sign windows executable with signpath

.github/actions/upload_ide/action.yml

@@ -8,6 +8,12 @@ inputs:
   artifacts_dir:
     description: 'IDE artifacts output directory'
     required: true
+
+outputs:
+  artifact-id:
+    description: 'output from actions/upload-artifact'
+    value: ${{ steps.upload.outputs.artifact-id }}
+
 runs:
   using: composite
   steps:
@@ -35,6 +41,7 @@ runs:
         fi
     - name: Upload ${{inputs.suffix}}
       uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      id: upload
       with:
         name: ${{inputs.os}}${{inputs.suffix}}-unsigned
         if-no-files-found: 'error'

.github/workflows/IntelliJ_IDEA.yml

@@ -41,6 +41,7 @@ jobs:
   build:
     needs: get_version
     uses: ./.github/workflows/ide_build_and_upload.yml
+    secrets: inherit
     with:
       artifacts_dir: out/idea-ce/artifacts
       product: intellij_idea
@@ -67,10 +68,11 @@ jobs:
           prerelease: false
           draft: true
           files: |
-            **/*.tar.gz
-            **/*.AppImage
-            **/*.zsync
-            **/*.exe
-            **/*.dmg
-            **/*.spdx.json
-
+            linux-*/*.tar.gz
+            linux-*/*.AppImage
+            linux-*/*.zsync
+            linux-*/*.spdx.json
+            windows-signed/rebased.exe
+            windows-signed/*.spdx.json
+            mac-*/*.dmg
+            mac-*/*.spdx.json

.github/workflows/ide_build_and_upload.yml

@@ -20,6 +20,8 @@ permissions: {}
 jobs:
   distributions:
     runs-on: ubuntu-latest
+    outputs:
+      unsigned-windows-artifact-id: ${{ steps.upload-unsigned-artifact.outputs.artifact-id }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -42,6 +44,7 @@ jobs:
           artifacts_dir: ${{inputs.artifacts_dir}}
       - name: upload-windows-x64
         uses: ./.github/actions/upload_ide
+        id: upload-unsigned-artifact
         with:
           os: windows
           suffix: .exe
@@ -169,4 +172,25 @@ jobs:
         with:
           os: linux
           suffix: -${{ matrix.arch.appimage }}.AppImage
-          artifacts_dir: .
+          artifacts_dir: .
+  sign-windows-exe:
+    runs-on: ubuntu-latest
+    needs: distributions
+    steps:
+      - name: submit signing request
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '6fa8204e-d307-43a0-bd8b-39b0883fc150'
+          project-slug: 'rebased'
+          signing-policy-slug: 'release-signing'
+          github-artifact-id: '${{ needs.distributions.outputs.unsigned-windows-artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: 'signed-exe'
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        id: upload
+        with:
+          name: windows-signed
+          if-no-files-found: 'error'
+          retention-days: 1
+          path: 'signed-exe/*'

.signpath/policies/rebased/release-signing.yml

@@ -0,0 +1,4 @@
+github-policies:
+  runners:
+    allowed_groups:
+      - 'GitHub Actions'  # GitHub-hosted runners

README.md

@@ -29,6 +29,13 @@ You can either download the installer `.exe` from [GitHub releases](https://gith
 winget install detachhead.rebased --source winget
 ```
 
+<table>
+  <tr>
+    <td><a href="https://signpath.io/"><img src="https://signpath.org/assets/favicon-50x50.png" alt="SignPath" width="32" /></a></td>
+    <td>Free code signing on Windows provided by <a href="https://signpath.io/">SignPath.io</a>, certificate by <a href="https://signpath.org/">SignPath Foundation</a></td>
+  </tr>
+</table>
+
 ### macOS
 
 Install with [homebrew](https://brew.sh/):