mirror of
https://github.com/pbatard/rufus.git
synced 2026-11-13 16:53:58 +00:00
* Any step of a job can read the secrets that this job uses (e.g. by dumping the runner's memory, as was done in the tj-actions/changed-files compromise), and our build jobs run third-party actions such as crazy-max/ghaction-upx, msys2/setup-msys2 and KamaranL/add-signtool-action. * So move the ALPHA signing and the VirusTotal uploads to separate MinGW-Sign/VS2026-Sign jobs, that only use first-party actions to pass the artifacts around, and locate signtool ourselves, so that KamaranL/add-signtool-action is no longer needed. * Also make signing failures fail the job (since 'del sign.pfx' was the last command of the step, signtool errors were previously ignored), and skip signing and VirusTotal uploads when the relevant secrets aren't available (such as when running from a fork). * Closes #3068. |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| dependabot.yml | ||
| pull_request_template.md | ||