dynamic-azure-codesign.yml

name: 'AzureSignTool & Dynamic Secret'
# Docs => https://docs.akeyless.io/docs/azure-ad-dynamic-secrets
# Using AzureSignTool https://learn.microsoft.com/en-us/windows/msix/desktop/cicd-keyvault

on:
  workflow_dispatch:
  push:
    branches:
      - aad-tests
    paths:
      - 'src/**/*'
      - '.github/workflows/dynamic-azure-codesign.yml'

jobs:
  code_sign:
    runs-on: windows-latest
    name: Code Signing
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Fetch static secret from AKeyless
        id: fetch-static-secrets
        uses: ./
        with:
          access-id: ${{ secrets.AKEYLESS_ACCESS_ID }}
          static-secrets: '{"/DevTools/my-static-secret":"my_static_secret"}'

      - name: Verify Static Secret Job Outputs
        run: echo "Your output secret is ${{ steps.fetch-static-secrets.outputs.my_static_secret }}"

      - name: Verify Static Secret Environment Variables
        run: echo "Your environment secret is ${{ env.my_static_secret }}"
      - name: Fetch dynamic secret from Akleyless
        id: fetch-secrets
        uses: ./
        with:
          access-id: ${{ secrets.AKEYLESS_ACCESS_ID }}
          dynamic-secrets: '{"/DevTools/live-azure-ad":"akelyess_payload"}'
          parse-dynamic-secrets: true

      - name: Check Outputs
        run: |
          echo 'ENTIRE OUTPUT'
          echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}'
          echo 'ID'
          echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.id'
          echo 'TTL_IN_MINUTES'
          echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.ttl_in_minutes'
          echo 'MSG'
          echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.msg'
          echo 'SECRET'
          echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret'
          # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret_appId'
          # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret_displayName'
          # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret_keyId'
          # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret_secretText'
          # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret_tenantId'

      - name: Check Environment Variables
        run: |
          echo 'ID'
          echo '${{ env.id }}'
          echo 'TTL_IN_MINUTES'
          echo '${{ env.ttl_in_minutes }}'
          echo 'MSG'
          echo '${{ env.msg }}'
          echo 'SECRET'
          echo '${{ env.secret }}'
          # echo '${{ env.secret_appId }}'
          # echo '${{ env.secret_displayName }}'
          # echo '${{ env.secret_keyId }}'
          # echo '${{ env.secret_secretText }}'
          # echo '${{ env.secret_tenantId }}'

    # - name: Read Secrets
    #   run: |
    #     echo 'ID'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.id'
    #     echo 'TTL_IN_MINUTES'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.ttl_in_minutes'
    #     echo 'MSG'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.msg'
    #     echo 'SECRET'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret.appId'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret.displayName'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret.keyId'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret.secretText'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq '.secret.tenantId'

    # - name: Read Secrets
    #   run: |
    #     echo 'ID'
    #     echo '${{ env.id }}'
    #     echo 'TTL_IN_MINUTES'
    #     echo '${{ env.ttl_in_minutes }}'
    #     echo 'MSG'
    #     echo '${{ env.msg }}'
    #     echo 'SECRET'
    #     echo '${{ env.secret }}'
    #     echo '${{ env.secret.appId }}'
    #     echo '${{ env.secret.displayName }}'
    #     echo '${{ env.secret.keyId }}'
    #     echo '${{ env.secret.secretText }}'
    #     echo '${{ env.secret.tenantId }}'

    # - name: Read Secrets
    #   run: |
    #     echo 'ID'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.id'
    #     echo 'TTL_IN_MINUTES'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.ttl_in_minutes'
    #     echo 'MSG'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.msg'
    #     echo 'SECRET'
    #     echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.secret'
    #     # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.secret.appId'
    #     # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.secret.displayName'
    #     # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.secret.keyId'
    #     # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.secret.secretText'
    #     # echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.secret.tenantId'

    # - name: Download File to Sign
    #   run: Invoke-WebRequest "https://dvlup.blob.core.windows.net/general-app-files/MSIs/MicrosoftStoreServicesSDK.msi" -OutFile '${{ github.workspace }}\MicrosoftStoreServicesSDK.msi'

    # - name: Install AzureSignTool
    #   id: install-signtool
    #   run: dotnet tool install --global AzureSignTool

    # - name: Sign File
    #   id: use-signtool
    #   run: |
    #     azuresigntool sign -kvu "${{ secrets.AZURE_KEY_VAULT_URI }}" -kvi "${{ secrets.AZURE_CLIENT_ID }}" -kvt "${{ secrets.AZURE_TENANT_ID }}"-kvs "${{ secrets.AZURE_CLIENT_SECRET }}" -kvc ${{ secrets.AZURE_CERT_NAME }} -tr http://timestamp.digicert.com -v '${{ github.workspace }}\MicrosoftStoreServicesSDK.msi'