tests sign msi installer

.github/workflows/windows-msi.yml

@@ -221,7 +221,35 @@ jobs:
           echo "MSI_NAME=$outputName" >> $env:GITHUB_ENV
 
       # ----------------------------------------------------------------
-      # 10. Upload the MSI artifact
+      # 10. Sign the MSI with SignPath
+      # ----------------------------------------------------------------
+      - name: Install SignPath PowerShell module
+        shell: pwsh
+        run: |
+          Install-Module -Name SignPath -Force -Scope CurrentUser
+
+      - name: Sign MSI with SignPath
+        shell: pwsh
+        run: |
+          $msi = Get-ChildItem "$env:GITHUB_WORKSPACE\dist\*.msi" | Select-Object -First 1
+          if (-not $msi) {
+            Write-Error "No .msi found in dist/"
+            exit 1
+          }
+          Write-Host "Signing: $($msi.FullName)"
+          Submit-SigningRequest `
+            -InputArtifactPath $msi.FullName `
+            -ApiToken "${{ secrets.SIGNPATH_API_TOKEN }}" `
+            -OrganizationId "${{ secrets.SIGNPATH_ORGANIZATION_ID }}" `
+            -ProjectSlug "MSI" `
+            -SigningPolicySlug "test-signing" `
+            -OutputArtifactPath $msi.FullName `
+            -Force `
+            -WaitForCompletion
+          Write-Host "Signing complete: $($msi.Name)"
+
+      # ----------------------------------------------------------------
+      # 11. Upload the MSI artifact
       # ----------------------------------------------------------------
       - name: Upload MSI artifact
         uses: actions/upload-artifact@v4