From b84d9abd960a5e5853f48369434801ca0183f54b Mon Sep 17 00:00:00 2001
From: Elliot Mackenzie <6545046+barfle@users.noreply.github.com>
Date: Mon, 13 Jul 2026 20:52:42 +1000
Subject: [PATCH] Add Azure Artifact Signing release flow

---
 .github/workflows/release.yml  | 42 ++++++++++++++++++++++++++++++++++
 dataplicity_cli/__init__.py    |  2 +-
 pyproject.toml                 |  2 +-
 tests/test_cli_ux_snapshots.py |  2 +-
 4 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 053a72c..9eb3875 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,11 +8,13 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   build:
     name: Build ${{ matrix.name }}
     runs-on: ${{ matrix.os }}
+    environment: release-signing
     strategy:
       fail-fast: false
       matrix:
@@ -58,6 +60,33 @@ jobs:
         if: runner.os == 'Windows'
         run: pyinstaller --noconfirm --clean --onefile --name dataplicity --workpath pyinstaller-build --distpath pyinstaller-dist dataplicity_cli/__main__.py
 
+      - name: Setup .NET for Artifact Signing
+        if: runner.os == 'Windows'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Azure login for Artifact Signing
+        if: runner.os == 'Windows'
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Sign Windows executable
+        if: runner.os == 'Windows'
+        uses: azure/artifact-signing-action@v2
+        with:
+          endpoint: ${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
+          signing-account-name: ${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
+          files-folder: ${{ github.workspace }}\pyinstaller-dist
+          files-folder-filter: exe
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Build macOS tarball (for Homebrew)
         if: runner.os == 'macOS'
         shell: bash
@@ -94,6 +123,19 @@ jobs:
         run: |
           ./build/windows/build_msi.ps1 -Version "${env:VERSION}"
 
+      - name: Sign Windows MSI
+        if: runner.os == 'Windows'
+        uses: azure/artifact-signing-action@v2
+        with:
+          endpoint: ${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
+          signing-account-name: ${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
+          files-folder: ${{ github.workspace }}\dist
+          files-folder-filter: msi
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Stage Windows release artifacts
         if: runner.os == 'Windows'
         shell: pwsh
diff --git a/dataplicity_cli/__init__.py b/dataplicity_cli/__init__.py
index d4a0c3f..7cbd8df 100644
--- a/dataplicity_cli/__init__.py
+++ b/dataplicity_cli/__init__.py
@@ -1,3 +1,3 @@
 __all__ = ["__version__"]
 
-__version__ = "0.1.6"
+__version__ = "0.1.7"
diff --git a/pyproject.toml b/pyproject.toml
index 2d977e9..f90df9e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dataplicity-cli"
-version = "0.1.6"
+version = "0.1.7"
 description = "Dataplicity command line interface"
 readme = "README.md"
 requires-python = ">=3.9"
diff --git a/tests/test_cli_ux_snapshots.py b/tests/test_cli_ux_snapshots.py
index 32ccc8b..a5787e4 100644
--- a/tests/test_cli_ux_snapshots.py
+++ b/tests/test_cli_ux_snapshots.py
@@ -136,7 +136,7 @@ def test_logging_path_map_help_snapshot(self) -> None:
     def test_version_flag_snapshot(self) -> None:
         result = self._invoke(["--version"])
         self.assertEqual(result.exit_code, 0, msg=result.output)
-        self.assertEqual(result.output.strip(), "dataplicity-cli 0.1.6")
+        self.assertEqual(result.output.strip(), "dataplicity-cli 0.1.7")
 
     def test_auth_required_message_snapshot_json(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir: