# SDK Publishing Pipeline (DEVOPS-SDK-63-001)

Scope: registry credentials, signing keys, and secure storage for SDK publishing.

Artifacts
- Scripts: `scripts/sdk/generate-cert.sh`, `scripts/sdk/sign-packages.sh`, `scripts/sdk/publish.sh`.
- CI: `.gitea/workflows/sdk-publish.yml` (build/test if present, sign, publish, and export offline kit).
- Local feed: defaults to `local-nugets/packages` for offline/file-based distribution.

Secrets / env
- `SDK_SIGNING_CERT_B64` — base64 PKCS#12 (PFX) code-signing cert (generate with `generate-cert.sh`).
- `SDK_SIGNING_CERT_PASSWORD` — PFX password (empty allowed for dev).
- `SDK_NUGET_SOURCE` — NuGet feed (HTTP URL or local path; default `local-nugets/packages`).
- `SDK_NUGET_API_KEY` — API key for HTTP feeds (not used for file feeds).

Usage
1) Generate signing cert (dev/stage):
```bash
scripts/sdk/generate-cert.sh
# read base64 from out/sdk-signing/README.txt and load into secrets
```
2) Build/pack SDK (upstream generator publishes .nupkg into `out/sdk/` or `local-nugets/packages/`).
3) Sign packages:
```bash
SDK_SIGNING_CERT_B64=... SDK_SIGNING_CERT_PASSWORD=... scripts/sdk/sign-packages.sh
```
4) Publish:
```bash
SDK_NUGET_SOURCE=https://nuget.example.com/v3/index.json SDK_NUGET_API_KEY=... scripts/sdk/publish.sh
# or to file feed (default): scripts/sdk/publish.sh
```

CI behavior
- Restores, (optionally) builds/tests if SDK solution present, signs any `.nupkg` under `out/sdk` or `local-nugets/packages`, then publishes to `SDK_NUGET_SOURCE`, and uploads `out/sdk` as artifact.
- No-op if no packages present (keeps pipeline green for config-only updates).

Secure storage
- Do not commit keys. Store certs in the CI secret store; for manual ops, keep encrypted blobs outside the repo (e.g., vault entry with `SDK_SIGNING_CERT_B64` + password).