Migrate Windows code signing from client secret to OIDC#12911
Merged
Conversation
![github-advanced-security[bot]](proxy.php?url=https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
BagToad
force-pushed
the
kw/deployment-oidc
branch
from
00d79d2 to
bd12a06
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Migrates Windows release code signing in the deployment workflow from client-secret auth to OIDC-based authentication using azure/login@v2, aligning with the Trusted Signing/DefaultAzureCredential flow and removing long-lived secrets from the workflow.
Changes:
- Add
azure/login@v2(production-only) to establish an Azure auth session for code signing via OIDC. - Remove
AZURE_CLIENT_SECRETfrom Windows.exe(GoReleaser) and.msisigning environments. - Keep
AZURE_CLIENT_ID/AZURE_TENANT_IDenvironment variables for identity selection.
Comments suppressed due to low confidence (1)
.github/workflows/deployment.yml:226
azure/login@v2only runs forproduction, but the GoReleaser build step still setsDLIB_PATH/METADATA_PATHunconditionally. Since.goreleaser.ymlalways runspwsh .\script\sign.ps1as a post-hook for Windows builds, staging runs will still attempt to code-sign but won’t have an authenticated Azure session (and may also not have these environment-scoped secrets), which is likely to fail the build. Consider only settingDLIB_PATH/METADATA_PATH(and Azure env vars, if only needed for signing) wheninputs.environment == 'production', soscript/sign.ps1reliably skips signing outside production, or alternatively runazure/loginfor all environments where signing is expected to occur.
- name: Authenticate to Azure for code signing
if: inputs.environment == 'production'
uses: azure/login@v2
with:
client-id: ${{ secrets.SPN_GITHUB_CLI_SIGNING_CLIENT_ID }}
tenant-id: ${{ secrets.SPN_GITHUB_CLI_SIGNING_TENANT_ID }}
allow-no-subscriptions: true
# Azure Code Signing authenticates via OIDC (azure/login above). AZURE_CLIENT_ID and AZURE_TENANT_ID
# are still passed so DefaultAzureCredential can identify the service principal.
- name: Build release binaries
shell: bash
env:
AZURE_CLIENT_ID: ${{ secrets.SPN_GITHUB_CLI_SIGNING_CLIENT_ID }}
AZURE_TENANT_ID: ${{ secrets.SPN_GITHUB_CLI_SIGNING_TENANT_ID }}
DLIB_PATH: ${{ runner.temp }}\acs\bin\x64\Azure.CodeSigning.Dlib.dll
METADATA_PATH: ${{ runner.temp }}\acs\metadata.json
TAG_NAME: ${{ inputs.tag_name }}
run: script/release --local "$TAG_NAME" --platform windows
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
babakks
approved these changes
Mar 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces
AZURE_CLIENT_SECRET-based authentication for Windows code signing with OIDC federated identity credentials viaazure/login@v2.Changes
azure/login@v2step before signing (production only) to establish OIDC sessionAZURE_CLIENT_SECRETfrom both the .exe signing (GoReleaser) and .msi signing stepsAZURE_CLIENT_IDandAZURE_TENANT_IDenv vars forDefaultAzureCredentialidentificationPre-requisites completed
cli/cli(repository_owner_id,repository_id,context)id-token: writepermission already present at workflow levelCompanion work
Modeled after desktop's identical migration: desktop/desktop#21786
Notes for reviewer
Please see the successful test run using this workflow: https://github.com/cli/cli/actions/runs/22981502108/job/66722159067