From f8b867423df6f6ace826156aadca737b79407271 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 6 Oct 2026 06:22:44 +0000 Subject: [PATCH 1/2] Scope code-signing secrets to the signing step Pass CSC_LINK/CSC_KEY_PASSWORD only through the env of the step that builds and signs the installer instead of exporting them via GITHUB_ENV, where every later step (including the end-to-end test) could read them. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jze3nDgZGqUXGceiu5RCAf --- .github/workflows/release.yml | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c64d11d..3f6f009 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,25 +57,28 @@ jobs: # Signing is used when the WIN_CSC_LINK (base64 .pfx) and WIN_CSC_KEY_PASSWORD # secrets exist; otherwise an unsigned installer is built. - - name: Configure code signing + # The signing secrets are given only to the step that signs. They are not + # written to $GITHUB_ENV, which would expose them to every later step + # (and to any dependency code those steps run). + - name: Check code signing configuration shell: bash env: - WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }} - WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }} + HAS_CERT: ${{ secrets.WIN_CSC_LINK != '' }} run: | - if [ -n "$WIN_CSC_LINK" ]; then - echo "CSC_LINK=$WIN_CSC_LINK" >> "$GITHUB_ENV" - echo "CSC_KEY_PASSWORD=$WIN_CSC_KEY_PASSWORD" >> "$GITHUB_ENV" + if [ "$HAS_CERT" = "true" ]; then echo "Code signing enabled" else echo "::warning::WIN_CSC_LINK not set - building an UNSIGNED installer (SmartScreen will warn users)" - echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV" fi - - name: Build and publish installer + - name: Build, sign and publish installer env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} ELECTRON_BUILD: 'true' + # Empty when the secrets are not configured; electron-builder then skips signing. + CSC_LINK: ${{ secrets.WIN_CSC_LINK }} + CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }} + CSC_IDENTITY_AUTO_DISCOVERY: ${{ secrets.WIN_CSC_LINK != '' }} run: | npm run build npx electron-builder --win --publish always From c0e291e2abc7f515745a850c560ce2856b650dcb Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 6 Oct 2026 06:23:42 +0000 Subject: [PATCH 2/2] Remove unused icon imports that fail CI lint Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jze3nDgZGqUXGceiu5RCAf --- src/components/CookieConsent.jsx | 2 +- src/pages/TrustCenter.jsx | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/components/CookieConsent.jsx b/src/components/CookieConsent.jsx index 8c4b243..0e217c2 100644 --- a/src/components/CookieConsent.jsx +++ b/src/components/CookieConsent.jsx @@ -1,6 +1,6 @@ import { useState, useEffect } from 'react' import { Link } from 'react-router-dom' -import { ShieldCheck, Cookie, Settings, Check, X } from 'lucide-react' +import { Cookie, Settings, Check } from 'lucide-react' import './CookieConsent.css' const COOKIE_STORAGE_KEY = 'libradigit_cookie_consent' diff --git a/src/pages/TrustCenter.jsx b/src/pages/TrustCenter.jsx index fbd8037..400af56 100644 --- a/src/pages/TrustCenter.jsx +++ b/src/pages/TrustCenter.jsx @@ -1,9 +1,9 @@ import { useState, useEffect } from 'react' import { Link, useLocation, useNavigate } from 'react-router-dom' import { - ShieldCheck, Lock, FileText, RefreshCw, Info, Mail, - CreditCard, Cookie, CheckCircle2, AlertCircle, ArrowLeft, - ExternalLink, MapPin, Phone, Clock, Send, Scale, BookOpen + ShieldCheck, Lock, RefreshCw, Info, Mail, + CreditCard, Cookie, CheckCircle2, ArrowLeft, + ExternalLink, MapPin, Clock, Send, Scale } from 'lucide-react' import LogoLoader from '../components/LogoLoader' import './TrustCenter.css'