ci: set secrets just where needed

cloudflightio · Feb 16, 2022 · 8a61c56 · 8a61c56
1 parent 440c950
commit 8a61c56
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -29,11 +29,6 @@ jobs:
   build-msi:
     runs-on: windows-latest
     needs: build-container
-
-    env:
-      PFX_PASSPHRASE: ${{ secrets.PFX_PASSPHRASE }}
-      PFX_THUMBPRINT: ${{ secrets.PFX_THUMBPRINT }}
-      AZURE_SIGN_CLIENT_SECRET: ${{ secrets.AZURE_SIGN_CLIENT_SECRET }}
 
     steps:
     - uses: actions/checkout@v2
@@ -56,10 +51,15 @@ jobs:
     - name: Sign the MSI Package (test)
       run: ./msi/SignInstaller.ps1
       continue-on-error: true
+      env:
+        PFX_PASSPHRASE: ${{ secrets.PFX_PASSPHRASE }}
+        PFX_THUMBPRINT: ${{ secrets.PFX_THUMBPRINT }}
       if: startsWith(github.ref, 'refs/tags/') != true
 
     - name: Sign the MSI Package (release)
       run: ./msi/AzureSignInstaller.ps1
+      env:
+        AZURE_SIGN_CLIENT_SECRET: ${{ secrets.AZURE_SIGN_CLIENT_SECRET }}
       if: startsWith(github.ref, 'refs/tags/')
 
     - name: Move artifact to top