fix(release): verify test signatures without interactive prompts

Trust test certificates temporarily in the CI machine store instead of
the user root store, which displays a confirmation dialog on Windows.
Log certificate import and verification stages and bound their runtime.

Add a Windows-only manual rehearsal for signing integration iterations.
Keep desktop tests on both architectures and require the full test suite
for tag releases and the default rehearsal.

Author: NihilDigit

.github/scripts/verify-windows-signature.ps1

@@ -19,16 +19,19 @@ try {
     if ($TestCertificate) {
         if ($env:GITHUB_ACTIONS -ne 'true') { throw 'Test certificate trust is only permitted on the CI runner' }
         if ($signer.Subject -ne $signer.Issuer) { throw 'Expected a self-signed test certificate' }
-        # 只在临时 runner 上信任本次测试证书，再让 WinVerifyTrust 验证文件内容；不能把 NotTrusted 当通过。
-        $store = [System.Security.Cryptography.X509Certificates.X509Store]::new('Root', 'CurrentUser')
+        # CurrentUser 根存储会弹确认窗口；临时 runner 用机器存储，验证后移除。不能把 NotTrusted 当通过。
+        $store = [System.Security.Cryptography.X509Certificates.X509Store]::new('Root', 'LocalMachine')
         $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
         $existing = $store.Certificates.Find('FindByThumbprint', $signer.Thumbprint, $false)
         if ($existing.Count -eq 0) {
+            Write-Host "Temporarily trusting test certificate $($signer.Thumbprint) on the CI runner"
             $store.Add($signer)
             $added = $true
+            Write-Host 'Test certificate added'
         }
     }
     foreach ($file in $Path) {
+        Write-Host "Verifying Authenticode signature: $file"
         $signature = Get-AuthenticodeSignature -LiteralPath $file
         if ($signature.Status -ne 'Valid') { throw "Invalid signature on ${file}: $($signature.Status) $($signature.StatusMessage)" }
         if (-not $TestCertificate -and -not $signature.TimeStamperCertificate) { throw "Missing timestamp: $file" }

.github/workflows/release.yml

@@ -31,6 +31,10 @@ on:
         description: 演练用的版本号（MAJOR.MINOR.PATCH），不发布
         required: true
         default: '9.9.9'
+      windows-only:
+        description: 仅演练 Windows 签名（仍运行两个架构的桌面单测）
+        type: boolean
+        default: false
 
 concurrency:
   group: release-${{ github.ref }}
@@ -70,13 +74,15 @@ jobs:
   # 发版前把全部测试在真机器上跑一遍：JVM 与各平台的单测，Android 模拟器、Windows 与 macOS 上的原生行为冒烟
   # （含全新安装与应用内更新），并行跑，全绿才开始打正式包。用已发布的 SDK，与下面的正式构建一致
   test:
+    if: github.event_name != 'workflow_dispatch' || !inputs.windows-only
     uses: ./.github/workflows/test.yml
     with:
       desktop: true
       sdk-main: false
 
   # 签名密钥只进这个 job，负责汇总发布的 release 不碰它。
   android:
+    if: github.event_name != 'workflow_dispatch' || !inputs.windows-only
     needs: [version, test]
     runs-on: ubuntu-latest
     env:
@@ -141,6 +147,7 @@ jobs:
 
   windows:
     needs: [version, test]
+    if: ${{ !cancelled() && needs.version.result == 'success' && (needs.test.result == 'success' || (github.event_name == 'workflow_dispatch' && inputs.windows-only)) }}
     permissions:
       contents: read
       actions: read
@@ -227,6 +234,7 @@ jobs:
           output-artifact-directory: ${{ runner.temp }}/signed-launcher
 
       - name: Stage signed application image
+        timeout-minutes: 5
         shell: pwsh
         run: |
           $ErrorActionPreference = 'Stop'
@@ -282,6 +290,7 @@ jobs:
           output-artifact-directory: ${{ runner.temp }}/signed-msi
 
       - name: Verify signed packages
+        timeout-minutes: 10
         shell: pwsh
         run: |
           $ErrorActionPreference = 'Stop'
@@ -319,6 +328,7 @@ jobs:
 
   # Apple 芯片。jpackage 不能交叉构建，Intel Mac 要另起 macos-15-intel runner，暂不出
   macos:
+    if: github.event_name != 'workflow_dispatch' || !inputs.windows-only
     needs: [version, test]
     runs-on: macos-15
     env:
@@ -361,6 +371,7 @@ jobs:
   # x64 AppImage 与 app-image 的 tar.gz。MediaMP 的 mpv 运行库没有 linux-arm64，Linux 只出 x64。
   # 打包时的 AOT 训练要开窗，套一层 xvfb-run；appimagetool 与运行时的版本和摘要钉在 build-appimage.sh 里
   linux:
+    if: github.event_name != 'workflow_dispatch' || !inputs.windows-only
     needs: [version, test]
     runs-on: ubuntu-24.04
     env:

docs/development/windows-signing.md

@@ -54,13 +54,19 @@ Windows job 应显式配置 contents: read、actions: read。所有签名前置
 - x64 和 ARM64 分别在对应 GitHub runner 上验证。
 
 verify-windows-signature.ps1 使用系统 Authenticode 验证签名，并要求 EXE、MSI 使用同一证书。
-测试证书只在 GitHub runner 的 CurrentUser 根证书存储中临时信任，验证完移除；正式签名
+测试证书只在 GitHub runner 的 LocalMachine 根证书存储中临时信任，验证完移除；CurrentUser
+根存储会弹出交互式确认窗口，不适合 CI。正式签名
 还要求时间戳。verify-windows-packages.ps1 检查清单与更新 ZIP，解开便携包并通过
 msiexec /a 解开 MSI，比对各处启动器的 SHA-256。
 
 本机 Gradle 原生缓存需要沙箱外访问；此前 native-platform.dll 加载失败与此有关。
 首次演练完成后的真实签名结果以 Actions run 和 Step summary 中的 SignPath 请求链接为准。
 
+首次完整演练的所有前置测试已通过，GitHub App 安装后两个架构的 EXE 均成功签名。
+调试后续签名步骤可用 `gh workflow run release.yml -f version=9.9.9 -f windows-only=true`，
+仅运行 Windows 构建和两个架构各自的桌面单测；Windows 产物保留在 workflow 中，不汇总
+其他平台、不创建 Release。默认完整演练与 tag 发布仍要求全部前置测试。
+
 ## 官方依据
 
 - [GitHub integration](https://docs.signpath.io/trusted-build-systems/github)