feat: Windows Signing

Author: Rishabh4275

.github/workflows/publish.yml

@@ -7,6 +7,7 @@ on:
   push:
     branches:
       - main
+      - windowsSigning
 
 jobs:
   build-and-publish:
@@ -49,11 +50,59 @@ jobs:
           npm run postinstall
           npm run build
 
-      - name: Publish Windows release
+      - name: Get package version
         if: matrix.platform == 'win'
+        id: get-version
+        shell: bash
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "artifact-name=Cobolt-Setup-$VERSION.exe" >> $GITHUB_OUTPUT
+
+      - name: Check if release already exists
+        if: matrix.platform == 'win'
+        id: check-release
+        shell: bash
+        run: |
+          RELEASE_EXISTS=$(gh release view "v${{ steps.get-version.outputs.version }}" --json assets,draft --jq 'if .draft == false then .assets | map(select(.name == "${{ steps.get-version.outputs.artifact-name }}")) | length else 0 end' 2>/dev/null || echo "0")
+          echo "release-exists=$RELEASE_EXISTS" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build Windows executable (no publish)
+        if: matrix.platform == 'win'
+        run: npm exec electron-builder -- --win --publish=never
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm exec electron-builder -- --publish --win
+
+      - name: upload-unsigned-artifact
+        id: upload-unsigned-artifact
+        if: matrix.platform == 'win' && steps.check-release.outputs.release-exists == '0'
+        uses: actions/upload-artifact@v4
+        with: 
+          name: unsigned-installer
+          retention-days: 1
+          path: release/build/Cobolt-Setup-${{ steps.get-version.outputs.version }}.exe
+
+      - name: Sign artifact
+        if: matrix.platform == 'win' && steps.check-release.outputs.release-exists == '0'
+        uses: signpath/github-action-submit-signing-request@v1.1
+        with:
+          api-token: ${{secrets.SIGNPATH_API_TOKEN}}
+          organization-id: 3fe5dc9d-e6f6-4c25-83e5-70c5844441b9
+          project-slug: cobolt
+          signing-policy-slug: test-signing
+          github-artifact-id: ${{steps.upload-unsigned-artifact.outputs.artifact-id}}
+          wait-for-completion: true
+          output-artifact-directory: signed-artifacts
+
+      - name: Publish Windows release with signed executable
+        if: matrix.platform == 'win' && steps.check-release.outputs.release-exists == '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Create or update release with signed executable
+          gh release create "v${{ steps.get-version.outputs.version }}" signed-artifacts/${{ steps.get-version.outputs.artifact-name }} --title "v${{ steps.get-version.outputs.version }}" --notes "Release v${{ steps.get-version.outputs.version }}" || gh release upload "v${{ steps.get-version.outputs.version }}" signed-artifacts/${{ steps.get-version.outputs.artifact-name }} --clobber
 
       - name: Publish macOS release
         if: matrix.platform == 'mac'
@@ -70,4 +119,4 @@ jobs:
         if: matrix.platform == 'linux'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm exec electron-builder -- --publish always --linux
+        run: npm exec electron-builder -- --publish always --linux

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cobolt",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Your personal AI companion",
   "keywords": [],
   "repository": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cobolt",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Cobolt",
   "license": "MIT",
   "author": {