toolkit/.github/workflows/sign.yml

name: Sign installers

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag name (e.g. v1.2.3). If empty, will use latest.'
        required: false
        default: ''
  workflow_run:
    workflows: ["Builder main installer"]
    types: [completed]

permissions:
  contents: read
  id-token: write

jobs:
  sign:
    if: >
      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
      || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest

    steps:
      - name: Determine release tag
        id: tag
        uses: actions/github-script@v7
        with:
          script: |
            const inputTag = '${{ github.event.inputs.tag }}';
            if (inputTag) return inputTag;
            if (context.eventName === 'workflow_run') {
              return context.payload.workflow_run.event.release.tag_name;
            }
            const latest = await github.rest.repos.getLatestRelease({
              owner: context.repo.owner,
              repo: context.repo.repo
            });
            return latest.data.tag_name;

      - name: Download release assets
        uses: repo-sync/download-release@v2
        with:
          owner: ${{ github.repository_owner }}
          repo: ${{ github.repository }}
          tag: ${{ steps.tag.outputs.result }}
          pattern: '*.exe'

      - name: Install cosign
        run: |
          curl -sSL -o cosign \
            https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
          chmod +x cosign

      - name: Fetch OIDC token
        id: oidc
        uses: actions/github-script@v7
        with:
          script: |
            // return GitHub OIDC token scoped for sigstore
            return await github.actions.getOIDCToken({audience: 'sigstore'});

      - name: Keyless sign installers
        env:
          COSIGN_EXPERIMENTAL: '1'
        run: |
          for exe in *.exe; do
            ./cosign sign-blob \
              --identity-token "${{ steps.oidc.outputs.result }}" \
              "$exe"
          done

      - name: Verify signatures
        run: |
          for exe in *.exe; do
            ./cosign verify-blob \
              --certificate-identity "https://github.com/${{ github.repository }}" \
              "$exe" --signature "$exe.sig"
          done