action.yml

name: "Windows sign action"
description: "Sign Windows installer using DigiCert One Signing Manager"

inputs:
  bin-path:
    description: "The path to the binary to sign"
    required: true
  sm-host:
    description: "The Signing Manager host"
    required: true
  sm-api-key:
    description: "The Signing Manager API key"
    required: true
  sm-client-cert-file-b64:
    description: "The client certificate file in base64"
    required: true
  sm-client-cert-password:
    description: "The client certificate password"
    required: true
  sm-code-signing-cert-sha1-hash:
    description: "The code signing certificate public SHA1 hash"
    required: true

runs:
  using: "composite"

  steps:
    - name: Setup signing certificate
      run: |
        echo "${{ inputs.sm-client-cert-file-b64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
      shell: bash

    - name: Set signing variables
      id: variables
      run: |
        echo "SM_HOST=${{ inputs.sm-host }}" >> "$GITHUB_ENV" 
        echo "SM_API_KEY=${{ inputs.sm-api-key }}" >> "$GITHUB_ENV" 
        echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV" 
        echo "SM_CLIENT_CERT_PASSWORD=${{ inputs.sm-client-cert-password }}" >> "$GITHUB_ENV"
        echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH 
        echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH 
        echo "C:\Program Files\DigiCert\DigiCert One Signing Manager Tools" >> $GITHUB_PATH
      shell: bash

    - name: Cache smtools
      id: cache-smtools
      uses: actions/cache@v3
      with:
        path: smtools-windows-x64.msi
        key: smtools-windows

    - name: Download smtools
      if: ${{ !steps.cache-smtools.cache-hit }}
      run: |
        echo cache hit: ${{ steps.cache-smtools.cache-hit }}
        curl ^
        -X GET https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download ^
        -H "x-api-key:${{ inputs.sm-api-key }}" ^
        -o smtools-windows-x64.msi
      shell: cmd

    - name: Setup SSM KSP for signing
      run: |
        msiexec /i smtools-windows-x64.msi /quiet /qn 
        smksp_registrar.exe list 
        smctl.exe keypair ls 
        C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user 
        smksp_cert_sync.exe
      shell: cmd

    - name: Signing using Signtool
      run: |
        signtool.exe sign `
        /sha1 ${{ inputs.sm-code-signing-cert-sha1-hash }} `
        /tr http://timestamp.digicert.com `
        /td SHA256 `
        /fd SHA256 `
        ${{ inputs.bin-path }}

        signtool.exe verify `
        /v `
        /pa `
        ${{ inputs.bin-path }}
      shell: powershell