ci: Update signing

Author: jeromelaban

.github/workflows/runtime-ci.yml

@@ -347,6 +347,10 @@ jobs:
     name: Sign Package
     if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) }}
     runs-on: windows-latest
+
+    permissions:
+      id-token: write # Required for requesting the JWT
+
     needs: [package_job,build_aot_windows_job,build_aot_linux_job]
     steps:
       - name: Checkout
@@ -362,22 +366,40 @@ jobs:
       - name: Setup .NET SDK
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '3.1.x'
+          dotnet-version: '9.0.x'
 
-      - name: Setup SignClient
-        run: |
-          dotnet tool install --tool-path build SignClient
+      # Install the code signing tool
+      - name: Install Sign CLI tool
+        run: dotnet tool install --tool-path . sign --version 0.9.1-beta.25278.1
 
-      - name: SignClient
+      # Login to Azure using a ServicePrincipal configured to authenticate against a GitHub Action
+      - name: 'Az CLI login'
+        uses: azure/login@v1
+        with:
+          allow-no-subscriptions: true
+          client-id: ${{ secrets.SIGN_AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.SIGN_AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.SIGN_AZURE_SUBSCRIPTION_ID }}
+
+      # Run the signing command
+      - name: Sign artifacts
         shell: pwsh
-        run: |
-          build\SignClient sign -i artifacts\*.nupkg -c build\signing\SignClient.json -r "${{ secrets.UNO_PLATFORM_CODESIGN_USERNAME }}" -s "${{ secrets.UNO_PLATFORM_CODESIGN_SECRET }}" -n "dotnet runtime" -d "dotnet runtime" -u "https://github.dev/unoplatform/Uno.DotnetRuntime.WebAssembly"
+        run: >
+          ./sign code azure-key-vault
+          artifacts/*.nupkg
+          --publisher-name "Uno.DotnetRuntime.WebAssembly"
+          --description "Uno.DotnetRuntime.WebAssembly"
+          --description-url "https://github.com/${{ github.repository }}"
+          --azure-key-vault-managed-identity true
+          --azure-key-vault-url "${{ secrets.SIGN_KEY_VAULT_URL }}"
+          --azure-key-vault-certificate "${{ secrets.SIGN_KEY_VAULT_CERTIFICATE_ID }}"
+          --verbosity information
 
       - name: Upload Signed Artifacts
         uses: actions/upload-artifact@v4
         with:
           name: nuget-signed
-          path: .\artifacts        
+          path: .\artifacts
 
   publish_dev:
     name: Publish Dev