CI: Windows binary signing fails with 403 Forbidden from Azure Trusted Signing

What happened

The `Build app and sign files (with Trusted Signing)` job in the Go package workflow is failing on main with a 403 Forbidden from the Azure Trusted Signing service.

• Failing run: https://github.com/DefangLabs/defang/actions/runs/34920774466
• Commit: 1c8a395a74584a32f6136cae25cc6a767430079f (#2273, "Allow UDP ingress on dual-protocol ports")
• Confirmed not transient: reran the failed job and it failed again with the identical error.

Azure.RequestFailedException: Service request failed.
Status: 403 (Forbidden)
Error information: "Error: SignerSign() failed." (-2147467259/0x80004005)

Why this isn't a code issue

• The azure/login OIDC step in the same job succeeds — authentication works fine.
• go-test, nix-shell-test, and the macOS build/sign job all pass.
• The failure happens specifically on the Trusted Signing step's call to SignAsync against:
  • Trusted Signing account: DefangLabs
  • Certificate profile: signed-binary-test (used for non-tag pushes; see .github/workflows/go.yml)

A 403 here (after a successful login) points to an authorization problem on the Azure side — e.g. the service principal's role assignment on the Trusted Signing account/certificate profile was revoked, expired, or the certificate profile itself is disabled/missing — rather than anything in the PR that triggered this run.

Checked for precedent

No prior occurrence found in the last several weeks of "Go package" workflow failures — this is a first-time failure mode for this step.

Ask

Someone with access to the DefangLabs Azure Trusted Signing account needs to check:

• The RBAC role assignment for the CI service principal (AZURE_CLIENT_ID used in .github/workflows/go.yml) on the Trusted Signing resource.
• Whether the signed-binary-test certificate profile is still active.

I don't have Azure portal access from this environment to investigate further.

🤖 Filed by an automated CI-failure watch on agent-box.

Start with the failing “Build app and sign files (with Trusted Signing)” job in .github/workflows/go.yml and the linked GitHub Actions run. Check the CI service principal’s access to the DefangLabs Trusted Signing account and the signed-binary-test certificate profile. Done means the Windows signing step succeeds on a rerun without the 403 error.