mirror of
https://github.com/svnscha/mcp-windbg.git
synced 2026-10-26 10:32:29 +08:00
Sven Scharmentke
5c643b04db
The isolated signing job now requires SIGNING_API_KEY from its environment and supplies the bearer header. HTTP failures clean a pending file before any signed artifact can be uploaded. Reusable workflow callers declare the key; the existing release-please caller forwards it through secrets: inherit. The signing environment, trusted triggers, no-checkout/no-write-token boundary, osslsigncode check and Windows signed-binary scenarios remain intact. CLAUDE.md records the secret contract and controlled acceptance: dispatch with rehearsal=true and an empty tag, so neither PyPI nor release attachment runs. Validation: python scripts/test_signing_http.py passed four local fake HTTP cases covering missing/whitespace key, 401, exact bearer/multipart delivery, cleanup and input preservation. The test executes the exact workflow shell without a hardware call. pwsh scripts/Format-Docs.ps1 -Check passed. Master: liasoft/cloud#253.