{"id":6799,"date":"2022-11-16T19:52:52","date_gmt":"2022-11-16T19:52:52","guid":{"rendered":"https:\/\/rakhesh.com\/?p=6799"},"modified":"2022-11-16T19:52:52","modified_gmt":"2022-11-16T19:52:52","slug":"automatically-signing-powershell-scripts-via-github-actions","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/coding\/automatically-signing-powershell-scripts-via-github-actions\/","title":{"rendered":"Automatically signing PowerShell scripts via GitHub actions"},"content":{"rendered":"

A while ago I had come across this cool blog post<\/a> (and cool blog in general) on signing PowerShell scripts via GitHub actions. Before that I was signing scripts manually, and I think I was Googling on whether there’s a way to do this via GitHub actions and luckily came across that blog post. Ever since I’ve been using it.<\/p>\n

I had modified it a bit to suit my needs – such as have the zip file name be a mix of the repo name, branch name, and so on. Easy to know what is what when I have a bunch of these lying around. Unfortunately, today I ran into an issue wherein I named a branch as “feature\/something” and the slash caused and issue in the file name. Wanted to see if there’s a way to remove the branch and came across the find-and-replace strings action<\/a>. Combined the two and here’s my workflow:<\/p>\n

name: Sign Runbook and make available for download\r\non: \r\n  workflow_dispatch:\r\n  push:\r\n    paths:\r\n      - 'Runbooks\/*.ps1'\r\n\r\njobs:\r\n  sign_runbooks:\r\n    runs-on: windows-2019\r\n    steps:\r\n      - name: Import code signing certificate\r\n        shell: powershell\r\n        run: |\r\n          $pfxCertFilePath = Join-Path -Path $PSScriptRoot -ChildPath \"CodeSigningCertificate.pfx\"\r\n          Set-Content -Value $([System.Convert]::FromBase64String($env:BASE64_PFX)) -Path $pfxCertFilePath -Encoding Byte\r\n          $codeSigningCert = Import-PfxCertificate -FilePath $pfxCertFilePath -Password $($env:PFX_PASSWORD | ConvertTo-SecureString -AsPlainText -Force) -CertStoreLocation Cert:\\CurrentUser\\My\r\n        env:\r\n          BASE64_PFX: ${{ secrets.BASE64_PFX }}\r\n          PFX_PASSWORD: ${{ secrets.PFX_PASSWORD }}\r\n\r\n      - name: Check out repository\r\n        uses: actions\/checkout@v2\r\n\r\n      - name: Sign PowerShell Runbooks\r\n        shell: powershell\r\n        run: |\r\n          $scripts = Get-ChildItem -Path .\\Runbooks\\ -Filter \"*.ps1\" -Recurse -ErrorAction Stop\r\n\r\n          $codeSigningCert = Get-ChildItem Cert:\\CurrentUser\\My -CodeSigningCert | Select-Object -First 1\r\n\r\n          foreach ($script in $scripts) {\r\n            try {\r\n              $scriptContent = Get-Content -Path $script.FullName\r\n              Write-Output \"Signing script `\"$($script.Name)`\" with certificate `\"$($codeSigningCert.Thumbprint)`\"\"\r\n              # sign script\r\n              $null = Set-AuthenticodeSignature -Certificate $codeSigningCert -FilePath $script.FullName -TimestampServer \"http:\/\/timestamp.comodoca.com\/rfc3161\"\r\n            }\r\n            catch {\r\n              Write-Error $_\r\n            }\r\n          }\r\n      \r\n      - name: Fix Branch name if needed\r\n        uses: mad9000\/actions-find-and-replace-string@2\r\n        with:\r\n          source: ${{ github.ref_name }}  # The short ref name of the branch or tag that triggered the workflow run. This value matches the branch or tag name shown on GitHub. For example, feature\/branch-1.\r\n          find: '\/'                       # We want to remove \/ from source \r\n          replace: ''                     # and replace it with a blank string (ie. removing it)\r\n        id: fixbranchname\r\n\r\n      - name: Publish artifacts\r\n        uses: actions\/upload-artifact@v2\r\n        with:\r\n          name: ${{ env.ARTIFACT_NAME }}\r\n          path: .\\Runbooks\r\n        env: \r\n          ARTIFACT_NAME: SignedRunbooks-${{ github.event.repository.name }}-${{ steps.fixbranchname.outputs.value }}  # More variables at https:\/\/docs.github.com\/en\/actions\/learn-github-actions\/contexts#github-context<\/pre>\n
Just putting it here in case it helps anyone else. This one runs on any push to the repo, as long as there’s changes to the .ps1<\/code> files in the Runbooks<\/code> folder. I could have targetted specific branches too, for instance, by modifying this section:<\/p>\n
on: \r\n  workflow_dispatch:\r\n  push:\r\n    branches:\r\n      - 'prod'\r\n    paths:\r\n      - 'Runbooks\/*.ps1'<\/pre>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
A while ago I had come across this cool blog post (and cool blog in general) on signing PowerShell scripts via GitHub actions. Before that I was signing scripts manually, and I think I was Googling on whether there’s a way to do this via GitHub actions and luckily came across that blog post. Ever … Continue reading Automatically signing PowerShell scripts via GitHub actions<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[102],"tags":[1091,975,227],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6799"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=6799"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6799\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=6799"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=6799"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=6799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}