From ae4b3ca7df91ea47ae72ef6a0ec441fce3900e2a Mon Sep 17 00:00:00 2001
From: Victor Irzak <victor.irzak@zomp.com>
Date: Tue, 28 Jul 2026 12:58:57 -0400
Subject: [PATCH] Run the signing tool with dnx instead of installing it

dotnet dnx runs a tool without installing it, so the separate install step is
redundant. Matches how efcore-extensions and the adoption docs invoke it.

Version stays pinned, now at 1.0.34.
---
 .github/workflows/build.yml | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 421689e..020d288 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -146,17 +146,14 @@ jobs:
           name: packages
           path: packages
 
-      # Pinned deliberately: the tool that signs the release should not change without
-      # someone choosing to change it.
-      - name: Install the signing tool
-        run: dotnet tool install --global SignUniversal.Cli --version 1.0.32
-
       - name: Sign
         env:
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_SIGNER_CLIENT_SECRET }}
           AZURE_CLIENT_ID: ${{ secrets.AZURE_SIGNER_CLIENT_ID }}
         if: ${{ env.AZURE_CLIENT_SECRET != '' && github.ref == 'refs/heads/master' }}
+        # dnx runs the tool without installing it. The version stays pinned: the thing
+        # signing the release should not change without someone choosing to change it.
         # --trust-signing-root is required on Linux and its absence is not obvious. Trusted
         # Signing issues from Microsoft Identity Verification Root CA 2020, which Linux trust
         # stores do not carry, and NuGet refuses to sign against a chain it cannot build:
@@ -164,7 +161,7 @@ jobs:
         # The root is installed for this user alone, from the chain the signing service
         # itself returned.
         run: |
-          sign-universal sign packages/*.nupkg --trust-signing-root \
+          dotnet dnx SignUniversal.Cli@1.0.34 --yes sign packages/*.nupkg --trust-signing-root \
             --trusted-signing-endpoint "${{ secrets.TRUSTED_SIGNING_ENDPOINT }}" \
             --trusted-signing-account "${{ secrets.TRUSTED_SIGNING_ACCOUNT }}" \
             --trusted-signing-certificate-profile "${{ secrets.TRUSTED_SIGNING_CERTIFICATE_PROFILE }}"