[DEVOPS-1333] Add code signing to the Windows bws CLI

[michalchecinski]

Type of change

- [ ] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [x] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Digitally sign Windows CLI .exe executable to prevent warning showing up on clients' computers while running bws commands.

Code changes

• .github/workflows/build-cli.yml:
  • split Windows and UNIX build jobs
  • add steps to windows build job to login to Azure, get secrets from KeyVault, install azuresigntool and use azuresigntool to sign windows CLI artifact.

Before you submit

• Please add unit tests where it makes sense to do so

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.40%. Comparing base (199851b) to head (a602d0e).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #534   +/-   ##
=======================================
  Coverage   59.40%   59.40%           
=======================================
  Files         171      171           
  Lines       10345    10345           
=======================================
  Hits         6145     6145           
  Misses       4200     4200           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[bitwarden-bot]

Checkmarx One – Scan Summary & Details – cbb94c53-a891-4622-a496-284fa6859b2d

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	Unpinned Actions Full Length Commit SHA	/build-cli.yml: 339	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
	Unpinned Actions Full Length Commit SHA	/build-cli.yml: 88	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
	Unpinned Actions Full Length Commit SHA	/build-cli.yml: 176	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...

Fixed Issues

Severity	Issue	Source File / Package
	Unpinned Actions Full Length Commit SHA	/build-cli.yml: 324
	Unpinned Actions Full Length Commit SHA	/build-cli.yml: 161
	Unpinned Actions Full Length Commit SHA	/build-cli.yml: 75

[Hinton]

Please ensure the secrets in the pipeline are optional by only requiring them if we're publishing or have the secrets set, this will ensure external PRs don't automatically fail.

I wonder if we could put the signing as a separate stage after the build which would avoid repeating the build command.

[michalchecinski]

@Hinton The build command is not repeated. I split the Unix and Windows build - the steps to sign macOS and Windows are different, so to make it clear, I made different build jobs for each system. I'll make signing steps run only on main/rc branches to ensure they will work for the external PRs.

Secrets are no longer required to build

[Hinton]

Thanks for excluding the secrets. I'm still slightly concern with the duplication of steps, since it's easy to miss modifying one of the places, but not a blocker.