Add Azure Artifact Signing release flow

.github/workflows/release.yml

@@ -8,11 +8,13 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   build:
     name: Build ${{ matrix.name }}
     runs-on: ${{ matrix.os }}
+    environment: release-signing
     strategy:
       fail-fast: false
       matrix:
@@ -58,6 +60,33 @@ jobs:
         if: runner.os == 'Windows'
         run: pyinstaller --noconfirm --clean --onefile --name dataplicity --workpath pyinstaller-build --distpath pyinstaller-dist dataplicity_cli/__main__.py
 
+      - name: Setup .NET for Artifact Signing
+        if: runner.os == 'Windows'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Azure login for Artifact Signing
+        if: runner.os == 'Windows'
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Sign Windows executable
+        if: runner.os == 'Windows'
+        uses: azure/artifact-signing-action@v2
+        with:
+          endpoint: ${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
+          signing-account-name: ${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
+          files-folder: ${{ github.workspace }}\pyinstaller-dist
+          files-folder-filter: exe
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Build macOS tarball (for Homebrew)
         if: runner.os == 'macOS'
         shell: bash
@@ -94,6 +123,19 @@ jobs:
         run: |
           ./build/windows/build_msi.ps1 -Version "${env:VERSION}"
 
+      - name: Sign Windows MSI
+        if: runner.os == 'Windows'
+        uses: azure/artifact-signing-action@v2
+        with:
+          endpoint: ${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
+          signing-account-name: ${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
+          files-folder: ${{ github.workspace }}\dist
+          files-folder-filter: msi
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Stage Windows release artifacts
         if: runner.os == 'Windows'
         shell: pwsh

dataplicity_cli/__init__.py

@@ -1,3 +1,3 @@
 __all__ = ["__version__"]
 
-__version__ = "0.1.6"
+__version__ = "0.1.7"

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dataplicity-cli"
-version = "0.1.6"
+version = "0.1.7"
 description = "Dataplicity command line interface"
 readme = "README.md"
 requires-python = ">=3.9"

tests/test_cli_ux_snapshots.py

@@ -136,7 +136,7 @@ def test_logging_path_map_help_snapshot(self) -> None:
     def test_version_flag_snapshot(self) -> None:
         result = self._invoke(["--version"])
         self.assertEqual(result.exit_code, 0, msg=result.output)
-        self.assertEqual(result.output.strip(), "dataplicity-cli 0.1.6")
+        self.assertEqual(result.output.strip(), "dataplicity-cli 0.1.7")
 
     def test_auth_required_message_snapshot_json(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir: