You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
if ([string]::IsNullOrWhiteSpace($identityValidationId)) {
84
+
throw "AUTO_CREATE_CERT_PROFILE=true but Key Vault secret 'artifactSigningIdentityValidationId' is empty. Complete identity validation in the portal and set that secret."
85
+
}
105
86
106
87
$subId = (az account show --query id -o tsv)
107
88
if ([string]::IsNullOrWhiteSpace($subId)) { throw "Unable to determine subscription id from Azure CLI context." }
az rest --method put --url $profileUrl --body $body --only-show-errors | Out-Null
115
+
if ($LASTEXITCODE -ne 0) { throw "Failed to create certificate profile via ARM. Ensure the GitHub identity has RG Contributor (or equivalent) permissions." }
-[Quickstart: Set up Artifact Signing](https://learn.microsoft.com/en-us/azure/artifact-signing/quickstart?tabs=registerrp-portal%2Caccount-portal%2Corgvalidation%2Ccertificateprofile-portal%2Cdeleteresources-portal)
24
+
-[Set up signing integrations to use Artifact Signing](https://learn.microsoft.com/en-us/azure/artifact-signing/how-to-signing-integrations)
25
+
-[Microsoft Included CA Certificate List](https://ccadb.my.salesforce-sites.com/microsoft/IncludedCACertificateReportForMSFT)
- Key Vault (RBAC-enabled) for pipeline variables/secrets (created by default)
49
-
- Certificate profile (`.../certificateProfiles`)
50
-
- Preferred: created by the GitHub Actions workflow after you set the Key Vault secret `artifactSigningIdentityValidationId` (no second `terraform apply`)
51
-
- Optional: created by Terraform if you set `identity_validation_id` and re-apply
53
+
54
+
Certificate profile + identity validation are created in the Azure Portal (service requirement).
55
+
56
+
Optional advanced paths:
57
+
- Terraform can create the certificate profile if you set `identity_validation_id` and re-run `terraform apply`.
58
+
- The GitHub Actions workflow can create it if you opt in via `AUTO_CREATE_CERT_PROFILE: 'true'` in the workflow (requires broader RBAC such as RG `Contributor`).
52
59
53
60
When `github_enabled = true`, Terraform also creates:
54
61
- Entra app registration + service principal for GitHub Actions (OIDC)
@@ -60,113 +67,116 @@ From [What is Artifact Signing?](https://learn.microsoft.com/en-us/azure/artifac
60
67
61
68
> [!NOTE]
62
69
> -**Identity validation** itself is **portal-only** (service requirement). Terraform can’t complete that workflow.
63
-
> - After you complete it, set Key Vault secret `artifactSigningIdentityValidationId` and the GitHub Actions workflow will create the certificate profile automatically.
70
+
> - The **Identity validation Id** is not exposed via the Azure management API for the code signing account, so Terraform cannot “wait and fetch” it automatically.
71
+
> - Identity validation + certificate profile creation can be done entirely in the portal.
72
+
> - If you want Terraform (or the workflow) to create the certificate profile, you must copy the Identity validation Id from the portal.
64
73
65
74
## Deploy with Terraform
66
75
67
76
Terraform files live in `terraform-infrastructure/`.
68
77
78
+
If you're using GitHub Actions, prefer the fully automated bootstrap path below (it configures GitHub OIDC + secrets and runs Terraform for you):
1) Edit `terraform-infrastructure/terraform.tfvars` and set a globally-unique account name.
70
85
71
-
2) Run Terraform:
86
+
Not using the bootstrap script? See the internal runbook: [_docs/README.md](_docs/README.md).
87
+
88
+
By default (`github_autodetect = true`), Terraform will auto-detect `github_owner/github_repo` during `terraform apply` (from GitHub Actions env vars if present, otherwise from your local git `origin`). `github_ref` defaults to `refs/heads/main` unless you set it explicitly.
89
+
90
+
If this repo is not a git clone (for example, you downloaded a zip) or `origin` is not set to GitHub, autodetect can’t determine the values.
- Creates the resource group, Artifact Signing account, and Key Vault.
102
+
- Populates Key Vault secrets for the workflow (`artifactSigningEndpoint`, `artifactSigningAccountName`, `artifactSigningCertificateProfileName`).
103
+
- If `github_enabled = true`: creates the GitHub OIDC Entra app/service principal + federated identity credential, and assigns RBAC so the workflow can read Key Vault secrets and sign.
81
104
82
-
- In Azure portal, open the Artifact Signing account and complete **Identity validation**.
83
-
- This is required by the service and cannot be automated by Terraform.
84
-
- If the portal says you need **Artifact Signing Identity Verifier**, re-run Terraform (it assigns this role to the identity running `terraform apply` by default) and wait a few minutes for RBAC to propagate.
105
+
What it cannot do:
106
+
- Complete Artifact Signing **identity validation** (this is portal-only).
85
107
86
-
4) Copy the **Identity validation Id** from the portal and set it in Key Vault:
az keyvault secret set --vault-name $kvName --name artifactSigningIdentityValidationId --value "00000000-0000-0000-0000-000000000000"
91
-
```
92
110
93
-
5) Run the GitHub Actions workflow. It will create the certificate profile if it doesn’t exist yet, then sign the binaries.
111
+
In Azure portal:
112
+
- Open the Artifact Signing account and complete **Identity validation**.
113
+
- Create the **certificate profile** (use the same name as `certificate_profile_name`).
94
114
95
-
Optional: If you prefer Terraform to manage the certificate profile instead, set `identity_validation_id` in `terraform-infrastructure/terraform.tfvars` and run `terraform apply` again.
115
+
Optional (Terraform-managed certificate profile):
116
+
- Copy the **Identity validation Id** (GUID) from the portal.
117
+
- Paste it into `identity_validation_id` in `terraform-infrastructure/terraform.tfvars`.
118
+
- Run `terraform apply` again.
119
+
120
+
Push/merge to `main` (or run the workflow via `workflow_dispatch`). The GitHub Actions workflow will build + sign the binaries.
96
121
97
122
## Azure Key Vault for workflow variables
98
123
99
-
Terraform creates a Key Vault by default and wires RBAC so:
100
-
- your current identity (the identity running `terraform apply`) can set secrets (`Key Vault Secrets Officer`)
101
-
- the GitHub Actions service principal can read secrets (`Key Vault Secrets User`)
124
+
Terraform creates a Key Vault by default and wires RBAC so the workflow can read signing inputs.
125
+
126
+
| Principal | Role assigned | Why it exists |
127
+
| --- | --- | --- |
128
+
| Your current identity (the identity running `terraform apply`) |`Key Vault Secrets Officer`| Can set secrets during provisioning |
129
+
| GitHub Actions service principal |`Key Vault Secrets User`| Can read secrets at workflow runtime |
102
130
103
-
> This Key Vault is **RBAC-enabled** (`rbac_authorization_enabled = true`). You will see access under **Key Vault → Access control (IAM)** (not under “Access policies”).
131
+
> [!NOTE]
132
+
> - This Key Vault is **RBAC-enabled** (`rbac_authorization_enabled = true`). You will see access under **Key Vault → Access control (IAM)** (not under “Access policies”).
133
+
> - The GitHub Actions workflow reads them from Key Vault at runtime using the Azure CLI.
104
134
105
135
Least privilege options:
106
-
- Set `keyvault_populate_secrets = false` if you do not want Terraform to write secrets into Key Vault (you can manage secrets yourself and/or set pipeline variables another way).
107
-
- If you want to view **Keys** and/or **Certificates** in the Azure portal, opt in to RBAC for your current identity:
|`keyvault_populate_secrets = false`| Terraform will not write secrets into Key Vault (you can manage secrets yourself and/or set pipeline variables another way). |
140
+
|`keyvault_grant_keys_access_to_current = true`| Grants your current identity `Key Vault Crypto User` (lets you view **Keys** in the portal). |
141
+
|`keyvault_grant_certificates_access_to_current = true`| Grants your current identity `Key Vault Certificates User` (lets you view **Certificates** in the portal). |
142
+
|`keyvault_grant_administrator_to_current = true`| Simplest “make the portal work” option (broad permissions): grants your current identity `Key Vault Administrator`. |
112
143
113
144
Terraform also populates these Key Vault secrets during `terraform apply`:
114
-
-`artifactSigningEndpoint`
115
-
-`artifactSigningAccountName`
116
-
-`artifactSigningCertificateProfileName`
117
-
-`artifactSigningIdentityValidationId` (placeholder until you set it after portal validation)
118
145
119
-
The GitHub Actions workflow reads them from Key Vault at runtime using the Azure CLI.
146
+
| Secret name | Notes |
147
+
| --- | --- |
148
+
|`artifactSigningEndpoint`| Service endpoint used by the workflow |
149
+
|`artifactSigningAccountName`| Artifact Signing account name |
150
+
|`artifactSigningCertificateProfileName`| Certificate profile name |
151
+
|`artifactSigningIdentityValidationId`| Optional. Only needed if Terraform or the workflow will create the certificate profile. |
152
+
120
153
121
154
If signing fails with 403, validate:
122
-
- Endpoint matches region
123
-
- GitHub Actions identity has `Artifact Signing Certificate Profile Signer` at the certificate profile scope
124
155
125
-
## GitHub Actions (recommended)
156
+
| Check | Expected |
157
+
| --- | --- |
158
+
| Endpoint matches region |`artifactSigningEndpoint` points to the correct region |
159
+
| Role at certificate profile scope | GitHub Actions identity has `Artifact Signing Certificate Profile Signer` at the certificate profile scope |
126
160
127
-
This repo includes a GitHub Actions workflow that performs the end-to-end signing flow:
161
+
## GitHub Actions
162
+
163
+
This repo includes a GitHub Actions workflow that performs the signing flow:
128
164
- build/publish unsigned exe
129
165
- load signing inputs from Key Vault
130
-
- create the certificate profile if missing (after you complete portal identity validation)
- GitHub Actions must authenticate to Azure to (1) read signing inputs from Key Vault and (2) call the Artifact Signing service.
175
+
- OIDC lets GitHub obtain an Azure token **without** storing an Azure client secret in GitHub.
163
176
164
-
Then push to `main` (or run the workflow manually via `workflow_dispatch`).
177
+
In this repo, OIDC + GitHub secrets are configured automatically by the bootstrap step in **Deploy with Terraform**.
165
178
166
-
Notes:
167
-
- The workflow uses OIDC, so there is no Azure client secret.
168
-
- The GitHub Actions identity must have RBAC to read Key Vault secrets (`Key Vault Secrets User`) and to sign (`Artifact Signing Certificate Profile Signer`).
169
-
- If you want the workflow to auto-create the certificate profile, you typically also need RG `Contributor` for that identity (`assign_contributor_role_to_github_sp = true`).
179
+
Manual (service requirement): complete the **Identity validation** step in the Azure Portal when prompted.
0 commit comments