azure/Artifact Signing
Sign your files with Artifact Signing.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 21, 2026
- License
- MIT
Pinned Snippet
uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| azure-tenant-id | The Azure Active Directory tenant (directory) ID. | no | — |
| azure-client-id | The client (application) ID of an App Registration in the tenant. | no | — |
| azure-client-secret | A client secret that was generated for the App Registration. | no | — |
| azure-client-certificate-path | A path to certificate and private key pair in PEM or PFX format, which can authenticate the App Registration. | no | — |
| azure-client-send-certificate-chain | Specifies whether an authentication request will include an x5c header to support subject name / issuer based authentication. When set to `true` or `1`, authentication requests include the x5c header. | no | — |
| azure-username | The username, also known as upn, of an Azure Active Directory user account. | no | — |
| azure-password | The password of the Azure Active Directory user account. Note this does not support accounts with MFA enabled. | no | — |
| endpoint | The Artifact Signing Account endpoint. The URI value must have a URI that aligns to the region your Signing Account and Certificate Profile you are specifying were created in during the setup of these resources. | yes | — |
| signing-account-name | The Signing Account name. | no | — |
| trusted-signing-account-name | The Trusted Signing Account name. | no | — |
| certificate-profile-name | The Certificate Profile name. | yes | — |
| files | A comma or newline separated list of absolute paths to the files being signed. Can be combined with the files-folder and file-catalog inputs. | no | — |
| files-folder | The folder containing files to be signed. Can be combined with the files and file-catalog inputs. | no | — |
| files-folder-filter | A comma separated list of file extensions that determines which types of files will be signed in the folder specified by the files-folder input. E.g., 'dll,exe,msix'. Any file type not included in this list will not be signed. If this input is not used, all files in the folder will be signed. Supports wildcards for matching multiple file names with a pattern. | no | — |
| files-folder-recurse | A boolean value (true/false) that indicates if the folder specified by the files-folder input should be searched recursively. The default value is false. | no | — |
| files-folder-depth | An integer value that indicates the depth of the recursive search toggled by the files-folder-recursive input. | no | — |
| files-catalog | A file containing a list of relative paths to the files being signed. The paths should be relative to the location of the catalog file. Each file path should be on a separate line. Can be combined with the files and files-folder inputs. | no | — |
| file-digest | The name of the digest algorithm used for hashing the files being signed. The supported values are SHA256, SHA384, and SHA512. | no | SHA256 |
| timestamp-rfc3161 | A URL to an RFC3161 compliant timestamping service. | no | http://timestamp.acs.microsoft.com |
| timestamp-digest | The name of the digest algorithm used for timestamping. The supported values are SHA256, SHA384, and SHA512. | no | SHA256 |
| append-signature | A boolean value (true/false) that indicates if the signature should be appended. If no primary signature is present, this signature is made the primary signature instead. | no | — |
| description | A description of the signed content. | no | — |
| description-url | A Uniform Resource Locator (URL) for the expanded description of the signed content. | no | — |
| generate-digest-path | Generates the digest to be signed and the unsigned PKCS7 files at this path. The output digest and PKCS7 files will be path\FileName.dig and path\FileName.p7u. To output an additional XML file, see `generate-digest-xml`. | no | — |
| generate-digest-xml | A boolean value (true/false) that indicates if an XML file is produced when the `generate-digest-path` input is used. The output file will be Path\FileName.dig.xml. | no | — |
| ingest-digest-path | Creates the signature by ingesting the signed digest to the unsigned PKCS7 file at this path. The input signed digest and unsigned PKCS7 files should be path\FileName.dig.signed and path\FileName.p7u. | no | — |
| sign-digest | A boolean value (true/false) that indicates if only the digest should be signed. The input file should be the digest generated by the `generate-digest-path` input. The output file will be File.signed. | no | — |
| generate-page-hashes | A boolean value (true/false) that indicates if page hashes should be generated for executable files. | no | — |
| suppress-page-hashes | A boolean value (true/false) that indicates if page hashes should be suppressed for executable files. The default is determined by the SIGNTOOL_PAGE_HASHES environment variable and by the wintrust.dll version. This input is ignored for non-PE files. | no | — |
| generate-pkcs7 | A boolean value (true/false) that indicates if a Public Key Cryptography Standards (PKCS) \#7 file is produced for each specified content file. PKCS \#7 files are named path\filename.p7. | no | — |
| pkcs7-options | Options for the signed PKCS \#7 content. Set value to "Embedded" to embed the signed content in the PKCS \#7 file, or to "DetachedSignedData" to produce the signed data portion of a detached PKCS \#7 file. If this input is not used, the signed content is embedded by default. | no | — |
| pkcs7-oid | The object identifier (OID) that identifies the signed PKCS \#7 content. | no | — |
| enhanced-key-usage | The enhanced key usage (EKU) that must be present in the signing certificate. The usage value can be specified by OID or string. The default usage is "Code Signing" (1.3.6.1.5.5.7.3.3). | no | — |
| exclude-environment-credential | Exclude the "EnvironmentCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | false |
| exclude-workload-identity-credential | Exclude the "WorkloadIdentityCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | true |
| exclude-managed-identity-credential | Exclude the "ManagedIdentity" type from being considered when authenticating with "DefaultAzureCredential". | no | true |
| exclude-shared-token-cache-credential | Exclude the "SharedTokenCacheCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | true |
| exclude-visual-studio-credential | Exclude the "VisualStudioCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | true |
| exclude-visual-studio-code-credential | Exclude the "VisualStudioCodeCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | true |
| exclude-azure-cli-credential | Exclude the "AzureCliCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | false |
| exclude-azure-powershell-credential | Exclude the "AzurePowerShellCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | true |
| exclude-azure-developer-cli-credential | Exclude the "AzureDeveloperCliCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | true |
| exclude-interactive-browser-credential | Exclude the "InteractiveBrowserCredential" type from being considered when authenticating with "DefaultAzureCredential". | no | true |
| timeout | The number of seconds that the Artifact Signing service will wait for all files to be signed before it exits. The default value is 300 seconds. | no | — |
| batch-size | The summed length of file paths that can be signed with each signtool call. This parameter should only be relevant if you are signing a large number of files. Increasing the value may result in performance gains at the risk of potentially hitting your system's maximum command length limit. The minimum value is 0 and the maximum value is 30000. A value of 0 means that every file will be signed with an individual call to signtool. | no | — |
| cache-dependencies | A boolean value (true/false) that indicates if the dependencies for this action should be cached by GitHub or not. The default value is true. When using self-hosted runners, caches from workflow runs are stored on GitHub-owned cloud storage. A customer-owned storage solution is only available with GitHub Enterprise Server. When enabled, this option can reduce the duration of the action by at least 1 minute. | no | true |
| trace | A boolean value (true/false) that controls trace logging. The default value is false. | no | false |
| clickonce-application-name | The application name for any ClickOnce files being signed. | no | — |
| clickonce-publisher-name | The publisher name for any ClickOnce files being signed. | no | — |
| correlation-id | A unique identifier for the signing request. This value is used to track the signing request in the Artifact Signing service. | no | — |
Outputs
no outputs