test-certificate.yml

name: Test Windows Certificate 🧪

on:
  pull_request:
    types: [opened, synchronize, reopened, edited]

jobs:
  temp-windows:
    runs-on:
      labels: windows-latest

    steps:
      - name: Checkout Directory 🔖
        uses: actions/checkout@v4

      - name: Setup Certificate
        run: |
          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" > ./base64certificate.txt
          base64 --decode -i ./base64certificate.txt > /d/Certificate_pkcs12.p12
          cat /d/Certificate_pkcs12.p12
        shell: bash

      - name: Set variables
        id: variables
        run: |
          dir
          echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
          echo "::set-output name=KEYPAIR_NAME::gt-standard-keypair"
          echo "::set-output name=CERTIFICATE_NAME::gt-certificate"
          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
        shell: bash

      - name: Setup Keylocker KSP on windows
        run: |
          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi 
          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
          smksp_registrar.exe list 
          smctl.exe keypair ls 
          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
        shell: cmd

      - name: Certificates Sync
        run: |
          smctl windows certsync
        shell: cmd

      - name: Signing using Signtool
        run: |
          signtool.exe sign /debug /fd SHA256 /a /f /d/Certificate_pkcs12.p12 /p ${{ secrets.SM_CLIENT_CERT_PASSWORD }} /t http://timestamp.digicert.com "./target/wix/*.msi"

      - name: Verify signing
        run: signtool.exe verify /v /pa "./target/wix/*.msi"

      - name: Upload Executable ⬆️
        uses: actions/upload-artifact@v3
        with:
          name: Uplink-windows-test
          path: target/wix/*.msi