Sign with SignPath

.github/workflows/build.yml

@@ -60,6 +60,7 @@ jobs:
         run: Src\Setup\BuildBinaries.bat
 
       - name: Upload binaries
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
         id: upload-binaries
         uses: actions/upload-artifact@v7
         with:
@@ -69,8 +70,10 @@ jobs:
             !Src/Setup/Output/*.skin
             !Src/Setup/Output/*.skin7
             !Src/Setup/Output/*.zip
+          retention-days: 1
 
       - name: Sign binaries with SignPath
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
         uses: signpath/github-action-submit-signing-request@v2
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
@@ -89,14 +92,17 @@ jobs:
         run: Src\Setup\_BuildEnglish.bat
 
       - name: Upload installers
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
         id: upload-installers
         uses: actions/upload-artifact@v7
         with:
           name: MSI
           path: |
             Src/Setup/Temp/*.msi
+          retention-days: 1
 
       - name: Sign installers with SignPath
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
         uses: signpath/github-action-submit-signing-request@v2
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
@@ -108,40 +114,64 @@ jobs:
           wait-for-completion: true
           output-artifact-directory: 'Src/Setup/Temp/'
 
-      - name: Build final
+      - name: Build setup and symbols
         shell: cmd
         env:
           CS_VERSION: ${{ steps.versioning.outputs.NEW_VERSION }}
         run: Src\Setup\BuildArchives.bat
 
-      - name: Upload final
+      - name: Upload symbols
-        id: upload-final
         uses: actions/upload-artifact@v7
         with:
-          name: Final
           path: |
-            Src/Setup/Final/
+            Src/Setup/Final/OpenShellSymbols*.7z
-            !Src/Setup/Final/OpenShellLoc.zip
+          archive: false
 
-      - name: Sign final artifacts with SignPath
+      - name: Upload utility
+        uses: actions/upload-artifact@v7
+        with:
+          path: |
+            Src/Setup/Final/Utility.exe
+          archive: false
+
+      - name: Upload setup
+        id: upload-setup
+        uses: actions/upload-artifact@v7
+        with:
+          path: |
+            Src/Setup/Final/OpenShellSetup*.exe
+          archive: false
+
+      - name: Sign setup with SignPath
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
         uses: signpath/github-action-submit-signing-request@v2
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
           organization-id: 'b34b60e3-e5bf-4a6e-a13c-dcf641b4362c'
           project-slug: 'Open-Shell-Menu'
           signing-policy-slug: 'test-signing'
-          artifact-configuration-slug: 'Final'
+          github-artifact-id: '${{ steps.upload-setup.outputs.artifact-id }}'
-          github-artifact-id: '${{ steps.upload-final.outputs.artifact-id }}'
           wait-for-completion: true
+          skip-decompress: true
           output-artifact-directory: 'Src/Setup/Final/'
 
-      - name: Upload final (signed)
+      # `overwrite: true` doesn't work with `archive: false`, so we have to delete the original first
+      # https://github.com/actions/upload-artifact/issues/769
+      # https://github.com/actions/upload-artifact/issues/785
+      - name: Delete setup
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
+        uses: geekyeggo/delete-artifact@v6
+        with:
+            name: OpenShellSetup*.exe
+
+      - name: Upload setup (signed)
+        if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
         uses: actions/upload-artifact@v7
         with:
-          name: Final-signed
           path: |
-            Src/Setup/Final/
+            Src/Setup/Final/OpenShellSetup*.exe
-            !Src/Setup/Final/OpenShellLoc.zip
+          archive: false
+          overwrite: true
 
   release:
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' # Only manual master builds
@@ -150,7 +180,29 @@ jobs:
     permissions:
       contents: write # Elevate permissions ONLY for this job
     steps:
-      - name: Download artifacts
+      - name: Download setup
         uses: actions/download-artifact@v8
         with:
-          name: OpenShell
+          pattern: OpenShellSetup*.exe
+      - name: Download symbols
+        uses: actions/download-artifact@v8
+        with:
+          pattern: OpenShellSymbols*.7z
+      - name: Download utility
+        uses: actions/download-artifact@v8
+        with:
+          pattern: Utility.exe
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: v${{ needs.build.outputs.new_version }}
+          name: ${{ needs.build.outputs.new_version }}
+          generate_release_notes: true
+          prerelease: true
+          files: |
+            OpenShellSetup*.exe
+            OpenShellSymbols_*.7z
+            Utility.exe
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Src/Setup/BuildArchives.bat

@@ -160,10 +160,10 @@ cd ..
 
 cd Setup
 
-copy /B ..\..\build\bin\Release\Utility.exe .\Final > nul
+copy /B Output\Utility.exe .\Final > nul
 
 if defined APPVEYOR (
-	appveyor PushArtifact ..\..\build\bin\Release\Utility.exe
+	appveyor PushArtifact Output\Utility.exe
 )
 
 exit /b 0

Src/Setup/BuildBinaries.bat

@@ -55,6 +55,7 @@ copy /B ..\..\build\bin\Setup\StartMenuHelper32.dll Output > nul
 copy /B ..\..\build\bin\Release\Update.exe Output > nul
 copy /B ..\..\build\bin\Release\DesktopToasts.dll Output > nul
 copy /B ..\..\build\bin\Release\SetupHelper.exe Output > nul
+copy /B ..\..\build\bin\Release\Utility.exe Output > nul
 
 copy /B ..\..\build\bin\SetupARM64\ClassicExplorer64.dll Output\ARM64 > nul
 copy /B ..\..\build\bin\SetupARM64\ClassicIEDLL_64.dll Output\ARM64 > nul