Update release.yml for OSS

Author: seerge

.github/workflows/release.yml

@@ -4,13 +4,12 @@ on:
   release:
     types: [ published ]
   workflow_dispatch:
-  
 
 permissions:
   contents: write
   id-token: write
   attestations: write
-  
+
 jobs:
   release:
     runs-on: windows-2022
@@ -20,18 +19,40 @@ jobs:
       uses: actions/setup-dotnet@v4
       with:
         dotnet-version: '8.0.x'
+
     - name: Publish
       run: |
         dotnet publish app/GHelper.sln --configuration Release --runtime win-x64 -p:PublishSingleFile=true --no-self-contained
-        powershell Compress-Archive app/bin/x64/Release/net8.0-windows/win-x64/publish/GHelper.exe GHelper.zip
-    - name: Upload
+
+    - name: Upload unsigned EXE
+      id: upload-unsigned
+      uses: actions/upload-artifact@v4
+      with:
+        path: app/bin/x64/Release/net8.0-windows/win-x64/publish/GHelper.exe
+
+    - id: sign-exe
+      uses: signpath/[email protected]
+      with:
+        api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+        organization-id: ${{ secrets.SIGNPATH_ORG_ID }}
+        project-slug: ${{ secrets.SIGNPATH_PROJECT }}
+        signing-policy-slug: ${{ secrets.SIGNPATH_POLICY }}
+        github-artifact-id: ${{ steps.upload-unsigned.outputs.artifact-id }}
+        wait-for-completion: true
+        output-artifact-directory: './signed'
+
+    - name: Create ZIP from signed EXE
+      run: powershell Compress-Archive ./signed/GHelper.exe ./signed/GHelper.zip
+
+    - name: Upload signed EXE and ZIP
       env:
         GH_TOKEN: ${{ github.token }}
       run: |
-        gh release upload ${{ github.ref_name }} app/bin/x64/Release/net8.0-windows/win-x64/publish/GHelper.exe GHelper.zip
+        gh release upload ${{ github.ref_name }} ./signed/GHelper.exe ./signed/GHelper.zip
+
     - name: Generate SLSA build provenance attestation
       uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
-          app/bin/x64/Release/net8.0-windows/win-x64/publish/GHelper.exe
-          GHelper.zip
+          ./signed/GHelper.exe
+          ./signed/GHelper.zip