fix(release): refresh Azure credentials before signing

[SunkenInTime]

The unpublished release passed early Azure login, but compilation outlasted the five-minute GitHub OIDC assertion. Signing then failed with AADSTS700024 when Azure CLI requested the signing scope. Keep the early configuration check and refresh Azure login immediately before each signing action. Validation: workflow YAML parsing and assertions that both signing actions directly follow a login refresh passed. Reproduced in run 35534131893; another unpublished release will verify the fix.

[coderabbitai]

Warning

Review limit reached

Next included review available in 33 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 24b184f6-91f8-4890-a008-e92670f7cc96

📥 Commits

Reviewing files that changed from the base of the PR and between 138a8a5 and 79d00fe.

📒 Files selected for processing (1)

• .github/workflows/release-desktop.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The reviewed workflow change is safe to merge for the intended Azure credential-refresh behavior.

What we checked:

• Expired binary-signing credentials: The workflow performs a new Azure login after compilation and immediately before binary signing. The signing action allows Azure CLI credentials, so it can use the session from that refreshed login.
• Expired installer-signing credentials: The workflow performs a new Azure login after installer packaging and immediately before installer signing. The signing action allows Azure CLI credentials, and workflow permissions retain the OIDC token required for login.
• Validated that the Windows binary release path in the Windows release workflow is followed by a fresh Azure login and then artifact signing, confirming the expected ordering.
• Validated that the prior installer release path is compared with the current workflow and follows by a fresh Azure login and artifact signing, with the OIDC permission retained.
• Reviewed the release workflow details, including the build lines, the azure/login@v3 usage, the Windows signing action, and the Azure CLI credential enablement, and noted local checks of git status, diff, and Python validation.
• Checked the uploaded evidence that captures signing risk before and after the changes and the workflow excerpt to verify the signing sequence.

Summary

The desktop release workflow now refreshes Azure OIDC authentication after compiling Windows binaries and again after packaging the installer. The checked release configuration confirms each signing action follows its corresponding fresh login and can use the Azure CLI session created by that login.

_{Reviews (1) · Last reviewed commit: "fix(release): refresh Azure credentials ..."}