From 20ff811b1ac044cec678cb1bb48dda93d6b27f6c Mon Sep 17 00:00:00 2001 From: Maximilian Roos Date: Thu, 23 Jul 2026 04:17:22 -0700 Subject: [PATCH 1/2] feat(release): sign Windows binaries via SignPath Adds a SignPath signing step to the Windows release build, gated behind the SIGNPATH_API_TOKEN secret. Non-blocking (continue-on-error) while the project is on SignPath's self-signed test certificate, so a signing hiccup can't take down crates.io/homebrew/winget/AUR publishing. Checksums are recomputed after signing since the signed zip's bytes differ from the unsigned one. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release.yaml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 4661da4278..85dee20a85 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -150,6 +150,35 @@ jobs: # Actually do builds and make zips and whatnot dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json echo "dist ran successfully" + # SignPath is on a self-signed test certificate while the project's OSS + # application is under review, so signing failures are expected and must + # not block crates.io/homebrew/winget/AUR publishing. + - name: Upload unsigned Windows artifact + if: contains(matrix.targets, 'x86_64-pc-windows-msvc') + id: upload-unsigned-windows-artifact + continue-on-error: true + uses: actions/upload-artifact@v7 + with: + name: unsigned-windows-zip + path: target/distrib/worktrunk-x86_64-pc-windows-msvc.zip + - name: Submit SignPath signing request + if: contains(matrix.targets, 'x86_64-pc-windows-msvc') && steps.upload-unsigned-windows-artifact.outcome == 'success' + continue-on-error: true + uses: signpath/github-action-submit-signing-request@v2 + with: + api-token: '${{ secrets.SIGNPATH_API_TOKEN }}' + organization-id: '9424a34f-9491-47e1-a8a2-e0ff32b2a099' + project-slug: 'Worktrunk' + signing-policy-slug: 'Test_signing' + github-artifact-id: '${{ steps.upload-unsigned-windows-artifact.outputs.artifact-id }}' + wait-for-completion: true + output-artifact-directory: 'target/distrib' + - name: Recompute checksum for signed Windows artifact + if: contains(matrix.targets, 'x86_64-pc-windows-msvc') + shell: bash + run: | + cd target/distrib + sha256sum worktrunk-x86_64-pc-windows-msvc.zip > worktrunk-x86_64-pc-windows-msvc.zip.sha256 - id: cargo-dist name: Post-build # We force bash here just because github makes it really hard to get values up From 72b228260c14681d6842082134dae53f00038500 Mon Sep 17 00:00:00 2001 From: Maximilian Roos Date: Thu, 23 Jul 2026 04:28:37 -0700 Subject: [PATCH 2/2] fix(release): point SignPath signing at the correct org The earlier commit used a self-serve free-trial org created by an Okta signup quirk, not the "Worktrunk [OSS]" org SignPath's team actually reviewed and approved for the Foundation program. Repoint at the real org/project/policy slugs, which already had a dedicated low-privilege "CI builds" submitter provisioned for this exact use. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 85dee20a85..b364b3e56d 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -167,9 +167,9 @@ jobs: uses: signpath/github-action-submit-signing-request@v2 with: api-token: '${{ secrets.SIGNPATH_API_TOKEN }}' - organization-id: '9424a34f-9491-47e1-a8a2-e0ff32b2a099' - project-slug: 'Worktrunk' - signing-policy-slug: 'Test_signing' + organization-id: '56bf7020-7661-4b4e-ad77-b627278eaefd' + project-slug: 'worktrunk' + signing-policy-slug: 'test-signing' github-artifact-id: '${{ steps.upload-unsigned-windows-artifact.outputs.artifact-id }}' wait-for-completion: true output-artifact-directory: 'target/distrib'