ci; add Windows signing

.github/workflows/rust.yml

@@ -125,20 +125,47 @@ jobs:
 
       - run: rustup update ${{ matrix.toolchain }} && rustup default ${{ matrix.toolchain }}
       - uses: Swatinem/rust-cache@v2
+      
       - name: Build Release
         shell: bash
-        # Removed this because this it seems not worth the hussle
-        #  if [[ "${{ runner.arch }}" == "X64" ]]; then
-        #     export RUSTFLAGS="$RUSTFLAGS -C target-cpu=x86-64-v3"
-        #   fi
         run: |
           cargo build --verbose --release
+          
       - name: Prepare artifacts
         shell: bash
         run: |
           mkdir -p dist
           if [ "${{ runner.os }}" == "Windows" ]; then EXT=".exe"; fi
           cp "target/release/pumpkin$EXT" "dist/pumpkin-${{ runner.arch }}-${{ runner.os }}$EXT"
+
+      - name: Upload unsigned executable for SignPath (Windows only)
+        if: runner.os == 'Windows'
+        id: upload_unsigned
+        uses: actions/upload-artifact@v7
+        with:
+          name: unsigned-${{ runner.arch }}-${{ runner.os }}
+          path: dist/pumpkin-*
+          retention-days: 1
+
+      - name: Submit SignPath signing request (Windows only)
+        if: runner.os == 'Windows'
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
+          project-slug: '${{ secrets.SIGNPATH_PROJECT_SLUG }}'
+          signing-policy-slug: '${{ secrets.SIGNPATH_SIGNING_POLICY_SLUG }}'
+          github-artifact-id: '${{ steps.upload_unsigned.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: dist/signed/
+
+      - name: Overwrite with signed version (Windows only)
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          cp dist/signed/* dist/
+          rm -rf dist/signed/
+
       - name: Export executable
         uses: actions/upload-artifact@v7
         with: