I own a public and open-source Windows Forms/C# application in a Github repo that I want to start code signing with my certificate through Azure Pipelines CI. I have set up my pipeline and it is building fine, the next step is to integrate automatic code signing, which until this point I have been doing manually. I have taken the following steps:
- Certificate has been added to Secure File storage
- Code Signing Extension Installed https://marketplace.visualstudio.com/items?itemName=stefankert.codesigning
- Task variables have been created and marked as secret
After adding a task, the YML generating is:
- task: codesigning@2 inputs: secureFileId: '$(certName)' signCertPassword: '$(certPass)' files: '**/*.exe' timeServer: 'http://timestamp.digicert.com' hashingAlgorithm: 'SHA256'
So, saving this, it is obviously going to update my azure-pipelines.yml in my repository. Is it possible to perform code signing in Azure Pipelines without exposing any information in the repository? Is this considered best practice for code-signing in Azure Pipelines?