Plugin signing

[ilimurzin]

Isn't a plugin supposed to be signed before publishing a new version to the Marketplace?

For now Release workflow upload an unsigned version of plugin.

[ilimurzin]

Problem

If we set up an environment variables like on this screenshot:

and tries to publish plugin through Release workflow, we publish an unsigned plugin. Sign step is skipped because environment variables are not passed to the publishPlugin task.

Possible solution

Add

env:
+  CERTIFICATE_CHAIN: ${{ secrets.CERTIFICATE_CHAIN }}
+  PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
+  PRIVATE_KEY_PASSWORD: ${{ secrets.PRIVATE_KEY_PASSWORD }}
  PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}

to the Publish Plugin step of Release workflow.

Then the sign step of publishPlugin will not be skipped.

Am I getting something wrong, or is it how it should to be?

[hsz]

Thank you, Vladimir! I've added your changes to the Release workflow. Good job on that!