From b10eaa4d7d750fd76f74d608116a5e3abcd82134 Mon Sep 17 00:00:00 2001
From: ge0rdi <ge0rdi@users.noreply.github.com>
Date: Sun, 31 May 2026 09:31:43 +0200
Subject: [PATCH] Sign with SignPath

---
 .github/workflows/build.yml | 47 +++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9790730..05ae336 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -60,6 +60,7 @@ jobs:
         run: Src\Setup\BuildBinaries.bat
 
       - name: Upload binaries
+        id: upload-binaries
         uses: actions/upload-artifact@v7
         with:
           name: Binaries
@@ -69,6 +70,18 @@ jobs:
             !Src/Setup/Output/*.skin7
             !Src/Setup/Output/*.zip
 
+      - name: Sign binaries with SignPath
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'b34b60e3-e5bf-4a6e-a13c-dcf641b4362c'
+          project-slug: 'Open-Shell-Menu'
+          signing-policy-slug: 'test-signing'
+          artifact-configuration-slug: 'Binaries'
+          github-artifact-id: '${{ steps.upload-binaries.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: 'Src/Setup/Output/'
+
       - name: Build installers
         shell: cmd
         env:
@@ -76,12 +89,25 @@ jobs:
         run: Src\Setup\_BuildEnglish.bat
 
       - name: Upload installers
+        id: upload-installers
         uses: actions/upload-artifact@v7
         with:
           name: MSI
           path: |
             Src/Setup/Temp/*.msi
 
+      - name: Sign installers with SignPath
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'b34b60e3-e5bf-4a6e-a13c-dcf641b4362c'
+          project-slug: 'Open-Shell-Menu'
+          signing-policy-slug: 'test-signing'
+          artifact-configuration-slug: 'Installers'
+          github-artifact-id: '${{ steps.upload-installers.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: 'Src/Setup/Temp/'
+
       - name: Build final
         shell: cmd
         env:
@@ -89,6 +115,7 @@ jobs:
         run: Src\Setup\BuildArchives.bat
 
       - name: Upload final
+        id: upload-final
         uses: actions/upload-artifact@v7
         with:
           name: Final
@@ -96,6 +123,26 @@ jobs:
             Src/Setup/Final/
             !Src/Setup/Final/OpenShellLoc.zip
 
+      - name: Sign final artifacts with SignPath
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: 'b34b60e3-e5bf-4a6e-a13c-dcf641b4362c'
+          project-slug: 'Open-Shell-Menu'
+          signing-policy-slug: 'test-signing'
+          artifact-configuration-slug: 'Final'
+          github-artifact-id: '${{ steps.upload-final.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: 'Src/Setup/Final/'
+
+      - name: Upload final (signed)
+        uses: actions/upload-artifact@v7
+        with:
+          name: Final-signed
+          path: |
+            Src/Setup/Final/
+            !Src/Setup/Final/OpenShellLoc.zip
+
   release:
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
     needs: build