chore: Signs build tool (#2406)

.github/workflows/build-tool-release.yml

@@ -59,8 +59,56 @@ jobs:
           name: ${{ matrix.artifact }}
           path: publish/${{ matrix.artifact }}
 
-  release:
+  sign:
     needs: build
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    name: Sign (${{ matrix.artifact }})
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    strategy:
+      matrix:
+        include:
+          - artifact: build-tool-win-x64.exe
+          - artifact: build-tool-win-arm64.exe
+
+    steps:
+      - name: Download unsigned artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: ${{ matrix.artifact }}
+          path: unsigned/
+
+      - name: Upload for signing
+        id: upload-for-signing
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ matrix.artifact }}-unsigned
+          path: unsigned/${{ matrix.artifact }}
+
+      - name: Submit signing request
+        id: submit
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
+          project-slug: 'modernuo'
+          signing-policy-slug: 'test-signing'
+          artifact-configuration-slug: 'build-tool'
+          github-artifact-id: '${{ steps.upload-for-signing.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: signed/
+
+      - name: Upload signed artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ matrix.artifact }}-signed
+          path: signed/${{ matrix.artifact }}
+
+  release:
+    needs: [build, sign]
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     permissions:
@@ -74,9 +122,24 @@ jobs:
           git tag -f build-tool-latest
           git push origin build-tool-latest --force
 
-      - name: Download all artifacts
+      - name: Download signed Windows artifacts
         uses: actions/download-artifact@v8
         with:
+          pattern: '*-signed'
+          path: artifacts/
+          merge-multiple: true
+
+      - name: Download macOS artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: 'build-tool-osx-*'
+          path: artifacts/
+          merge-multiple: true
+
+      - name: Download Linux artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: 'build-tool-linux-*'
           path: artifacts/
           merge-multiple: true