v6.6.6-beta.14

.github/workflows/build-app-beta.yaml

@@ -6,16 +6,20 @@ name: Electron app BETA
   push:
     tags:
       - v[0-9]+.[0-9]+.[0-9]+-beta.[0-9]+
+
+permissions:
+  id-token: write
+  contents: write
+  
 jobs:
   build:
     runs-on: ${{ matrix.os }}
+    environment: dbgate-app
     strategy:
       fail-fast: false
       matrix:
         os:
-          - macos-14
           - windows-2022
-          - ubuntu-22.04
     steps:
       - name: Install python 3.11 (MacOS)
         if: matrix.os == 'macos-14'
@@ -66,8 +70,8 @@ jobs:
           yarn run build:app
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
-          WIN_CSC_LINK: ${{ secrets.WINCERT_2025 }}
-          WIN_CSC_KEY_PASSWORD: ${{ secrets.WINCERT_2025_PASSWORD }}
+          # WIN_CSC_LINK: ${{ secrets.WINCERT_2025 }}
+          # WIN_CSC_KEY_PASSWORD: ${{ secrets.WINCERT_2025_PASSWORD }}
           CSC_LINK: ${{ secrets.APPLECERT_CERTIFICATE }}
           CSC_KEY_PASSWORD: ${{ secrets.APPLECERT_PASSWORD }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
@@ -75,6 +79,42 @@ jobs:
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           SNAPCRAFT_STORE_CREDENTIALS: ${{secrets.SNAPCRAFT_LOGIN}}
           APPLE_APP_SPECIFIC_PASSWORD: ${{secrets.APPLE_APP_SPECIFIC_PASSWORD}}
+
+      - name: Check OIDC availability
+        if: matrix.os == 'windows-2022'
+        run: |
+          echo "OIDC URL: $env:ACTIONS_ID_TOKEN_REQUEST_URL"
+          echo "OIDC TOKEN: ${{ steps.none.outputs.nothing || '' }}"
+          echo "Client ID: ${{ secrets.AZURE_TC_CLIENT_ID }}"
+          echo "Tenant ID: ${{ secrets.AZURE_TC_TENANT_ID }}"
+        shell: pwsh
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v2
+        if: matrix.os == 'windows-2022'
+        with:
+          client-id: ${{ secrets.AZURE_TC_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TC_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Sign Windows artifacts with Azure Trusted Signing
+        uses: azure/trusted-signing-action@v0
+        if: matrix.os == 'windows-2022'
+        with:
+          # azure-tenant-id: ${{ secrets.AZURE_TC_TENANT_ID }}
+          # azure-client-id: ${{ secrets.AZURE_TC_CLIENT_ID }}
+          # azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+
+          endpoint: https://wus3.codesigning.azure.net/
+          trusted-signing-account-name: DbGate
+          certificate-profile-name: DbGate-Release
+
+          files-folder: app/dist
+          files-folder-filter: exe
+
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Copy artifacts
         run: |
           mkdir artifacts          

.github/workflows/build-app.yaml

@@ -13,9 +13,7 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - macos-14
           - windows-2022
-          - ubuntu-22.04
     steps:
       - name: Install python 3.11 (MacOS)
         if: matrix.os == 'macos-14'
@@ -62,8 +60,8 @@ jobs:
           yarn run build:app
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
-          WIN_CSC_LINK: ${{ secrets.WINCERT_2025 }}
-          WIN_CSC_KEY_PASSWORD: ${{ secrets.WINCERT_2025_PASSWORD }}
+          # WIN_CSC_LINK: ${{ secrets.WINCERT_2025 }}
+          # WIN_CSC_KEY_PASSWORD: ${{ secrets.WINCERT_2025_PASSWORD }}
           CSC_LINK: ${{ secrets.APPLECERT_CERTIFICATE }}
           CSC_KEY_PASSWORD: ${{ secrets.APPLECERT_PASSWORD }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
@@ -74,6 +72,24 @@ jobs:
       - name: generatePadFile
         run: |
           yarn generatePadFile
+
+
+      - name: Sign Windows artifacts with Azure Trusted Signing
+        uses: azure/trusted-signing-action@v0
+        with:
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+
+          endpoint: https://wus3.codesigning.azure.net/
+          trusted-signing-account-name: DbGate
+          certificate-profile-name: DbGate-Release
+
+          files-folder: app/dist
+          files-folder-filter: exe
+
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Copy artifacts
         run: |
           mkdir artifacts          

.github/workflows/build-docker.yaml

@@ -1,95 +0,0 @@
-# --------------------------------------------------------------------------------------------
-# This file is generated. Do not edit manually
-# --------------------------------------------------------------------------------------------
-name: Docker image Community
-'on':
-  push:
-    tags:
-      - v[0-9]+.[0-9]+.[0-9]+
-      - v[0-9]+.[0-9]+.[0-9]+-beta.[0-9]+
-jobs:
-  build:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os:
-          - ubuntu-22.04
-    steps:
-      - name: Context
-        env:
-          GITHUB_CONTEXT: ${{ toJson(github) }}
-        run: echo "$GITHUB_CONTEXT"
-      - uses: actions/checkout@v2
-        with:
-          fetch-depth: 1
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v4
-        with:
-          images: dbgate/dbgate
-          flavor: |
-            latest=false
-          tags: |
-            type=raw,value=beta,enable=${{ contains(github.ref_name, '-docker.') || contains(github.ref_name, '-beta.') }}
-
-            type=match,pattern=\d+.\d+.\d+,enable=${{ !contains(github.ref_name, '-docker.') && !contains(github.ref_name, '-beta.') }}
-            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-docker.') && !contains(github.ref_name, '-beta.') }}
-      - name: Docker alpine meta
-        id: alpmeta
-        uses: docker/metadata-action@v4
-        with:
-          images: |
-            dbgate/dbgate
-          flavor: |
-            latest=false
-          tags: |
-            type=raw,value=beta-alpine,enable=${{ contains(github.ref_name, '-docker.') || contains(github.ref_name, '-beta.') }}
-
-            type=match,pattern=\d+.\d+.\d+,suffix=-alpine,enable=${{ !contains(github.ref_name, '-docker.') && !contains(github.ref_name, '-beta.') }}
-            type=raw,value=alpine,enable=${{ !contains(github.ref_name, '-docker.') && !contains(github.ref_name, '-beta.') }}
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@v1
-        with:
-          node-version: 22.x
-      - name: adjustPackageJson
-        run: |
-
-          node adjustPackageJson --community
-      - name: yarn install
-        run: |
-
-          # yarn --version
-          # yarn config set network-timeout 300000
-          yarn install
-      - name: setCurrentVersion
-        run: |
-
-          yarn setCurrentVersion
-      - name: Prepare docker image
-        run: |
-
-          yarn run prepare:docker
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: Login to DockerHub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build and push
-        uses: docker/build-push-action@v3
-        with:
-          push: true
-          context: ./docker
-          tags: ${{ steps.meta.outputs.tags }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-      - name: Build and push alpine
-        uses: docker/build-push-action@v3
-        with:
-          push: true
-          context: ./docker
-          file: ./docker/Dockerfile-alpine
-          tags: ${{ steps.alpmeta.outputs.tags }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7

.github/workflows/winsigntest.yaml

@@ -0,0 +1,39 @@
+# --------------------------------------------------------------------------------------------
+# This file is generated. Do not edit manually
+# --------------------------------------------------------------------------------------------
+name: WinSignTest
+'on':
+  push:
+    branches:
+      - winsign
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    environment: dbgate-app
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - windows-2022
+    steps:
+      - name: Check OIDC availability
+        if: matrix.os == 'windows-2022'
+        run: |
+          echo "OIDC URL: $env:ACTIONS_ID_TOKEN_REQUEST_URL"
+          echo "OIDC TOKEN: ${{ steps.none.outputs.nothing || '' }}"
+          echo "Client ID: ${{ secrets.AZURE_TC_CLIENT_ID }}"
+          echo "Tenant ID: ${{ secrets.AZURE_TC_TENANT_ID }}"
+        shell: pwsh
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v2
+        if: matrix.os == 'windows-2022'
+        with:
+          client-id: ${{ secrets.AZURE_TC_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TC_TENANT_ID }}
+          allow-no-subscriptions: true

package.json

@@ -1,6 +1,6 @@
 {
   "private": true,
-  "version": "6.6.6-premium-beta.2",
+  "version": "6.6.6-beta.14",
   "name": "dbgate-all",
   "workspaces": [
     "packages/*",