Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Around line 114-117: The "Move Signed Artifacts" job step runs mv to place the
built binary into signed/ but the signed/ directory is not created, causing mv
to fail; update that step (the line containing mv unsigned/azurehound-bin-${{
matrix.os }}-${{ matrix.arch }}/azurehound.exe signed/azurehound.exe) to ensure
the destination directory exists first (e.g., create signed/ with mkdir -p
signed/ or equivalent) before running mv so the move succeeds reliably.
- Around line 100-112: The workflow step with id "digicert" incorrectly includes
a step-level "shell: bash" (only valid for run steps) and a broken env variable
reference; remove the "shell: bash" line from the Digicert action step and
replace the SM_CLIENT_CERT_FILE env value that currently uses shell expansion
(${SM_CLIENT_CERT_FILE}) with a proper GitHub Actions expression such as ${{
env.SM_CLIENT_CERT_FILE }} (if you set it via GITHUB_ENV earlier) or reference a
secret directly like ${{ secrets.SM_CLIENT_CERT_FILE }} so the env block uses
valid Actions syntax.
- Around line 94-98: Fix the certificate setup step: correct the temp variable
to RUNNER_TEMP, fix the filename typo to "Certificate", and replace the failing
export-with-pipe by echoing the secret (use echo "${{
secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > "$SM_CLIENT_CERT_FILE"
or equivalent). Also ensure SM_CLIENT_CERT_FILE is exported for later steps by
writing the path into $GITHUB_ENV (e.g., echo "SM_CLIENT_CERT_FILE=/path" >>
$GITHUB_ENV) or by providing the path via the step/action env block so
downstream steps can access it; update references to SM_CLIENT_CERT_FILE and
SM_CLIENT_CERT_FILE_B64 accordingly.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Line 7: Sanitize github.ref_name before using it in FILE_NAME by replacing
path characters so branch names like feature/foo don't create nested paths:
update the FILE_NAME assignment (and any places that reference it for 7z and
sha256sum) to use the GitHub Actions expression replace(github.ref_name, '/',
'-') (or a similar replace for other unsafe chars) e.g. set FILE_NAME to ${{
replace(github.ref_name, '/', '-') }} so archives created by 7z and sha256sum
use a safe flat filename.
- Line 139: The workflow currently gates an AWS-dependent job with "if:
github.event_name != 'workflow_dispatch'" but still runs the
aws-actions/configure-aws-credentials step (the step using
aws-actions/configure-aws-credentials around Lines 85-89), causing manual
workflow_dispatch runs to depend on AWS secrets; fix by applying the same gating
to that step (or add an equivalent if conditional to the
configure-aws-credentials step) so configure-aws-credentials only executes when
github.event_name != 'workflow_dispatch', ensuring manual sign-only runs don't
require AWS secrets.