feat(release): sign Windows artifacts with Azure

.github/workflows/ci.yml

@@ -54,6 +54,27 @@ jobs:
       - name: Analyze
         shell: pwsh
         run: fvm flutter analyze --no-fatal-infos
+
+      - name: Validate PowerShell Scripts
+        shell: pwsh
+        run: |
+          $parseErrors = @(
+            Get-ChildItem -Path scripts, installer -Filter "*.ps1" -File | ForEach-Object {
+              $tokens = $null
+              $parseFileErrors = $null
+              [void][System.Management.Automation.Language.Parser]::ParseFile(
+                $_.FullName,
+                [ref]$tokens,
+                [ref]$parseFileErrors
+              )
+              $parseFileErrors
+            }
+          )
+
+          if ($parseErrors.Count -gt 0) {
+            throw "PowerShell parse errors: $($parseErrors.Message -join ', ')"
+          }
+
       - name: Run Tests
         shell: pwsh
         run: fvm flutter test

.github/workflows/release-desktop.yml

@@ -44,6 +44,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   build:
@@ -54,6 +55,11 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Require Main Branch
+        if: ${{ github.ref != 'refs/heads/main' }}
+        shell: pwsh
+        run: throw "Signed desktop releases must be dispatched from main."
+
       - uses: dart-lang/setup-dart@v1
 
       - name: Add Pub Cache To PATH
@@ -69,18 +75,104 @@ jobs:
         shell: pwsh
         run: fvm install
 
-      - name: Run Desktop Release Script
+      - name: Build Windows Release Binaries
+        shell: pwsh
+        env:
+          POSTHOG_PROJECT_TOKEN: ${{ secrets.POSTHOG_PROJECT_TOKEN }}
+        run: |
+          powershell -ExecutionPolicy Bypass -File scripts/release_desktop.ps1 -Phase build -VersionBump "${{ inputs.version_bump }}" -Channel "${{ inputs.channel }}"
+
+      - name: Sign In To Azure With OIDC
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Sign Windows Release Binaries
+        uses: azure/artifact-signing-action@v2
+        with:
+          endpoint: ${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
+          signing-account-name: ${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
+          files-folder: ${{ github.workspace }}\build\windows\x64\runner\Release
+          files-folder-filter: exe,dll
+          files-folder-recurse: true
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+          exclude-environment-credential: true
+          exclude-workload-identity-credential: true
+          exclude-managed-identity-credential: true
+          exclude-shared-token-cache-credential: true
+          exclude-visual-studio-credential: true
+          exclude-visual-studio-code-credential: true
+          exclude-azure-cli-credential: false
+          exclude-azure-powershell-credential: true
+          exclude-azure-developer-cli-credential: true
+          exclude-interactive-browser-credential: true
+
+      - name: Build Signed Updater Archive And Installer
+        shell: pwsh
+        run: |
+          powershell -ExecutionPolicy Bypass -File scripts/release_desktop.ps1 -Phase package -Channel "${{ inputs.channel }}"
+
+      - name: Sign Windows Installer
+        uses: azure/artifact-signing-action@v2
+        with:
+          endpoint: ${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
+          signing-account-name: ${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
+          files-folder: ${{ github.workspace }}\build\installer
+          files-folder-filter: exe
+          files-folder-recurse: false
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+          exclude-environment-credential: true
+          exclude-workload-identity-credential: true
+          exclude-managed-identity-credential: true
+          exclude-shared-token-cache-credential: true
+          exclude-visual-studio-credential: true
+          exclude-visual-studio-code-credential: true
+          exclude-azure-cli-credential: false
+          exclude-azure-powershell-credential: true
+          exclude-azure-developer-cli-credential: true
+          exclude-interactive-browser-credential: true
+
+      - name: Verify Authenticode Signatures
+        shell: pwsh
+        run: |
+          $releaseFiles = Get-ChildItem -Path "build/windows/x64/runner/Release" -Recurse -File -Include "*.exe", "*.dll"
+          $installerFiles = Get-ChildItem -Path "build/installer" -File -Filter "*.exe"
+          $signedFiles = @($releaseFiles) + @($installerFiles)
+
+          if ($signedFiles.Count -eq 0) {
+            throw "No Windows executables or libraries were found to verify."
+          }
+
+          $invalidFiles = @(
+            $signedFiles | Where-Object {
+              (Get-AuthenticodeSignature -FilePath $_.FullName).Status -ne "Valid"
+            }
+          )
+          if ($invalidFiles.Count -gt 0) {
+            throw "Invalid Authenticode signatures: $($invalidFiles.FullName -join ', ')"
+          }
+
+          Write-Host "Verified $($signedFiles.Count) signed Windows files."
+
+      - name: Stage And Publish Desktop Release
         shell: pwsh
         env:
           CHANGE_MESSAGE: ${{ inputs.change_message }}
           RELEASE_TITLE: ${{ inputs.release_title }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          POSTHOG_PROJECT_TOKEN: ${{ secrets.POSTHOG_PROJECT_TOKEN }}
         run: |
           $args = @(
             "-ExecutionPolicy", "Bypass",
             "-File", "scripts/release_desktop.ps1",
-            "-VersionBump", "${{ inputs.version_bump }}",
+            "-Phase", "stage",
             "-Channel", "${{ inputs.channel }}",
             "-ChangeMessage", $env:CHANGE_MESSAGE
           )