Repository navigation
Low priority pre-release checklist item (not for immediate action): move the SignPath action to v3 #4218
Description
Low priority. Do not work this now. Make this change as a step of the checklist before a release, when someone can watch the signing steps of that release.
What to change
In .github/workflows/build.yml, change signpath/github-action-submit-signing-request@v2 to @v3 in these five steps:
- Sign Lite
- Sign Darling
- Sign Lite (Velopack)
- Sign Darling Viewer (Velopack)
- Sign the executables Velopack generates
Change all five in one PR, so that every signing request in a release goes to the same SignPath service.
Why
- v3 is the current version of the SignPath action. The only functional change from v2 is the default
connector-url. v3 sends signing requests to SignPath's new Pipeline Connector instead ofgithubactions.connectors.signpath.io. - v2 still works. PerformanceMonitor signed v3.8.0 with v2 on 2026-09-18. SignPath has not announced an end date for the v2 connector, so this change is not urgent.
- Dependabot does not watch GitHub Actions in this repository, so nothing makes this change automatically.
What is already done
- The SignPath GitHub App is installed on this repository (2026-09-24). The Pipeline Connector needs the app. Without it, every signing attempt fails with
Failed to retrieve GitHub App token. - PerformanceStudio moved to v3 first. Its v1.27.0 release signed with v3 on 2026-09-25. The details are in v1.27.0 release did not sign after the SignPath action moved to v3 PerformanceStudio#569.
- This repository has no
.signpath/policiesfiles. The Pipeline Connector reads those files differently, so that change does not affect this repository.
Risks
- This workflow signs after the release is published (
release: published). If signing fails on the first v3 run, the public release has no signed assets until a re-run succeeds. - SignPath signs only the first 3 attempts of a run. If a signing step fails, read the error in the step log before you re-run.
How to check the change
Watch the first release run after the change. Each of the five signing steps must submit its request to SignPath and then wait for approval.
Activity
List the SignPath action pin among the LF-reading tests (#4218)
Sign releases with SignPath's v3 action (#4218) (#4459)
erikdarlingdata commentedon Oct 2, 2026
Claude posting for Erik Darling.
Fixed by #4459, merged to dev as 28d1385. All five SignPath signing steps in
.github/workflows/build.yml(Sign Lite, Sign Darling, Sign Lite (Velopack), Sign Darling Viewer (Velopack), Sign the executables Velopack generates) now usesignpath/github-action-submit-signing-request@v3, andSignPathActionVersionTestspins all five.The signing steps run only when a release is published, so the first release published after this is the first v3 run. Watch each of the five steps submit its request to SignPath and wait for approval. If one fails, read its error before any re-run: SignPath signs only a run's first 3 attempts.