chore: added nuget-code-sign workflow

Author: tiwarishubham635

.github/workflows/test-and-deploy.yml

@@ -46,29 +46,65 @@ jobs:
           dotnet tool install --global dotnet-sonarscanner --version 5.5.3
           make cover
 
-  import-certificate:
+  code-signing:
     runs-on: windows-latest
     steps:
-     - uses: actions/checkout@v2
-     - run: make install
-     - name: import-certificate
-       run: |
-        New-Item -ItemType directory -Path certificate
-        Set-Content -Path certificate\certificate.txt -Value '${{ secrets.CODE_SIGNING_CERTIFICATE }}'
-        certutil -decode certificate\certificate.txt certificate\certificate.pfx
-
-     - name: Upload Artifact
-       uses: actions/upload-artifact@v3
-       with:
-         name: certificate.pfx
-         path: certificate\certificate.pfx
-         retention-days: 1
+      - name: Set up certificate
+        run: |
+          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
+          cat  /d/Certificate_pkcs12.p12
+        shell: bash
+
+      - name: Set variables
+        id: variables
+        run: |
+          dir
+          echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
+          echo "::set-output name=KEYPAIR_NAME::gt-standard-keypair"
+          echo "::set-output name=CERTIFICATE_NAME::gt-certificate"
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
+          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
+          echo "BUILD_TOOLS_VERSION=31.0.0" >> "$GITHUB_ENV"
+          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
+          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
+          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
+        shell: bash
+
+      - name: Code signing with Software Trust Manager
+        id: SSMClientToolSetup
+        uses: digicert/ssm-code-signing@v0.0.2
+        env:
+          SM_API_KEY: ${{ env.SM_API_KEY }}
+          SM_CLIENT_CERT_PASSWORD: ${{ env.SM_CLIENT_CERT_PASSWORD }}
+          SM_CLIENT_CERT_FILE: ${{ env.SM_CLIENT_CERT_FILE }}
 
+      - run: echo “The config file path ${{ steps.SSMClientToolSetup.outputs.PKCS11_CONFIG }}”
+
+      - name: Setup Keylocker KSP on windows
+        run: |
+          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi 
+          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
+          smksp_registrar.exe list 
+          smctl.exe keypair ls 
+          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
+        shell: cmd
+
+      - name: Certificates Sync
+        run: |
+          smctl windows certsync
+        shell: cmd
+
+      - name: Create Signed Directory
+        run: |
+          mkdir D:\a\stm-github-action-demo\stm-github-action-demo\dist\
+        shell: cmd
 
   deploy:
     name: Deploy
     if: success() && github.ref_type == 'tag'
-    needs: [ test, import-certificate ]
+    needs: [ test, code-signing ]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout twilio-csharp
@@ -106,11 +142,18 @@ jobs:
       - name: Build and Push image
         run: make docker-build docker-push
 
+      - name: NuGet Install
+        uses: NuGet/setup-nuget@v1.0.5
+        with:
+          nuget-version: latest
+
       - name: Publish package to NuGet
         run: |
           make release
-          dotnet nuget sign **/*.nupkg --certificate-path certificate.pfx --certificate-password ${{ secrets.CERTIFICATE_PASSWORD }} --timestamper http://timestamp.digicert.com
-          dotnet nuget push **/*.nupkg -k ${{ secrets.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json
+          copy D:\a\stm-github-action-demo\stm-github-action-demo\UNSIGNED.nupkg D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg
+          nuget sign "D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg" -Timestamper http://timestamp.digicert.com -outputdirectory "D:\a\stm-github-action-demo\stm-github-action-demo\dist\NugetSigned" -CertificateFingerprint ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} -HashAlgorithm SHA256 -Verbosity detailed -Overwrite
+          nuget verify -All "D:\a\stm-github-action-demo\stm-github-action-demo\dist\NugetSigned\*"
+          nuget push "D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg" -k ${{ secrets.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json
 
       - name: Submit metric to Datadog
         uses: sendgrid/dx-automator/actions/datadog-release-metric@main