that was a bit of a time sink (port from azure to GitHub Actions, then change all the packaging, and finally prepare all the workflows in our private repo to do the signing)