lando/Code Sign Action
A GitHub Action for code signing files. Particularly those generated with @yao-pkg/pkg.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 3, 2026
- License
- MIT
Pinned Snippet
uses: lando/code-sign-action@e4ff1308be14fade6516fd4f1ddd0509b7ea5223 # v3.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| file | The file to sign | yes | — |
| certificate-data | A `base64` encoded string of your `p12` or `pfx` cert contents. Note: if you use KeyLocker, this will be the base64 encoded client certificate (`SM_CLIENT_CERT_FILE`). Not required for Azure Artifact Signing. | no | — |
| certificate-password | The password to unlock the certificate-data. Not required for Azure Artifact Signing. | no | — |
| apple-notary-password | The Apple Developer account password to use in notarization | no | — |
| apple-notary-user | The Apple Developer account email to use in notarization | no | — |
| apple-notary-tool | The xcrun tool to use to notarize. | no | notarytool |
| apple-product-id | The unique product ID to use for notarization | no | — |
| apple-team-id | The Apple Developer account Team ID | no | — |
| certificate-id | A string to identify the correct signing cert | no | — |
| azure-client-id | The Azure application client ID to use for Azure Artifact Signing | no | — |
| azure-signing-account-name | The Azure Artifact Signing account name | no | — |
| azure-signing-endpoint | The Azure Artifact Signing endpoint | no | — |
| azure-subscription-id | The Azure subscription ID to use for Azure Artifact Signing | no | — |
| azure-tenant-id | The Azure tenant ID to use for Azure Artifact Signing | no | — |
| keylocker-api-key | The API key to use for KeyLocker | no | — |
| keylocker-cert-sha1-hash | The SHA1 hash of the certificate to use for KeyLocker | no | — |
| keylocker-host | The host to use for KeyLocker | no | — |
| keylocker-keypair-alias | The alias of the keypair to use for KeyLocker | no | — |
| options | Extra options to pass to the codesigning tool | no | — |
| signtool | The signtool to use | no | auto |
Outputs
| name | description |
|---|---|
| file | The path to the signed binary. |