feat(ci): add Windows signing process for executable in build workflow (#3417)

Author: afonsojramos

.github/workflows/build.yml

@@ -83,6 +83,31 @@ jobs:
           subject-path: "./spicetify${{ matrix.os == 'windows' && '.exe' || '' }}"
           subject-name: "spicetify v${{ env.TAG }} (${{ matrix.os }}, ${{ (matrix.os == 'windows' && matrix.arch == 'amd64' && 'x64') || (matrix.os == 'windows' && matrix.arch == '386' && 'x32') || matrix.arch }})"
 
+      - name: Upload Artifact for Signing
+        if: env.IS_WIN == 'true'
+        id: upload-artifact-for-signing
+        uses: actions/upload-artifact@v4
+        with:
+          name: spicetify-${{ env.TAG }}-${{ matrix.os }}-${{ (matrix.arch == 'amd64' && 'x64') || (matrix.arch == 'arm64' && 'arm64') || 'x32' }}-unsigned
+          path: ./spicetify.exe
+
+      - name: Sign Windows Executable
+        if: env.IS_WIN == 'true'
+        uses: signpath/github-action-submit-signing-request@v1
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ secrets.SIGNPATH_ORG_ID }}
+          project-slug: "cli"
+          signing-policy-slug: "release-signing"
+          github-artifact-id: ${{ steps.upload-artifact-for-signing.outputs.artifact-id }}
+          wait-for-completion: true
+          output-artifact-directory: "./signed"
+
+      - name: Copy Signed Windows Executable
+        if: env.IS_WIN == 'true'
+        run: |
+          cp ./signed/spicetify.exe ./spicetify.exe
+
       - name: 7z - .tar
         if: env.IS_UNIX == 'true'
         uses: edgarrc/action-7z@v1

README.md

@@ -27,3 +27,7 @@ Supports Windows, MacOS and Linux.
 - [Installation](https://spicetify.app/docs/getting-started)
 - [Basic Usage](https://spicetify.app/docs/getting-started#basic-usage)
 - [FAQ](https://spicetify.app/docs/faq)
+
+### Code Signing Policy
+
+Free code signing provided by [SignPath.io](https://signpath.io), certificate by [SignPath Foundation](https://signpath.org/).