
- name: Upload signed Windows CLI release assets
148+
if: needs.version.outputs.release != ''
149+
shell: pwsh
150+
env:
151+
GH_TOKEN: ${{ steps.committer.outputs.token }}
152+
run: |
153+
gh release upload "v${{ needs.version.outputs.version }}" `
154+
"${{ github.workspace }}\packages\opencode\dist\opencode-windows-arm64.zip" `
155+
"${{ github.workspace }}\packages\opencode\dist\opencode-windows-x64.zip" `
156+
"${{ github.workspace }}\packages\opencode\dist\opencode-windows-x64-baseline.zip" `
157+
--clobber `
158+
--repo "${{ needs.version.outputs.repo }}"
159+
160+
- uses: actions/upload-artifact@v4
161+
with:
162+
name: opencode-cli-signed-windows
163+
path: |
164+
packages/opencode/dist/opencode-windows-arm64
165+
packages/opencode/dist/opencode-windows-x64
166+
packages/opencode/dist/opencode-windows-x64-baseline
167+
105168
build-tauri:
106169
needs:
107170
- build-cli
171+
- sign-cli-windows
108172
- version
109173
continue-on-error: false
110174
strategy:
@@ -152,6 +216,16 @@ jobs:
152216
153217
- uses: ./.github/actions/setup-bun
154218

219+
- uses: ./.github/actions/windows-trusted-signing
220+
if: runner.os == 'Windows'
221+
with:
222+
azure-client-id: ${{ vars.AZURE_CLIENT_ID || secrets.AZURE_CLIENT_ID }}
223+
azure-tenant-id: ${{ vars.AZURE_TENANT_ID || secrets.AZURE_TENANT_ID }}
224+
azure-subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID || secrets.AZURE_SUBSCRIPTION_ID }}
225+
trusted-signing-account-name: ${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME || secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
226+
trusted-signing-certificate-profile: ${{ vars.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE || secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}
227+
trusted-signing-endpoint: ${{ vars.AZURE_TRUSTED_SIGNING_ENDPOINT || secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
228+
155229
- uses: actions/setup-node@v4
156230
with:
157231
node-version: "24"
@@ -190,6 +264,7 @@ jobs:
190264
env:
191265
OPENCODE_VERSION: ${{ needs.version.outputs.version }}
192266
GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
267+
OPENCODE_CLI_ARTIFACT: ${{ (runner.os == 'Windows' && 'opencode-cli-signed-windows') || 'opencode-cli' }}
193268
RUST_TARGET: ${{ matrix.settings.target }}
194269
GH_TOKEN: ${{ github.token }}
195270
GITHUB_RUN_ID: ${{ github.run_id }}
@@ -246,9 +321,27 @@ jobs:
246321
APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
247322
APPLE_API_KEY_PATH: ${{ runner.temp }}/apple-api-key.p8
248323

324+
- name: Verify signed Windows desktop artifacts
325+
if: runner.os == 'Windows'
326+
shell: pwsh
327+
run: |
328+
$files = @(
329+
"${{ github.workspace }}\packages\desktop\src-tauri\sidecars\opencode-cli-${{ matrix.settings.target }}.exe",
330+
"${{ github.workspace }}\packages\desktop\src-tauri\target\${{ matrix.settings.target }}\release\OpenCode.exe"
331+
)
332+
$files += Get-ChildItem "${{ github.workspace }}\packages\desktop\src-tauri\target\${{ matrix.settings.target }}\release\bundle\nsis\*.exe" | Select-Object -ExpandProperty FullName
333+
334+
foreach ($file in $files) {
335+
$sig = Get-AuthenticodeSignature $file
336+
if ($sig.Status -ne "Valid") {
337+
throw "Invalid signature for ${file}: $($sig.Status)"
338+
}
339+
}
340+
249341
build-electron:
250342
needs:
251343
- build-cli
344+
- sign-cli-windows
252345
- version
253346
continue-on-error: false
254347
strategy:
@@ -292,6 +385,16 @@ jobs:
292385

293386
- uses: ./.github/actions/setup-bun
294387

388+
- uses: ./.github/actions/windows-trusted-signing
389+
if: runner.os == 'Windows'
390+
with:
391+
azure-client-id: ${{ vars.AZURE_CLIENT_ID || secrets.AZURE_CLIENT_ID }}
392+
azure-tenant-id: ${{ vars.AZURE_TENANT_ID || secrets.AZURE_TENANT_ID }}
393+
azure-subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID || secrets.AZURE_SUBSCRIPTION_ID }}
394+
trusted-signing-account-name: ${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME || secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
395+
trusted-signing-certificate-profile: ${{ vars.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE || secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}
396+
trusted-signing-endpoint: ${{ vars.AZURE_TRUSTED_SIGNING_ENDPOINT || secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
397+
295398
- uses: actions/setup-node@v4
296399
with:
297400
node-version: "24"
@@ -326,6 +429,7 @@ jobs:
326429
env:
327430
OPENCODE_VERSION: ${{ needs.version.outputs.version }}
328431
OPENCODE_CHANNEL: ${{ (github.ref_name == 'beta' && 'beta') || 'prod' }}
432+
OPENCODE_CLI_ARTIFACT: ${{ (runner.os == 'Windows' && 'opencode-cli-signed-windows') || 'opencode-cli' }}
329433
RUST_TARGET: ${{ matrix.settings.target }}
330434
GH_TOKEN: ${{ github.token }}
331435
GITHUB_RUN_ID: ${{ github.run_id }}
@@ -358,6 +462,21 @@ jobs:
358462
env:
359463
OPENCODE_CHANNEL: ${{ (github.ref_name == 'beta' && 'beta') || 'prod' }}
360464

465+
- name: Verify signed Windows Electron artifacts
466+
if: runner.os == 'Windows'
467+
shell: pwsh
468+
run: |
469+
$files = @()
470+
$files += Get-ChildItem "${{ github.workspace }}\packages\desktop-electron\dist\*.exe" | Select-Object -ExpandProperty FullName
471+
$files += Get-ChildItem "${{ github.workspace }}\packages\desktop-electron\dist\*unpacked\*.exe" | Select-Object -ExpandProperty FullName
472+
473+
foreach ($file in $files | Select-Object -Unique) {
474+
$sig = Get-AuthenticodeSignature $file
475+
if ($sig.Status -ne "Valid") {
476+
throw "Invalid signature for ${file}: $($sig.Status)"
477+
}
478+
}
479+
361480
- uses: actions/upload-artifact@v4
362481
with:
363482
name: opencode-electron-${{ matrix.settings.target }}
@@ -373,6 +492,7 @@ jobs:
373492
needs:
374493
- version
375494
- build-cli
495+
- sign-cli-windows
376496
- build-tauri
377497
- build-electron
378498
runs-on: blacksmith-4vcpu-ubuntu-2404
@@ -411,6 +531,11 @@ jobs:
411531
name: opencode-cli
412532
path: packages/opencode/dist
413533

534+
- uses: actions/download-artifact@v4
535+
with:
536+
name: opencode-cli-signed-windows
537+
path: packages/opencode/dist
538+
414539
- uses: actions/download-artifact@v4
415540
if: needs.version.outputs.release
416541
with:

‎.github/workflows/sign-cli.yml‎

Lines changed: 0 additions & 54 deletions
This file was deleted.

‎.signpath/policies/opencode/test-signing.yml‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎packages/desktop-electron/electron-builder.config.ts‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,24 @@
1+
import { execFile } from "node:child_process"
2+
import path from "node:path"
3+
import { fileURLToPath } from "node:url"
4+
import { promisify } from "node:util"
5+
16
import type { Configuration } from "electron-builder"
27

8+
const execFileAsync = promisify(execFile)
9+
const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..")
10+
const signScript = path.join(rootDir, "script", "sign-windows.ps1")
11+
12+
async function signWindows(configuration: { path: string }) {
13+
if (process.platform !== "win32") return
14+
15+
await execFileAsync(
16+
"pwsh",
17+
["-NoLogo", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", signScript, configuration.path],
18+
{ cwd: rootDir },
19+
)
20+
}
21+
322
const channel = (() => {
423
const raw = process.env.OPENCODE_CHANNEL
524
if (raw === "dev" || raw === "beta" || raw === "prod") return raw
@@ -44,6 +63,9 @@ const getBase = (): Configuration => ({
4463
},
4564
win: {
4665
icon: `resources/icons/icon.ico`,
66+
signtoolOptions: {
67+
sign: signWindows,
68+
},
4769
target: ["nsis"],
4870
},
4971
nsis: {

‎packages/desktop-electron/scripts/prepare.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,12 @@ await Bun.write("./package.json", JSON.stringify(pkg, null, 2) + "\n")
1313
console.log(`Updated package.json version to ${Script.version}`)
1414

1515
const sidecarConfig = getCurrentSidecar()
16+
const artifact = Bun.env.OPENCODE_CLI_ARTIFACT ?? "opencode-cli"
1617

1718
const dir = "resources/opencode-binaries"
1819

1920
await $`mkdir -p ${dir}`
20-
await $`gh run download ${Bun.env.GITHUB_RUN_ID} -n opencode-cli`.cwd(dir)
21+
await $`gh run download ${Bun.env.GITHUB_RUN_ID} -n ${artifact}`.cwd(dir)
2122

2223
await copyBinaryToSidecarFolder(windowsify(`${dir}/${sidecarConfig.ocBinary}/bin/opencode`))
2324

‎packages/desktop/scripts/prepare.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,11 @@ await Bun.write("./package.json", JSON.stringify(pkg, null, 2) + "\n")
1010
console.log(`Updated package.json version to ${Script.version}`)
1111

1212
const sidecarConfig = getCurrentSidecar()
13+
const artifact = Bun.env.OPENCODE_CLI_ARTIFACT ?? "opencode-cli"
1314

1415
const dir = "src-tauri/target/opencode-binaries"
1516

1617
await $`mkdir -p ${dir}`
17-
await $`gh run download ${Bun.env.GITHUB_RUN_ID} -n opencode-cli`.cwd(dir)
18+
await $`gh run download ${Bun.env.GITHUB_RUN_ID} -n ${artifact}`.cwd(dir)
1819

1920
await copyBinaryToSidecarFolder(windowsify(`${dir}/${sidecarConfig.ocBinary}/bin/opencode`))

0 commit comments

Comments
 (0)