1
1
Fork 0
mirror of https://github.com/pbatard/rufus.git synced 2026-11-13 16:53:58 +00:00
rufus/.github
Andreas Fehlner 8b7867d62f
[internal] only expose CI secrets to a job that runs no third-party actions
* Any step of a job can read the secrets that this job uses (e.g. by dumping the runner's memory,
  as was done in the tj-actions/changed-files compromise), and our build jobs run third-party
  actions such as crazy-max/ghaction-upx, msys2/setup-msys2 and KamaranL/add-signtool-action.
* So move the ALPHA signing and the VirusTotal uploads to separate MinGW-Sign/VS2026-Sign jobs,
  that only use first-party actions to pass the artifacts around, and locate signtool ourselves,
  so that KamaranL/add-signtool-action is no longer needed.
* Also make signing failures fail the job (since 'del sign.pfx' was the last command of the
  step, signtool errors were previously ignored), and skip signing and VirusTotal uploads when
  the relevant secrets aren't available (such as when running from a fork).
* Closes #3068.
2026-10-25 12:21:24 +00:00
..
ISSUE_TEMPLATE [misc] Fix issue template no longer being processed 2025-01-25 13:06:07 +00:00
workflows [internal] only expose CI secrets to a job that runs no third-party actions 2026-10-25 12:21:24 +00:00
dependabot.yml [cmd] fix hogger invocation for PowerShell 2024-09-14 12:21:22 +01:00
pull_request_template.md [internal] add pull_request_template.md and update issue_template.md 2023-01-13 21:45:50 +00:00