From 361ec67ad9c8b45931a19f9f11aa875911ffe461 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Mail=C3=A4nder?= <matthias@mailaender.name>
Date: Fri, 3 Oct 2025 12:11:06 +0200
Subject: [PATCH] Setup SignPath for Microsoft Authenticode.

---
 .github/workflows/packaging.yml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/packaging.yml b/.github/workflows/packaging.yml
index 4ce7972b39..2e8e397713 100644
--- a/.github/workflows/packaging.yml
+++ b/.github/workflows/packaging.yml
@@ -119,9 +119,30 @@ jobs:
           mkdir -p build/windows
           ./packaging/windows/buildpackage.sh "${GIT_TAG}" "${PWD}/build/windows"
 
+      - name: Upload Installer
+        id: unsigned-artifact
+        uses: actions/upload-artifact@v4
+        with:
+          path: build/windows/*.exe
+
+      - name: Microsoft Authenticode
+        id: signpath
+        uses: signpath/github-action-submit-signing-request@v1
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ secrets.SIGNPATH_ORGANISATION_ID }}'
+          project-slug: 'OpenRA'
+          signing-policy-slug: 'test-signing'
+          github-artifact-id: '${{ steps.unsigned-artifact.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: 'build/windows/signed/'
+          parameters: |
+            version: ${{ toJSON(github.ref_name) }}
+
       - name: Upload Packages
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
-          gh release upload ${{ github.ref_name }} build/windows/*
+          gh release upload ${{ github.ref_name }} build/windows/*.zip
+          gh release upload ${{ github.ref_name }} build/windows/signed/*.exe