mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-21 05:30:35 +00:00
3826316eec
Production SignPath signing requests require manual approval in the SignPath UI, so the previous single-job flow (submit with wait-for-completion inside a 40-minute window) let approval latency fail the Windows build, and any re-run rebuilt the binaries and submitted a second request needing a second approval. The Windows lane is now two jobs: sign-windows-agent builds the unsigned executables, submits the SignPath request without waiting, and uploads a 7-day signing-request record; collect-windows-signing absorbs approval latency by polling the recorded request, downloads the signed artifact by request id, and keeps the existing verification and evidence steps. If approval outlasts the 115-minute polling window, the collection job fails with re-run guidance and "Re-run failed jobs" collects the same recorded request - no rebuild, no resubmission. The legacy PFX break-glass backend rides the same two-job shape via an artifact hand-off. Workflow output wiring, artifact names, and evidence content are unchanged for downstream consumers. The shape test now pins the async invariants (no wait-for-completion: true in the candidate workflow), and the code signing policy plus the deployment-installability contract describe the two-phase flow. |
||
|---|---|---|
| .. | ||
| windowslifecycleserver | ||
| agent_state_dir_lifecycle_test.go | ||
| backfill_release_assets_test.go | ||
| build_release_assets_test.go | ||
| docker_entrypoint_test.go | ||
| install_docker_sh_test.go | ||
| install_ps1_test.go | ||
| install_sh_test.go | ||
| provider_msp_deploy_test.go | ||
| pulse_auto_update_test.go | ||
| release_ldflags_test.go | ||
| root_install_sh_test.go | ||
| uninstall_sensor_proxy_test.go | ||
| windows_agent_lifecycle.ps1 | ||