From 15ba429edb612db9edc9c4c7557ba009736ea0f9 Mon Sep 17 00:00:00 2001
From: Frank Lin <github@linshuang.info>
Date: Sat, 22 Aug 2026 11:13:23 -0700
Subject: [PATCH] Sign Windows release binaries on tag builds

The five SignPath steps were gated on github.event_name ==
'workflow_dispatch', so the run triggered by pushing a ver.* tag skipped
signing entirely while still uploading the portable zip to the release.
That is how the 1.4.1 Windows zip shipped unsigned, and README and NEWS
now state that 1.4.2 onwards is Authenticode-signed.

Detailed Changes:
- **Signing condition**: gate the steps on
  `inputs.sign_windows_binaries || startsWith(github.ref, 'refs/tags/')`
  so a tag build always signs. A failed signing request now fails the job
  instead of silently producing an unsigned artifact. Manual dispatch on a
  non-tag ref is unchanged and still opt-in.
- **Approval timeout**: set wait-for-completion-timeout-in-seconds to 1800.
  The release-signing policy requires a human approver, and the action's
  600s default leaves little room to notice the request and approve it.
- **Input description**: note that tag builds always sign.
---
 .github/workflows/release-winget.yml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release-winget.yml b/.github/workflows/release-winget.yml
index fcbae094e..56bbfb89e 100644
--- a/.github/workflows/release-winget.yml
+++ b/.github/workflows/release-winget.yml
@@ -11,7 +11,7 @@ on:
         description: "Release version or tag, for example 1.2.0, 1.2.1-rc1, 1.2.1-alpha1, or ver.1.2.0"
         required: false
       sign_windows_binaries:
-        description: "Sign Windows binaries with SignPath before packaging"
+        description: "Sign Windows binaries with SignPath before packaging (tag builds always sign)"
         required: true
         type: boolean
         default: false
@@ -84,7 +84,7 @@ jobs:
             -PrepareOnly
 
       - name: Create unsigned SignPath input
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_windows_binaries }}
+        if: ${{ inputs.sign_windows_binaries || startsWith(github.ref, 'refs/tags/') }}
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path release/signpath | Out-Null
@@ -94,7 +94,7 @@ jobs:
             -CompressionLevel Optimal
 
       - name: Upload unsigned SignPath input
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_windows_binaries }}
+        if: ${{ inputs.sign_windows_binaries || startsWith(github.ref, 'refs/tags/') }}
         id: upload-unsigned-signpath-input
         uses: actions/upload-artifact@v7
         with:
@@ -104,7 +104,7 @@ jobs:
           if-no-files-found: error
 
       - name: Submit SignPath signing request
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_windows_binaries }}
+        if: ${{ inputs.sign_windows_binaries || startsWith(github.ref, 'refs/tags/') }}
         uses: signpath/github-action-submit-signing-request@v2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
@@ -114,11 +114,14 @@ jobs:
           artifact-configuration-slug: opencc-winget-portable-win32-x64
           github-artifact-id: ${{ steps.upload-unsigned-signpath-input.outputs.artifact-id }}
           wait-for-completion: true
+          # The release-signing policy requires a human approver; the action's
+          # 600s default is not enough to notice the request and approve it.
+          wait-for-completion-timeout-in-seconds: 1800
           skip-decompress: true
           output-artifact-directory: release/signpath-signed
 
       - name: Restore signed portable staging
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_windows_binaries }}
+        if: ${{ inputs.sign_windows_binaries || startsWith(github.ref, 'refs/tags/') }}
         shell: pwsh
         run: |
           $signedRoot = "release/signpath-signed"
@@ -142,7 +145,7 @@ jobs:
           }
 
       - name: Verify signed portable files
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_windows_binaries }}
+        if: ${{ inputs.sign_windows_binaries || startsWith(github.ref, 'refs/tags/') }}
         shell: pwsh
         run: |
           $files = @(