GitHub needs to digitally sign the ps1 scripts.

Description

GitHub/Microsoft does not sign autogenerated ps1 scripted steps, this causes a failure on a self-hosted Windows runners.

For example, let’s take this step:

Run dotnet restore some.csproj

Which is turned into the following ps1 file that gets downloaded to the runner:

C:\actions-runner\_work\_temp\7af2df60-c729-42fb-85a1-d9de2fd74369.ps1

However, when the runner tries to execute it, you get the expected trust error:

The file C:\actions-runner\_work\_temp\7af2df60-c729-42fb-85a1-d9de2fd74369.ps1 is not digitally signed. You cannot run this script on the current system.

The workaround is to change execution policy, but this is extremely dangerous and a very bad idea. Microsoft should sign any ps1 steps it creates.

Area for Triage:

• .NET Core
• Scripting and command line

Question, Bug, or Feature?:

Bug

Virtual environments affected

• macOS 10.15
• Ubuntu 16.04 LTS
• Ubuntu 18.04 LTS
• Ubuntu 20.04 LTS
• Windows Server 2016 R2
• Windows Server 2019
• Self-Hosted Windows Runner

Expected behavior

Steps work

Actual behavior

Steps fail due to unsigned ps1 file.

Run dotnet restore $env:SolutionPath --configfile $env:NugetConfigPath --runtime $env:RID

. : File C:\actions-runner\_work\_temp\7af2df60-c729-42fb-85a1-d9de2fd74369.ps1 cannot be loaded. The file 
C:\actions-runner\_work\_temp\7af2df60-c729-42fb-85a1-d9de2fd74369.ps1 is not digitally signed. You cannot run this 
script on the current system. For more information about running scripts and setting execution policy, see 
about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:3
+ . 'C:\actions-runner\_work\_temp\7af2df60-c729-42fb-85a1-d9de2fd74369 ...
+   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : SecurityError: (:) [], PSSecurityException
    + FullyQualifiedErrorId : UnauthorizedAccess
##[error]Process completed with exit code 1.

Repro steps
A description with steps to reproduce the issue. If your have a public example or repo to share, please provide the link.

1. Create a Windows self-hosted runner
2. Run a workflow that uses any steps that creates a ps1 file for the step’s instructions.

For a repro example, you can use the following:

name: GitHub Actions Repro

on:
  push

jobs:
  build:
    runs-on: self-hosted

    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - uses: actions/setup-dotnet@v1
      with:
        dotnet-version: '3.1.302'

    # This will fail
    - name: NuGet Restore
      run: dotnet restore some.csproj --runtime win-x86

[jgwinner]

The net result is that Runners are broken for windows.

[GeorgeTsiokos]

Assuming a default install of the runner on Windows,

• download psexec
• execute psexec -i -u "nt authority\network service" powershell.exe
• in the Powershell prompt, run Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser

Ideally the service should run with a virtual account instead of network service.