fix(windows): sign release binaries

[Pimpmuckl]

Summary

• move stable and preview Windows releases into dedicated windows-signing environment jobs
• authenticate to Azure with GitHub OIDC and sign only the raw first-party herdr.exe with SHA-256 plus an RFC3161 timestamp before ConPTY packaging
• verify the Authenticode signature and timestamp, then preserve existing artifact names, preview metadata, and post-package hashes

Validation

• actionlint .github/workflows/release.yml .github/workflows/preview.yml
• just check
• Review Suite fast: clean (rvw_b2b412b6)

Merge gate

Keep this pull request draft and do not merge it until all external signing infrastructure is provisioned and live-validated:

• Azure Organization Public Trust identity validation is complete for the company
• a company-owned Azure Artifact Signing Public Trust certificate profile is active
• the GitHub OIDC federated identity is configured and has the profile-scoped Artifact Signing Certificate Profile Signer role
• the canonical repository has a protected windows-signing environment with AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID, AZURE_ARTIFACT_SIGNING_ENDPOINT, AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME, and AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME
• a canonical preview workflow has produced a signed artifact, and that artifact has been tested on Windows

The Azure values and live signing path are not yet validated. This change does not claim that Smart App Control is fixed; that requires a canonical signed preview and Windows testing.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• ai-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: c38503cb-2093-4359-9815-4c02ed3e3afc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 734a1e52-8d6a-44da-ada1-e850a1e2a857

📥 Commits

Reviewing files that changed from the base of the PR and between 4dd9aa5 and 13623a2.

📒 Files selected for processing (2)

• .github/workflows/preview.yml
• .github/workflows/release.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The preview and release workflows remove Windows from their build matrices. Each workflow adds a dedicated Windows job for MSVC compilation, Azure OIDC signing, signature verification, packaging, and artifact upload. Preview publishing and release creation now wait for the Windows job. Non-Windows release builds use shared libghostty environment variables and continue to package artifacts from the matrix.

Suggested reviewers: ogulcancelik

Merge Risk: 🟡 Moderate · up to 13623

Windows releases now depend on Azure signing infrastructure and a protected signing environment, but those prerequisites and a signed Windows artifact have not yet been live-validated. Merging now could cause release jobs to fail or leave signing behavior unverified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: signing Windows release binaries.
Description check	✅ Passed	The description directly explains the Windows signing workflow, Azure OIDC authentication, signature verification, validation, and merge prerequisites.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kangal-bot]

@coderabbitai review
@greptileai

[coderabbitai]

@kangal-bot I will review pull request #3437.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[greptile-apps]

Greptile Summary

The PR moves Windows preview and stable builds into dedicated environment-gated jobs so the first-party executable can be signed and verified before ConPTY packaging.

• Adds Azure OIDC authentication and Artifact Signing for herdr.exe.
• Verifies the Authenticode signature and RFC3161 timestamp before packaging.
• Preserves the existing Windows ZIP name, preview build metadata, checksum generation, and downstream publication dependencies.

Confidence Score: 5/5

The workflow changes appear safe to merge after the explicitly documented external signing infrastructure and canonical Windows validation gates are completed.

The signing, verification, packaging, artifact naming, checksum handling, and downstream job dependencies are internally consistent, with no concrete code-level failure identified.

Important Files Changed

Filename	Overview
.github/workflows/preview.yml	Splits the Windows preview build into an OIDC-enabled signing job while retaining the existing ZIP, checksum, BUILD_INFO, and publishing contracts.
.github/workflows/release.yml	Adds a dedicated signed Windows release job and makes release publication wait for its packaged artifact.

Sequence Diagram

sequenceDiagram
    participant G as GitHub Actions
    participant A as Azure Artifact Signing
    participant P as ConPTY Packager
    participant R as Release Publisher
    G->>G: Build herdr.exe
    G->>A: Authenticate with OIDC
    A-->>G: Sign herdr.exe with timestamp
    G->>G: Verify signature and timestamp
    G->>P: Package signed executable
    P-->>G: Windows ZIP
    G->>R: Upload artifact and checksum

Loading

_{Reviews (1): Last reviewed commit: "fix(windows): sign release binaries" | Re-trigger Greptile}