ci: make package signing optional

Author: rian-be

.github/workflows/publish-artifacts.yml

@@ -2,6 +2,10 @@ name: Publish Artifacts
 
 on:
   workflow_call:
+    outputs:
+      signing_enabled:
+        description: "Whether package signing was enabled for this run."
+        value: ${{ jobs.package.outputs.signing_enabled }}
     inputs:
       package_version:
         description: "Optional package version, usually the release tag without the leading v."
@@ -36,13 +40,13 @@ on:
         default: true
     secrets:
       NUGET_SIGN_CERTIFICATE_BASE64:
-        required: true
+        required: false
       NUGET_SIGN_CERTIFICATE_PASSWORD:
-        required: true
+        required: false
       NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT:
-        required: true
+        required: false
       NUGET_SIGN_TIMESTAMP_URL:
-        required: true
+        required: false
 
 permissions:
   contents: read
@@ -51,6 +55,8 @@ jobs:
   package:
     name: Pack packages
     runs-on: ubuntu-latest
+    outputs:
+      signing_enabled: ${{ steps.signing.outputs.enabled }}
 
     steps:
       - name: Checkout
@@ -137,32 +143,38 @@ jobs:
           -o nupkg
           -p:PackageVersion=${{ steps.version.outputs.redis_version }}
 
-      - name: Import signing certificate
+      - name: Resolve signing mode
+        id: signing
         env:
           NUGET_SIGN_CERTIFICATE_BASE64: ${{ secrets.NUGET_SIGN_CERTIFICATE_BASE64 }}
+          NUGET_SIGN_CERTIFICATE_PASSWORD: ${{ secrets.NUGET_SIGN_CERTIFICATE_PASSWORD }}
+          NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
+          NUGET_SIGN_TIMESTAMP_URL: ${{ secrets.NUGET_SIGN_TIMESTAMP_URL }}
         run: |
-          if [ -z "$NUGET_SIGN_CERTIFICATE_BASE64" ]; then
-            echo "NUGET_SIGN_CERTIFICATE_BASE64 secret is required for package signing." >&2
-            exit 1
+          if [ -n "$NUGET_SIGN_CERTIFICATE_BASE64" ] \
+            && [ -n "$NUGET_SIGN_CERTIFICATE_PASSWORD" ] \
+            && [ -n "$NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT" ] \
+            && [ -n "$NUGET_SIGN_TIMESTAMP_URL" ]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+            echo "Package signing enabled."
+          else
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+            echo "Package signing disabled. Continuing with unsigned packages."
           fi
 
+      - name: Import signing certificate
+        if: ${{ steps.signing.outputs.enabled == 'true' }}
+        env:
+          NUGET_SIGN_CERTIFICATE_BASE64: ${{ secrets.NUGET_SIGN_CERTIFICATE_BASE64 }}
+        run: |
           printf '%s' "$NUGET_SIGN_CERTIFICATE_BASE64" | base64 --decode > signing-cert.pfx
 
       - name: Sign packages
+        if: ${{ steps.signing.outputs.enabled == 'true' }}
         env:
           NUGET_SIGN_CERTIFICATE_PASSWORD: ${{ secrets.NUGET_SIGN_CERTIFICATE_PASSWORD }}
           NUGET_SIGN_TIMESTAMP_URL: ${{ secrets.NUGET_SIGN_TIMESTAMP_URL }}
         run: |
-          if [ -z "$NUGET_SIGN_CERTIFICATE_PASSWORD" ]; then
-            echo "NUGET_SIGN_CERTIFICATE_PASSWORD secret is required for package signing." >&2
-            exit 1
-          fi
-
-          if [ -z "$NUGET_SIGN_TIMESTAMP_URL" ]; then
-            echo "NUGET_SIGN_TIMESTAMP_URL secret is required for package signing." >&2
-            exit 1
-          fi
-
           for package in nupkg/*.nupkg; do
             dotnet nuget sign "$package" \
               --certificate-path signing-cert.pfx \
@@ -174,14 +186,10 @@ jobs:
           done
 
       - name: Verify signed packages
+        if: ${{ steps.signing.outputs.enabled == 'true' }}
         env:
           NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
         run: |
-          if [ -z "$NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT" ]; then
-            echo "NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT secret is required for package verification." >&2
-            exit 1
-          fi
-
           for package in nupkg/*.nupkg; do
             dotnet nuget verify "$package" \
               --all \

.github/workflows/publish-attested.yml

@@ -15,13 +15,13 @@ on:
         type: string
     secrets:
       NUGET_SIGN_CERTIFICATE_BASE64:
-        required: true
+        required: false
       NUGET_SIGN_CERTIFICATE_PASSWORD:
-        required: true
+        required: false
       NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT:
-        required: true
+        required: false
       NUGET_SIGN_TIMESTAMP_URL:
-        required: true
+        required: false
 
 permissions:
   contents: write
@@ -56,6 +56,11 @@ jobs:
           path: dist
           merge-multiple: true
 
+      - name: Attest package artifacts
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: dist/*.nupkg
+
       - name: Create or update draft release
         env:
           GITHUB_TOKEN: ${{ github.token }}

.github/workflows/publish-packages.yml

@@ -130,14 +130,10 @@ jobs:
           merge-multiple: true
 
       - name: Verify signed packages
+        if: ${{ needs.package.outputs.signing_enabled == 'true' }}
         env:
           NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
         run: |
-          if [ -z "$NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT" ]; then
-            echo "NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT secret is required for package verification." >&2
-            exit 1
-          fi
-
           for package in dist/*.nupkg; do
             dotnet nuget verify "$package" \
               --all \
@@ -184,14 +180,10 @@ jobs:
           merge-multiple: true
 
       - name: Verify signed packages
+        if: ${{ needs.package.outputs.signing_enabled == 'true' }}
         env:
           NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
         run: |
-          if [ -z "$NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT" ]; then
-            echo "NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT secret is required for package verification." >&2
-            exit 1
-          fi
-
           for package in dist/*.nupkg; do
             dotnet nuget verify "$package" \
               --all \

.github/workflows/release-drafter.yml

@@ -34,7 +34,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   publish-attested:
-    if: ${{ secrets.NUGET_SIGN_CERTIFICATE_BASE64 != '' && secrets.NUGET_SIGN_CERTIFICATE_PASSWORD != '' && secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT != '' && secrets.NUGET_SIGN_TIMESTAMP_URL != '' }}
     needs: update-release-draft
     uses: ./.github/workflows/publish-attested.yml
     with:

Docs/Package-Signing.md

@@ -1,9 +1,10 @@
 # Package Signing
 
-`ModularityKit.Mutator` release packages are signed as part of the standard package publish path.
+`ModularityKit.Mutator` can sign release packages as part of the standard package publish path.
 
-The repository signs generated `.nupkg` artifacts before they are uploaded or pushed to package feeds.
-Unsigned release packages are treated as a validation failure.
+When signing material is configured, the repository signs generated `.nupkg` artifacts before they
+are uploaded or pushed to package feeds. When signing material is not configured, the release path
+continues with unsigned packages and relies on GitHub artifact attestations for provenance.
 
 ## Signing approach
 
@@ -21,21 +22,28 @@ This keeps signing explicit, auditable, and integrated with the existing `pack`
 The standard package release path is:
 
 1. pack packages in `.github/workflows/publish-artifacts.yml`
-2. sign every `.nupkg`
-3. verify every signed `.nupkg`
-4. upload signed artifacts
-5. download and verify signed artifacts again before pushing to NuGet.org or GitHub Packages
+2. sign every `.nupkg` when signing secrets are configured
+3. verify every signed `.nupkg` when signing is enabled
+4. upload artifacts
+5. generate GitHub artifact attestations in `.github/workflows/publish-attested.yml`
+6. download and verify signed artifacts again before pushing to NuGet.org or GitHub Packages when signing is enabled
 
 The signing step changes package contents only by adding signature metadata.
 
-## Required GitHub secrets
+## GitHub secrets
 
-Configure these repository secrets before using the package publish workflows:
+Package signing is optional. Configure these repository secrets to enable signed package output:
 
 - `NUGET_SIGN_CERTIFICATE_BASE64`
 - `NUGET_SIGN_CERTIFICATE_PASSWORD`
 - `NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT`
 - `NUGET_SIGN_TIMESTAMP_URL`
+
+Without those secrets, the workflows still pack packages and the attested release path still emits
+GitHub provenance attestations.
+
+NuGet.org publishing still requires:
+
 - `NUGET_USERNAME`
 
 Notes:
@@ -55,7 +63,7 @@ Contributors can still:
 - pack projects locally
 - run tests and smoke tests
 
-Signing is enforced in the repository release workflows, not for ordinary local development.
+Signing is optional in the repository release workflows and not required for ordinary local development.
 
 If you have access to the signing certificate locally, you can validate package signatures with:
 

README.md

@@ -71,6 +71,7 @@ https://modularitykit.github.io/ModularityKit.Mutator/
 
 ## Package signing
 
-Release packages are signed and verified in the standard package publish workflow. See
-[`Docs/Package-Signing.md`](Docs/Package-Signing.md) for the signing approach, required secrets, and
-local verification expectations.
+Release packages can be signed and verified in the standard package publish workflow when signing
+secrets are configured. Without signing secrets, the attested release path still emits GitHub
+artifact attestations. See [`Docs/Package-Signing.md`](Docs/Package-Signing.md) for the signing
+approach, optional secrets, and local verification expectations.