Merge branch 'feature/code-signing'

.github/workflows/build.yml

@@ -166,6 +166,7 @@ jobs:
 
     - name: ⬆️ Upload Windows Installer
       uses: actions/upload-artifact@v4
+      id: upload-installer
       with:
         if-no-files-found: error
         name: Windows Installer ${{ matrix.architecture_name }}

.github/workflows/nightly_release.yml

@@ -82,6 +82,43 @@ jobs:
           git fetch --tags --recurse-submodules=no
           git log nightly..origin/master --oneline --no-merges --pretty=format:'* %s' >> changelog.md
 
+      - name: ⬆️ Upload Unsigned x86_64 Windows Installer
+        if: false
+        uses: actions/upload-artifact@v4
+        id: upload-installer-x86_64
+        with:
+          if-no-files-found: error
+          name: Windows Installer ${{ matrix.architecture_name }}
+          path: |
+            imhex-*-x86_64.msi
+
+      - name: ⬆️ Upload Unsigned ARM64 Windows Installer
+        if: false
+        uses: actions/upload-artifact@v4
+        id: upload-installer-arm64
+        with:
+          if-no-files-found: error
+          name: Windows Installer ${{ matrix.architecture_name }}
+          path: |
+            imhex-*-arm64.msi
+
+      - name: 🗑️ Delete unsigned installers
+        if: false
+        run: |
+          rm imhex-*.msi
+
+      - name: 🗝️ Sign Installer
+        if: false
+        uses: signpath/github-action-submit-signing-request@v1
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'f605a0e8-86cd-411c-bb6f-e05025afcc33'
+          project-slug: 'ImHex'
+          signing-policy-slug: 'release-signing'
+          github-artifact-id: '${{ steps.upload-installer.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: '.'
+
       - name: 📦 Update Pre-Release
         if: ${{ steps.check_commits.outputs.should_run == 'true' }}
         run: |

.github/workflows/release.yml

@@ -124,6 +124,50 @@ jobs:
           mv "ImHex Web.zip" imhex-${{ env.IMHEX_VERSION }}-Web.zip || true
           rm artifact.tar || true
 
+      - name: ⬆️ Upload Unsigned x86_64 Windows Installer
+        uses: actions/upload-artifact@v4
+        id: upload-installer-x86_64
+        with:
+          if-no-files-found: error
+          name: Windows Installer ${{ matrix.architecture_name }}
+          path: |
+            imhex-*-x86_64.msi
+
+      - name: ⬆️ Upload Unsigned ARM64 Windows Installer
+        uses: actions/upload-artifact@v4
+        id: upload-installer-arm64
+        with:
+          if-no-files-found: error
+          name: Windows Installer ${{ matrix.architecture_name }}
+          path: |
+            imhex-*-arm64.msi
+
+      - name: 🗑️ Delete unsigned installers
+        run: |
+          rm imhex-*.msi
+
+      - name: 🗝️ Sign x86_64 Installer
+        uses: signpath/github-action-submit-signing-request@v1
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'f605a0e8-86cd-411c-bb6f-e05025afcc33'
+          project-slug: 'ImHex'
+          signing-policy-slug: 'release-signing'
+          github-artifact-id: '${{ steps.upload-installer-x86_64.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: '.'
+
+      - name: 🗝️ Sign ARM64 Installer
+        uses: signpath/github-action-submit-signing-request@v1
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'f605a0e8-86cd-411c-bb6f-e05025afcc33'
+          project-slug: 'ImHex'
+          signing-policy-slug: 'release-signing'
+          github-artifact-id: '${{ steps.upload-installer-arm64.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: '.'
+
       - name: ⬆️ Upload everything to release
         uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981
         with: