feat: Windows Signing

Author: Rishabh4275

.github/workflows/publish.yml

@@ -7,6 +7,7 @@ on:
   push:
     branches:
       - main
+      - windowsSigning
 
 jobs:
   build-and-publish:
@@ -49,11 +50,77 @@ jobs:
           npm run postinstall
           npm run build
 
-      - name: Publish Windows release
+      - name: Get package version
         if: matrix.platform == 'win'
+        id: get-version
+        shell: bash
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "artifact-name=Cobolt-Setup-$VERSION.exe" >> $GITHUB_OUTPUT
+
+      - name: Check if release already exists
+        if: matrix.platform == 'win'
+        id: check-release
+        shell: bash
+        run: |
+          RELEASE_EXISTS=$(gh release view "v${{ steps.get-version.outputs.version }}" --json assets,draft --jq 'if .draft == false then .assets | map(select(.name == "${{ steps.get-version.outputs.artifact-name }}")) | length else 0 end' 2>/dev/null || echo "0")
+          echo "release-exists=$RELEASE_EXISTS" >> $GITHUB_OUTPUT
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm exec electron-builder -- --publish --win
+
+      - name: Build Windows executable (no publish)
+        if: matrix.platform == 'win'
+        run: npm exec electron-builder -- --win --publish=never
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: upload-unsigned-artifact
+        id: upload-unsigned-artifact
+        if: matrix.platform == 'win' && steps.check-release.outputs.release-exists == '0'
+        uses: actions/upload-artifact@v4
+        with: 
+          name: cobolt-unsigned-installer
+          retention-days: 1
+          path: |
+            release/build/Cobolt-Setup-${{ steps.get-version.outputs.version }}.exe
+            release/build/Cobolt-Setup-${{ steps.get-version.outputs.version }}.exe.blockmap
+
+      - name: Sign artifact
+        if: matrix.platform == 'win' && steps.check-release.outputs.release-exists == '0'
+        uses: signpath/github-action-submit-signing-request@v1.1
+        with:
+          api-token: ${{secrets.SIGNPATH_API_TOKEN}}
+          organization-id: 3fe5dc9d-e6f6-4c25-83e5-70c5844441b9
+          project-slug: cobolt
+          signing-policy-slug: test-signing
+          github-artifact-id: ${{steps.upload-unsigned-artifact.outputs.artifact-id}}
+          wait-for-completion: true
+          output-artifact-directory: signed-artifacts
+
+      - name: Update latest.yml with signed artifact details
+        if: matrix.platform == 'win' && steps.check-release.outputs.release-exists == '0'
+        shell: bash
+        run: |
+          # Get the size of the signed executable
+          SIGNED_SIZE=$(stat -c%s "signed-artifacts/${{ steps.get-version.outputs.artifact-name }}")
+          
+          # Update latest.yml to point to signed artifacts
+          if [ -f "release/build/latest.yml" ]; then
+            # Update the file reference and size in latest.yml
+            sed -i "s|size: [0-9]*|size: $SIGNED_SIZE|g" release/build/latest.yml
+            
+            # Copy updated latest.yml to signed-artifacts directory
+            cp release/build/latest.yml signed-artifacts/
+          fi
+
+      - name: Publish Windows release with signed executable
+        if: matrix.platform == 'win' && steps.check-release.outputs.release-exists == '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Create or update release with signed executable
+          gh release create "v${{ steps.get-version.outputs.version }}" signed-artifacts/${{ steps.get-version.outputs.artifact-name }} signed-artifacts/${{ steps.get-version.outputs.artifact-name }}.blockmap signed-artifacts/latest.yml --title "v${{ steps.get-version.outputs.version }}" --notes "Release v${{ steps.get-version.outputs.version }}" --draft || (gh release upload "v${{ steps.get-version.outputs.version }}" signed-artifacts/${{ steps.get-version.outputs.artifact-name }} --clobber && gh release upload "v${{ steps.get-version.outputs.version }}" signed-artifacts/${{ steps.get-version.outputs.artifact-name }}.blockmap --clobber && gh release upload "v${{ steps.get-version.outputs.version }}" signed-artifacts/latest.yml --clobber)
 
       - name: Publish macOS release
         if: matrix.platform == 'mac'
@@ -70,4 +137,4 @@ jobs:
         if: matrix.platform == 'linux'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm exec electron-builder -- --publish always --linux
+        run: npm exec electron-builder -- --publish always --linux

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cobolt",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Your personal AI companion",
   "keywords": [],
   "repository": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cobolt",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Cobolt",
   "license": "MIT",
   "author": {