How do you integrate Venafi CodeSign Protect into a CI/CD pipeline?

The integration is designed so a build job signs artifacts using the same commands it already runs, without ever having local access to the actual signing key.

1. Install a Code Sign Client on the build agent or as part of the build container image — this is what intercepts calls to native signing tools.
2. Configure the build environment and project in TPP's Code Signing module, defining which certificate template, key, and approval policy applies to that pipeline.
3. Authenticate the pipeline to TPP using a scoped service account credential (similar in spirit to how VCert authenticates for TLS certificates).
4. Invoke the normal signing command — signtool, jarsigner, or whatever the platform's native tool is — and the Code Sign Client transparently forwards the actual cryptographic operation to TPP, which performs it against the HSM-protected key and returns the signature.
5. Verify and package the signed artifact as the pipeline normally would; from the build script's point of view, nothing about the signing command itself changed.

If the project's policy requires approval for production releases, the pipeline's signing request pauses and waits for a release manager to authorize it in TPP before the signature is returned, which is how organizations put a human checkpoint on production signing without slowing down every routine development build.