release.yml

name: Signed Windows Release

on:
  workflow_dispatch:
  release:
    types: [published]

jobs:
  build-sign-and-checksum:
    runs-on: windows-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install hash-locked dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements-dev.txt
      - name: Locate SignTool and decode signing credential
        shell: pwsh
        env:
          CODESIGN_PFX_BASE64: ${{ secrets.WINDOWS_CODESIGN_PFX_BASE64 }}
        run: |
          if (-not $env:CODESIGN_PFX_BASE64) { throw "WINDOWS_CODESIGN_PFX_BASE64 is required" }
          [IO.File]::WriteAllBytes("$PWD\codesign.pfx", [Convert]::FromBase64String($env:CODESIGN_PFX_BASE64))
          $signtool = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin\*\x64\signtool.exe" |
            Sort-Object FullName -Descending | Select-Object -First 1
          if (-not $signtool) { throw "signtool.exe was not found" }
          "PDF_ESIGN_SIGNTOOL=$($signtool.FullName)" | Out-File -FilePath $env:GITHUB_ENV -Append
          "PDF_ESIGN_CODESIGN_PFX=$PWD\codesign.pfx" | Out-File -FilePath $env:GITHUB_ENV -Append
      - name: Build and Authenticode-sign
        shell: cmd
        env:
          PDF_ESIGN_CODESIGN_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_PASSWORD }}
          PDF_ESIGN_TIMESTAMP_URL: ${{ vars.WINDOWS_CODESIGN_TIMESTAMP_URL }}
        run: build.bat
      - name: Package and checksum release
        shell: pwsh
        run: |
          Compress-Archive -Path dist\PDF-eSign\* -DestinationPath dist\PDF-eSign-Windows.zip
          $items = @(
            "dist\PDF-eSign\PDF-eSign.exe",
            "dist\PDF-eSign-Windows.zip"
          )
          $lines = foreach ($item in $items) {
            $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $item).Hash.ToLower()
            "$hash  $([IO.Path]::GetFileName($item))"
          }
          $lines | Set-Content -Encoding ascii dist\SHA256SUMS.txt
          Remove-Item -LiteralPath codesign.pfx -Force
      - uses: actions/upload-artifact@v4
        with:
          name: PDF-eSign-Windows-signed
          path: |
            dist/PDF-eSign-Windows.zip
            dist/SHA256SUMS.txt
      - name: Attach files to published release
        if: github.event_name == 'release'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${{ github.event.release.tag_name }}" dist/PDF-eSign-Windows.zip dist/SHA256SUMS.txt --clobber