[eric] release: retire unused exp.13 signing detour [skip ci]

2026-09-22 09:34:53 +02:00 · 2026-09-15 14:55:42 -07:00
parent c2abf33d9a
commit 44f3d62ac6
1 changed files with 0 additions and 80 deletions
@@ -1,80 +0,0 @@
-name: Sign locally built exp.13 Windows package
-
-on:
-  workflow_dispatch:
-    inputs:
-      payload_sha256:
-        description: SHA256 of the reviewed local Windows package
-        required: true
-        type: string
-      tools_sha256:
-        description: SHA256 of the reviewed signing scripts
-        required: true
-        type: string
-
-permissions:
-  contents: write
-
-concurrency:
-  group: exp13-windows-signing
-  cancel-in-progress: false
-
-jobs:
-  sign:
-    if: github.repository == 'openswarm-ai/openswarm'
-    runs-on: windows-latest
-    timeout-minutes: 45
-    env:
-      GH_TOKEN: ${{ github.token }}
-      EXPECTED_PAYLOAD_SHA: ${{ inputs.payload_sha256 }}
-      EXPECTED_TOOLS_SHA: ${{ inputs.tools_sha256 }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-      AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
-      AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
-      AZURE_SIGNING_CERT_PROFILE: ${{ secrets.AZURE_SIGNING_CERT_PROFILE }}
-      EVS_ACCOUNT_NAME: ${{ secrets.EVS_ACCOUNT_NAME }}
-      EVS_PASSWD: ${{ secrets.EVS_PASSWD }}
-    steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20.18.1
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.13'
-      - name: Verify and unpack the local build
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          if ($env:EXPECTED_PAYLOAD_SHA -notmatch '^[a-f0-9]{64}$' -or $env:EXPECTED_TOOLS_SHA -notmatch '^[a-f0-9]{64}$') { throw 'Invalid expected digest' }
-          $release = gh release view v1.7.10-exp.13 --repo openswarm-ai/openswarm --json isDraft | ConvertFrom-Json
-          if ($LASTEXITCODE -ne 0 -or -not $release.isDraft) { throw 'Expected unpublished exp.13 draft' }
-          New-Item -ItemType Directory incoming | Out-Null
-          gh release download v1.7.10-exp.13 --repo openswarm-ai/openswarm --pattern exp13-windows-unpacked.zip --pattern exp13-windows-signing-tools.zip --dir incoming
-          if ($LASTEXITCODE -ne 0) { throw 'Cannot download reviewed inputs' }
-          if ((Get-FileHash incoming/exp13-windows-unpacked.zip -Algorithm SHA256).Hash.ToLowerInvariant() -ne $env:EXPECTED_PAYLOAD_SHA) { throw 'Payload digest mismatch' }
-          if ((Get-FileHash incoming/exp13-windows-signing-tools.zip -Algorithm SHA256).Hash.ToLowerInvariant() -ne $env:EXPECTED_TOOLS_SHA) { throw 'Signing tools digest mismatch' }
-          Expand-Archive incoming/exp13-windows-unpacked.zip payload
-          Expand-Archive incoming/exp13-windows-signing-tools.zip signing
-      - name: Install pinned signing tools
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          python -m pip install castlabs-evs==1.3.2
-          if ($LASTEXITCODE -ne 0) { throw 'Cannot install Widevine signing tool' }
-          nuget install Microsoft.Trusted.Signing.Client -Version 1.0.60 -OutputDirectory trusted-signing -ExcludeVersion
-          if ($LASTEXITCODE -ne 0) { throw 'Cannot install Microsoft signing tool' }
-          $dlib = Join-Path $PWD 'trusted-signing/Microsoft.Trusted.Signing.Client/bin/x64/Azure.CodeSigning.Dlib.dll'
-          if (-not (Test-Path $dlib)) { throw 'Signing library missing' }
-          "AZURE_SIGNING_DLIB=$dlib" | Out-File $env:GITHUB_ENV -Append -Encoding utf8
-          $signtool = Get-ChildItem 'C:/Program Files (x86)/Windows Kits/10/bin' -Filter signtool.exe -Recurse | Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } | Sort-Object FullName -Descending | Select-Object -First 1
-          if (-not $signtool) { throw 'Windows SDK signing tool missing' }
-          "SIGNTOOL_PATH=$($signtool.FullName)" | Out-File $env:GITHUB_ENV -Append -Encoding utf8
-          Set-Location signing
-          npm ci --no-audit --no-fund
-          if ($LASTEXITCODE -ne 0) { throw 'Cannot install pinned packaging tools' }
-      - name: Sign, verify, package and upload to the existing draft
-        shell: pwsh
-        working-directory: signing
-        run: ./sign-package.ps1