From c207c2c19f28e45cc87f4977fae47dced81a6ae5 Mon Sep 17 00:00:00 2001
From: Kamron Batman <3953314+kamronbatman@users.noreply.github.com>
Date: Thu, 9 Apr 2026 08:55:19 -0600
Subject: [PATCH] chore: Signs build tool (#2406)

---
 .github/workflows/build-tool-release.yml | 67 +++++++++++++++++++++++-
 1 file changed, 65 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-tool-release.yml b/.github/workflows/build-tool-release.yml
index 5061d15cb..c5aea1933 100644
--- a/.github/workflows/build-tool-release.yml
+++ b/.github/workflows/build-tool-release.yml
@@ -59,8 +59,56 @@ jobs:
           name: ${{ matrix.artifact }}
           path: publish/${{ matrix.artifact }}
 
-  release:
+  sign:
     needs: build
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    name: Sign (${{ matrix.artifact }})
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    strategy:
+      matrix:
+        include:
+          - artifact: build-tool-win-x64.exe
+          - artifact: build-tool-win-arm64.exe
+
+    steps:
+      - name: Download unsigned artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: ${{ matrix.artifact }}
+          path: unsigned/
+
+      - name: Upload for signing
+        id: upload-for-signing
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ matrix.artifact }}-unsigned
+          path: unsigned/${{ matrix.artifact }}
+
+      - name: Submit signing request
+        id: submit
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
+          project-slug: 'modernuo'
+          signing-policy-slug: 'test-signing'
+          artifact-configuration-slug: 'build-tool'
+          github-artifact-id: '${{ steps.upload-for-signing.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: signed/
+
+      - name: Upload signed artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ matrix.artifact }}-signed
+          path: signed/${{ matrix.artifact }}
+
+  release:
+    needs: [build, sign]
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     permissions:
@@ -74,9 +122,24 @@ jobs:
           git tag -f build-tool-latest
           git push origin build-tool-latest --force
 
-      - name: Download all artifacts
+      - name: Download signed Windows artifacts
         uses: actions/download-artifact@v8
         with:
+          pattern: '*-signed'
+          path: artifacts/
+          merge-multiple: true
+
+      - name: Download macOS artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: 'build-tool-osx-*'
+          path: artifacts/
+          merge-multiple: true
+
+      - name: Download Linux artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: 'build-tool-linux-*'
           path: artifacts/
           merge-multiple: true