refresh GHA testing

.github/workflows/label-add-to-project.yml

@@ -9,7 +9,6 @@ on:
 
 jobs:
   add_to_project:
-    if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'dependabot/')
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -22,7 +21,7 @@ jobs:
     steps:
       - name: Add issue/PR to GitHub Project
         if: github.event.label.name == '${{ matrix.flag }}'
-        uses: actions/add-to-project@v1.0.0
+        uses: actions/add-to-project@v2
         with:
           project-url: https://github.com/orgs/lando/projects/10
           github-token: ${{ secrets.SHADOW_COUNCIL_ESCALATOR }}

.github/workflows/pr-azure-tests.yaml

@@ -0,0 +1,49 @@
+name: PR Azure Tests
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  azure-artifact-signing-tests:
+    runs-on: windows-2025
+    env:
+      term: xterm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Install node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+      - name: Install dependencies
+        shell: bash
+        run: npm ci --prefer-offline
+      - name: Package node binary
+        shell: bash
+        run: npm run build
+      - name: Codesign
+        id: code-sign-action
+        uses: ./
+        with:
+          file: ${{ github.workspace }}\dist\@lando\code-sign-action.exe
+          certificate-id: lando
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure-signing-account-name: lando
+          azure-signing-endpoint: https://eus.codesigning.azure.net/
+      - name: Test output
+        shell: bash
+        run: |
+          echo "${{ steps.code-sign-action.outputs.file }}"
+          stat "${{ steps.code-sign-action.outputs.file }}"
+      - name: Execute file
+        shell: bash
+        run: chmod +x "${{ steps.code-sign-action.outputs.file }}" && "${{ steps.code-sign-action.outputs.file }}"

.github/workflows/pr-default-tests.yaml

@@ -0,0 +1,67 @@
+name: PR Default Tests
+
+on:
+  pull_request:
+
+jobs:
+  default-signtool-tests:
+    runs-on: ${{ matrix.os }}
+    env:
+      term: xterm
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-15
+            file: dist/@lando/code-sign-action
+          - os: macos-15
+            file: /Users/runner/work/code-sign-action/code-sign-action/dist/@lando/code-sign-action
+          - os: windows-2025
+            file: dist\@lando\code-sign-action.exe
+          - os: windows-2025
+            file: D:\a\code-sign-action\code-sign-action/dist\@lando\code-sign-action.exe
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Install node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+      - name: Install dependencies
+        shell: bash
+        run: npm ci --prefer-offline
+      - name: Package node binary
+        shell: bash
+        run: npm run build
+      - name: Trust Apple signer test anchor on Windows
+        if: runner.os == 'Windows'
+        shell: powershell
+        env:
+          APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}
+          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
+        run: |
+          .\scripts\trust-apple-signer.ps1 `
+            -CertificateData $env:APPLE_CERT_DATA `
+            -CertificatePassword $env:APPLE_CERT_PASSWORD `
+            -ExpectedSubject "*466VYKC9T5*"
+
+      - name: Codesign
+        id: code-sign-action
+        uses: ./
+        with:
+          file: ${{ matrix.file }}
+          certificate-data: ${{ secrets.APPLE_CERT_DATA }}
+          certificate-id: 466VYKC9T5
+          certificate-password: ${{ secrets.APPLE_CERT_PASSWORD }}
+      - name: Test output
+        shell: bash
+        run: |
+          echo "${{ steps.code-sign-action.outputs.file }}"
+          stat "${{ steps.code-sign-action.outputs.file }}"
+      - name: Execute file
+        shell: bash
+        run: chmod +x "${{ steps.code-sign-action.outputs.file }}" && "${{ steps.code-sign-action.outputs.file }}"

.github/workflows/pr-keylocker-tests.yaml

@@ -0,0 +1,49 @@
+name: PR KeyLocker Tests
+
+# PR triggering is disabled because the current KeyLocker account/secrets are no longer valid.
+on:
+  workflow_dispatch:
+  # pull_request:
+
+jobs:
+  keylocker-tests:
+    runs-on: windows-2025
+    env:
+      term: xterm
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Install node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+      - name: Install dependencies
+        shell: bash
+        run: npm ci --prefer-offline
+      - name: Package node binary
+        shell: bash
+        run: npm run build
+      - name: Codesign
+        id: code-sign-action
+        uses: ./
+        with:
+          file: dist/@lando/code-sign-action.exe
+          certificate-data: ${{ secrets.KEYLOCKER_CLIENT_CERT }}
+          certificate-password: ${{ secrets.KEYLOCKER_CLIENT_CERT_PASSWORD }}
+          keylocker-host: https://clientauth.one.digicert.com
+          keylocker-api-key: ${{ secrets.KEYLOCKER_API_KEY }}
+          keylocker-cert-sha1-hash: ${{ secrets.KEYLOCKER_CERT_SHA1_HASH }}
+          keylocker-keypair-alias: ${{ secrets.KEYLOCKER_KEYPAIR_ALIAS }}
+      - name: Test output
+        shell: bash
+        run: |
+          echo "${{ steps.code-sign-action.outputs.file }}"
+          stat "${{ steps.code-sign-action.outputs.file }}"
+      - name: Execute file
+        shell: bash
+        run: chmod +x "${{ steps.code-sign-action.outputs.file }}" && "${{ steps.code-sign-action.outputs.file }}"

.github/workflows/pr-notarization-tests.yaml

@@ -0,0 +1,46 @@
+name: PR Notarization Tests
+
+on:
+  pull_request:
+
+jobs:
+  notarize-tests:
+    runs-on: macos-15
+    env:
+      term: xterm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Install node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+      - name: Install dependencies
+        shell: bash
+        run: npm ci --prefer-offline
+      - name: Package node binary
+        shell: bash
+        run: npm run build
+      - name: Codesign
+        id: code-sign-action
+        uses: ./
+        with:
+          file: dist/@lando/code-sign-action
+          certificate-data: ${{ secrets.APPLE_CERT_DATA }}
+          certificate-password: ${{ secrets.APPLE_CERT_PASSWORD }}
+          apple-notary-user: ${{ secrets.APPLE_NOTARY_USER }}
+          apple-notary-password: ${{ secrets.APPLE_NOTARY_PASSWORD }}
+          apple-team-id: 466VYKC9T5
+          apple-product-id: dev.lando.code-sign-action
+          options: --options runtime --entitlements entitlements.xml
+      - name: Test output
+        shell: bash
+        run: |
+          echo "${{ steps.code-sign-action.outputs.file }}"
+          stat "${{ steps.code-sign-action.outputs.file }}"
+      - name: Execute file
+        shell: bash
+        run: chmod +x "${{ steps.code-sign-action.outputs.file }}" && "${{ steps.code-sign-action.outputs.file }}"