From 977045cc881d8656e889925f4661b4c4f64737da Mon Sep 17 00:00:00 2001
From: David Lane <42013603+ReenigneArcher@users.noreply.github.com>
Date: Tue, 10 Mar 2026 21:54:59 -0400
Subject: [PATCH] build(windows): sign windows executables (#4829)

---
 .github/workflows/ci-windows.yml | 62 ++++++++++++++++++++++++++++++++
 .github/workflows/ci.yml         |  8 +++++
 2 files changed, 70 insertions(+)

diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
index 783d74c3..8a210a9b 100644
--- a/.github/workflows/ci-windows.yml
+++ b/.github/workflows/ci-windows.yml
@@ -5,12 +5,41 @@ permissions: {}
 on:
   workflow_call:
     inputs:
+      # Azure Artifact Signing account name
+      azure_signing_account:
+        required: false
+        type: string
+        default: ''
+      # Azure Artifact Signing certificate profile name
+      azure_signing_cert_profile:
+        required: false
+        type: string
+        default: ''
+      # Azure Artifact Signing account endpoint
+      # e.g. https://<region>.codesigning.azure.net
+      azure_signing_endpoint:
+        required: false
+        type: string
+        default: ''
+      publish_release:
+        required: true
+        type: string
       release_commit:
         required: true
         type: string
       release_version:
         required: true
         type: string
+    secrets:
+      # Azure Client ID (App Registration) for Artifact Signing
+      AZURE_CLIENT_ID:
+        required: false
+      # Azure Client Secret for Artifact Signing
+      AZURE_CLIENT_SECRET:
+        required: false
+      # Azure Tenant ID for Artifact Signing
+      AZURE_TENANT_ID:
+        required: false
 
 jobs:
   build_windows:
@@ -217,6 +246,25 @@ jobs:
           ninja -C build
           echo "::remove-matcher owner=gcc::"
 
+      - name: Sign Windows executables
+        if: inputs.publish_release == 'true' && inputs.azure_signing_account != ''
+        uses: azure/trusted-signing-action@87c2e83e6868da99d3380aa309851b32ed9a8346  # v1.1.0
+        with:
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          certificate-profile-name: ${{ inputs.azure_signing_cert_profile }}
+          endpoint: ${{ inputs.azure_signing_endpoint }}
+          files: |
+            ${{ github.workspace }}/build/sunshine.exe
+            ${{ github.workspace }}/build/tools/audio-info.exe
+            ${{ github.workspace }}/build/tools/dxgi-info.exe
+            ${{ github.workspace }}/build/tools/sunshinesvc.exe
+          files-folder: src_assets/windows
+          files-folder-filter: ps1
+          files-folder-recurse: true
+          signing-account-name: ${{ inputs.azure_signing_account }}
+
       - name: Package Windows
         shell: msys2 {0}
         run: |
@@ -233,6 +281,20 @@ jobs:
           mv ./cpack_artifacts/Sunshine.msi ../artifacts/Sunshine-${{ matrix.name }}-installer.msi
           mv ./cpack_artifacts/Sunshine.zip ../artifacts/Sunshine-${{ matrix.name }}-portable.zip
 
+      - name: Sign Windows installers
+        if: inputs.publish_release == 'true' && inputs.azure_signing_account != ''
+        uses: azure/trusted-signing-action@87c2e83e6868da99d3380aa309851b32ed9a8346  # v1.1.0
+        with:
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          certificate-profile-name: ${{ inputs.azure_signing_cert_profile }}
+          endpoint: ${{ inputs.azure_signing_endpoint }}
+          files-folder: artifacts
+          files-folder-filter: exe,msi
+          files-folder-recurse: false
+          signing-account-name: ${{ inputs.azure_signing_account }}
+
       - name: Debug nsis
         if: always()
         shell: msys2 {0}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a587b408..246dc795 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -158,8 +158,16 @@ jobs:
       contents: read
     uses: ./.github/workflows/ci-windows.yml
     with:
+      azure_signing_account: ${{ vars.AZURE_SIGNING_ACCOUNT }}
+      azure_signing_cert_profile: ${{ vars.AZURE_SIGNING_CERT_PROFILE }}
+      azure_signing_endpoint: ${{ vars.AZURE_SIGNING_ENDPOINT }}
+      publish_release: ${{ needs.release-setup.outputs.publish_release }}
       release_commit: ${{ needs.release-setup.outputs.release_commit }}
       release_version: ${{ needs.release-setup.outputs.release_version }}
+    secrets:
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
 
   bundle-analysis:
     name: Bundle Analysis