release-windows.yml

name: Release Windows (SignPath)

# Authenticode-signs the Windows release binaries through SignPath Foundation
# and builds the Windows installer (MSI).
#
# SignPath's OSS program only accepts artifacts that originate from a trusted
# build system, and CircleCI is not one, so the Windows binaries are rebuilt
# here with the same Makefile targets and version variables the CircleCI
# `release` job uses (.circleci/config.yml), submitted for signing, and the
# signed results published as additional `*-signed*` release assets. CircleCI
# stays authoritative for the unsigned assets, SHA256SUMS.txt and its cosign
# bundle; see "Code signing policy" in README.md and docs/project/releasing.md.
#
# The MSI (packaging/msi, scripts/build-msi.sh) is built here rather than in
# CircleCI because the WiX toolset only runs on Windows. Without SignPath the
# `msi` job publishes an unsigned opensysml-<x.y.z>-windows-amd64.msi; with
# SignPath the `msi-signed` job rebuilds it from the signed binaries and has
# the MSI itself signed, published as ...-windows-amd64-signed.msi. The
# bundled z3.exe is never signed (SignPath policy).
#
# Until SignPath approves the project and a maintainer configures the
# SIGNPATH_API_TOKEN secret plus the SIGNPATH_* variables, only the build and
# msi jobs run.
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag (vX.Y.Z) to build and publish the Windows assets for, signing as a tag push would; leaves `version` and `submit` unused
        required: false
        default: ''
      version:
        description: Version to stamp into the binaries (VERSION)
        required: true
        default: v0.0.0-dry-run
      submit:
        description: Submit the build to SignPath (every request needs an Approver; nothing is published)
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: release-windows-${{ github.ref }}
  cancel-in-progress: false

env:
  UNSIGNED_ARTIFACT: windows-amd64-unsigned
  SIGNED_EXE_ARTIFACT: windows-amd64-signed-exe
  UNSIGNED_MSI_ARTIFACT: windows-amd64-msi-unsigned
  PRESIGN_MSI_ARTIFACT: windows-amd64-msi-presign
  MSI_INPUTS_ARTIFACT: windows-msi-inputs
  MSI_SBOM_ARTIFACT: windows-msi-sbom
  SIGNED_MSI_SBOM_ARTIFACT: windows-msi-signed-sbom
  WIX_VERSION: 5.0.2

jobs:
  build:
    name: Build Windows binaries
    runs-on: ubuntu-latest
    timeout-minutes: 30
    outputs:
      version: ${{ steps.version.outputs.version }}
      commit: ${{ steps.version.outputs.commit }}
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
      sign: ${{ steps.gate.outputs.sign }}
    steps:
      - name: Check out repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Set up Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Derive the release version
        id: version
        env:
          REF_TYPE: ${{ github.ref_type }}
          REF_NAME: ${{ github.ref_name }}
          INPUT_TAG: ${{ inputs.tag }}
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          # Tag builds mirror CircleCI's VERSION=${CIRCLE_TAG}; dry runs take the input.
          if [ -n "$INPUT_TAG" ]; then
            VERSION="$INPUT_TAG"
          elif [ "$REF_TYPE" = "tag" ]; then
            VERSION="$REF_NAME"
          else
            VERSION="$INPUT_VERSION"
          fi
          case "$VERSION" in
            v[0-9]*.[0-9]*.[0-9]*) ;;
            *) echo "Error: VERSION '$VERSION' must look like v<major>.<minor>.<patch>[-suffix]"; exit 1 ;;
          esac
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Build sysml, sysml-lsp, sysml-grpc and sysml-mcp for windows/amd64
        env:
          VERSION: ${{ steps.version.outputs.version }}
          COMMIT: ${{ steps.version.outputs.commit }}
        run: |
          # Same derivation as the CircleCI release job, so both builds stamp
          # identical -ldflags and VERSIONINFO values for a tag.
          BUILD_TIME=$(date -u '+%Y-%m-%d_%H:%M:%S')
          GO_VERSION=$(go version | awk '{print $3}')
          mkdir -p dist/unsigned

          GOOS=windows GOARCH=amd64 make build-sysml VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
          mv bin/sysml dist/unsigned/sysml-windows-amd64.exe

          GOOS=windows GOARCH=amd64 make build-lsp VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
          mv bin/sysml-lsp dist/unsigned/sysml-lsp-windows-amd64.exe

          GOOS=windows GOARCH=amd64 make build-grpc VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
          mv bin/sysml-grpc dist/unsigned/sysml-grpc-windows-amd64.exe

          GOOS=windows GOARCH=amd64 make build-mcp VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
          mv bin/sysml-mcp dist/unsigned/sysml-mcp-windows-amd64.exe

      - name: Check the embedded VERSIONINFO matches VERSION
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          for exe in dist/unsigned/*.exe; do
            make windows-versioninfo-check EXE="$exe" VERSION="$VERSION"
          done

      # The installer is built on Windows from these executables and the Z3
      # release packaging/msi/z3.pin names. Its SBOM is written here, from
      # those inputs, with the syft the CircleCI release pins, and travels to
      # the MSI jobs as an artifact to be listed beside the installer's digest.
      - name: Install syft
        run: |
          curl -fsSL --proto '=https' --proto-redir '=https' -o /tmp/syft.tar.gz \
            https://github.com/anchore/syft/releases/download/v1.55.0/syft_1.55.0_linux_amd64.tar.gz
          echo "bb65249542db5fedeeb4d3f9b018b75e7264dbfbbb10486f044581a92f90490d  /tmp/syft.tar.gz" | sha256sum --check --strict
          tar -xzf /tmp/syft.tar.gz -C /tmp syft
          sudo install -m 0755 /tmp/syft /usr/local/bin/syft
          syft version

      - name: Write the installer's software bill of materials from its inputs
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          # The pinned Z3 zip build-msi.sh bundles, refused on a digest mismatch as there.
          # shellcheck source=packaging/msi/z3.pin
          source packaging/msi/z3.pin
          curl -fsSL --proto '=https' --proto-redir '=https' -o "/tmp/${Z3_ZIP}" \
            "https://github.com/Z3Prover/z3/releases/download/z3-${Z3_VERSION}/${Z3_ZIP}"
          echo "${Z3_SHA256}  /tmp/${Z3_ZIP}" | sha256sum --check --strict
          python3 scripts/release-sbom.py --version "$VERSION" --out dist/msi-sbom \
            --msi-inputs dist/unsigned --z3-pin packaging/msi/z3.pin --z3-zip "/tmp/${Z3_ZIP}"
          ls -l dist/msi-sbom

      - name: Upload the installer's SBOM
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ env.MSI_SBOM_ARTIFACT }}
          path: dist/msi-sbom/*.spdx.json
          if-no-files-found: error
          retention-days: 14

      - name: Upload unsigned binaries
        id: upload
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ env.UNSIGNED_ARTIFACT }}
          path: dist/unsigned/*.exe
          if-no-files-found: error
          retention-days: 14

      - name: Upload the MSI packaging inputs
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ env.MSI_INPUTS_ARTIFACT }}
          path: |
            packaging/msi/
            scripts/build-msi.sh
            LICENSE
          if-no-files-found: error
          retention-days: 14

      - name: Decide whether SignPath is configured
        id: gate
        env:
          # Secrets cannot be tested in a job-level `if`, so the decision is
          # made here and the sign job keys off the output.
          HAS_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
          ORGANIZATION_ID: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
          POLICY_SLUG: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
          EVENT_NAME: ${{ github.event_name }}
          INPUT_TAG: ${{ inputs.tag }}
          SUBMIT_INPUT: ${{ inputs.submit }}
        run: |
          sign=true
          if [ "$HAS_TOKEN" != "true" ]; then
            echo "SIGNPATH_API_TOKEN secret is not set: skipping signing."; sign=false
          fi
          for v in ORGANIZATION_ID PROJECT_SLUG POLICY_SLUG; do
            if [ -z "${!v}" ]; then
              echo "SIGNPATH_${v/POLICY_SLUG/SIGNING_POLICY_SLUG} variable is not set: skipping signing."; sign=false
            fi
          done
          # A dispatch against an existing tag publishes, so it signs exactly as a tag push does.
          if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ -z "$INPUT_TAG" ] && [ "$SUBMIT_INPUT" != "true" ]; then
            echo "Dry run without 'submit': skipping signing."; sign=false
          fi
          echo "sign=$sign" >> "$GITHUB_OUTPUT"

  msi:
    name: Build the MSI (unsigned)
    needs: build
    runs-on: windows-latest
    timeout-minutes: 30
    defaults:
      run:
        shell: bash
    steps:
      # No checkout: the tagged tree holds paths Windows cannot check out; the build job ships what the MSI needs.
      - name: Download the MSI packaging inputs
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.MSI_INPUTS_ARTIFACT }}
          path: .

      - name: Download the unsigned binaries
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.UNSIGNED_ARTIFACT }}
          path: dist/unsigned

      # The SBOM the build job wrote from the installer's inputs, published
      # beside it under its name and listed with its digest.
      - name: Download the installer's SBOM
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.MSI_SBOM_ARTIFACT }}
          path: dist/release

      - name: Install WiX
        run: |
          dotnet tool install --global wix --version "$WIX_VERSION"
          wix --version

      - name: Build and validate the MSI
        env:
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          bash scripts/build-msi.sh "$VERSION" dist/unsigned/sysml-windows-amd64.exe dist/unsigned/sysml-lsp-windows-amd64.exe dist/unsigned/sysml-grpc-windows-amd64.exe dist/unsigned/sysml-mcp-windows-amd64.exe
          msi=$(ls dist/opensysml-*-windows-amd64.msi)
          wix msi validate "$msi"
          mkdir -p dist/release
          mv "$msi" dist/release/
          if [ ! -f "dist/release/$(basename "$msi").spdx.json" ]; then
            echo "Error: no SBOM named after $(basename "$msi") in dist/release:"; ls -l dist/release; exit 1
          fi
          (cd dist/release && sha256sum ./*.msi ./*.spdx.json | sed 's|\./||' | tee SHA256SUMS-windows-msi.txt)

      - name: Upload the unsigned MSI as a workflow artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ env.UNSIGNED_MSI_ARTIFACT }}
          path: dist/release/
          if-no-files-found: error
          retention-days: 14

  publish-msi:
    # Only when SignPath is not configured: with SignPath the MSI is published
    # signed by `publish-signed` instead, never both.
    name: Publish the unsigned MSI
    needs: [build, msi]
    if: (github.ref_type == 'tag' || inputs.tag != '') && needs.build.outputs.sign != 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 120
    permissions:
      contents: write
    steps:
      - name: Check out repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Download the unsigned MSI
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.UNSIGNED_MSI_ARTIFACT }}
          path: dist/release

      - name: Wait for CircleCI to publish the gated release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ needs.build.outputs.version }}
          COMMIT: ${{ needs.build.outputs.commit }}
        run: scripts/wait-for-release-gate.sh "$TAG" "$COMMIT"

      - name: Upload the unsigned MSI to the GitHub Release
        uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836 # v2.3.3
        with:
          tag_name: ${{ needs.build.outputs.version }}
          files: dist/release/*
          fail_on_unmatched_files: true
          # Only the MSI assets are touched; the release itself, its notes and
          # every CircleCI-published asset are left as they are.
          overwrite_files: true

  sign:
    name: Sign the binaries with SignPath
    needs: build
    if: needs.build.outputs.sign == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 330
    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - name: Check out repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Set up Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Wait for CircleCI to publish the gated release
        if: github.ref_type == 'tag' || inputs.tag != ''
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ needs.build.outputs.version }}
          COMMIT: ${{ needs.build.outputs.commit }}
        run: scripts/wait-for-release-gate.sh "$TAG" "$COMMIT"

      - name: Submit the signing request to SignPath
        id: signpath
        uses: signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2.3
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
          signing-policy-slug: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
          github-artifact-id: ${{ needs.build.outputs.artifact-id }}
          wait-for-completion: true
          # Release signing policies require a manual approval, so allow time
          # for an Approver to act before the job is failed and needs a re-run.
          wait-for-completion-timeout-in-seconds: "14000"
          output-artifact-directory: dist/signed

      - name: Check the signed binaries still carry VERSION
        env:
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          ls -la dist/signed
          for name in sysml sysml-lsp sysml-grpc sysml-mcp; do
            test -f "dist/signed/${name}-windows-amd64.exe" || { echo "Error: signed ${name}-windows-amd64.exe missing"; exit 1; }
          done
          for exe in dist/signed/*.exe; do
            make windows-versioninfo-check EXE="$exe" VERSION="$VERSION"
          done

      - name: Upload signed binaries
        id: upload
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ env.SIGNED_EXE_ARTIFACT }}
          path: dist/signed/*.exe
          if-no-files-found: error
          retention-days: 14

      # The signed installer is built from these signed executables, whose
      # bytes differ from the unsigned ones: its SBOM is written here, from
      # them, with the same pinned syft and Z3 as the unsigned installer's.
      - name: Install syft
        run: |
          curl -fsSL --proto '=https' --proto-redir '=https' -o /tmp/syft.tar.gz \
            https://github.com/anchore/syft/releases/download/v1.55.0/syft_1.55.0_linux_amd64.tar.gz
          echo "bb65249542db5fedeeb4d3f9b018b75e7264dbfbbb10486f044581a92f90490d  /tmp/syft.tar.gz" | sha256sum --check --strict
          tar -xzf /tmp/syft.tar.gz -C /tmp syft
          sudo install -m 0755 /tmp/syft /usr/local/bin/syft
          syft version

      - name: Write the signed installer's software bill of materials from its inputs
        env:
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          # shellcheck source=packaging/msi/z3.pin
          source packaging/msi/z3.pin
          curl -fsSL --proto '=https' --proto-redir '=https' -o "/tmp/${Z3_ZIP}" \
            "https://github.com/Z3Prover/z3/releases/download/z3-${Z3_VERSION}/${Z3_ZIP}"
          echo "${Z3_SHA256}  /tmp/${Z3_ZIP}" | sha256sum --check --strict
          python3 scripts/release-sbom.py --version "$VERSION" --out dist/msi-sbom \
            --msi-inputs dist/signed --msi-signed --z3-pin packaging/msi/z3.pin --z3-zip "/tmp/${Z3_ZIP}"
          ls -l dist/msi-sbom

      - name: Upload the signed installer's SBOM
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ env.SIGNED_MSI_SBOM_ARTIFACT }}
          path: dist/msi-sbom/*.spdx.json
          if-no-files-found: error
          retention-days: 14

  msi-signed:
    name: Build the MSI from the signed binaries and sign it
    needs: [build, sign]
    runs-on: windows-latest
    timeout-minutes: 330
    defaults:
      run:
        shell: bash
    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      # No checkout: the tagged tree holds paths Windows cannot check out; the build job ships what the MSI needs.
      - name: Download the MSI packaging inputs
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.MSI_INPUTS_ARTIFACT }}
          path: .

      - name: Check the MSI artifact configuration is configured
        env:
          MSI_ARTIFACT_CONFIGURATION_SLUG: ${{ vars.SIGNPATH_MSI_ARTIFACT_CONFIGURATION_SLUG }}
        run: |
          if [ -z "$MSI_ARTIFACT_CONFIGURATION_SLUG" ]; then
            echo "Error: SIGNPATH_MSI_ARTIFACT_CONFIGURATION_SLUG variable is not set; see docs/project/releasing.md."
            exit 1
          fi

      - name: Download the signed binaries
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.SIGNED_EXE_ARTIFACT }}
          path: dist/signed

      - name: Install WiX
        run: |
          dotnet tool install --global wix --version "$WIX_VERSION"
          wix --version

      - name: Build and validate the MSI
        env:
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          bash scripts/build-msi.sh "$VERSION" dist/signed/sysml-windows-amd64.exe dist/signed/sysml-lsp-windows-amd64.exe dist/signed/sysml-grpc-windows-amd64.exe dist/signed/sysml-mcp-windows-amd64.exe
          msi=$(ls dist/opensysml-*-windows-amd64.msi)
          wix msi validate "$msi"
          mkdir -p dist/presign
          mv "$msi" dist/presign/

      - name: Upload the MSI for signing
        id: upload
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ env.PRESIGN_MSI_ARTIFACT }}
          path: dist/presign/*.msi
          if-no-files-found: error
          retention-days: 14

      - name: Submit the MSI signing request to SignPath
        # The MSI artifact configuration must sign only the MSI itself: the
        # .exe files inside are already signed and z3.exe must stay unsigned.
        uses: signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2.3
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
          signing-policy-slug: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
          artifact-configuration-slug: ${{ vars.SIGNPATH_MSI_ARTIFACT_CONFIGURATION_SLUG }}
          github-artifact-id: ${{ steps.upload.outputs.artifact-id }}
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: "14000"
          output-artifact-directory: dist/signed-msi

      - name: Rename the signed MSI
        run: |
          ls -la dist/signed-msi
          mkdir -p dist/release
          for msi in dist/signed-msi/*.msi; do
            mv "$msi" "dist/release/$(basename "${msi%.msi}")-signed.msi"
          done
          ls -la dist/release

      - name: Upload the signed MSI
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: windows-amd64-msi-signed
          path: dist/release/*.msi
          if-no-files-found: error
          retention-days: 14

  publish-signed:
    name: Publish the signed assets
    needs: [build, sign, msi-signed]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
    steps:
      - name: Download the signed binaries
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.SIGNED_EXE_ARTIFACT }}
          path: dist/signed

      - name: Download the signed MSI
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-amd64-msi-signed
          path: dist/release

      # Its SBOM, written by the sign job from the executables SignPath signed
      # and the pinned Z3, under the signed installer's name.
      - name: Download the signed installer's SBOM
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.SIGNED_MSI_SBOM_ARTIFACT }}
          path: dist/release

      # No checkout here either; the LICENSE the sysml-mcp zip carries comes
      # from the packaging inputs the build job uploaded.
      - name: Download the MSI packaging inputs
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ env.MSI_INPUTS_ARTIFACT }}
          path: .

      - name: Package the signed assets
        run: |
          # Same layouts as the CircleCI assets of the same base name, under a
          # `-signed` suffix so the CircleCI-published SHA256SUMS.txt and its
          # cosign bundle never describe a file they did not hash.
          cd dist/signed
          zip -q ../release/sysml-windows-amd64-signed.zip sysml-windows-amd64.exe
          zip -q ../release/sysml-lsp-windows-amd64-signed.zip sysml-lsp-windows-amd64.exe
          mkdir -p stage-mcp
          cp sysml-mcp-windows-amd64.exe stage-mcp/sysml-mcp.exe
          cp ../../LICENSE stage-mcp/LICENSE
          (cd stage-mcp && zip -q ../../release/sysml-mcp-windows-amd64-signed.zip sysml-mcp.exe LICENSE)
          rm -rf stage-mcp
          cp sysml-grpc-windows-amd64.exe ../release/sysml-grpc-windows-amd64-signed.exe
          mkdir -p stage
          cp sysml-windows-amd64.exe stage/sysml.exe
          cp sysml-lsp-windows-amd64.exe stage/sysml-lsp.exe
          (cd stage && zip -q ../../release/opensysml-windows-amd64-signed.zip sysml.exe sysml-lsp.exe)
          rm -rf stage
          cd ../release
          for msi in ./*.msi; do
            if [ ! -f "$msi.spdx.json" ]; then
              echo "Error: no SBOM named after $msi in dist/release:"; ls -l; exit 1
            fi
          done
          sha256sum sysml-grpc-windows-amd64-signed.exe > sysml-grpc-windows-amd64-signed.exe.sha256
          sha256sum ./*.zip ./*.msi ./*.spdx.json sysml-grpc-windows-amd64-signed.exe | sed 's|\./||' > SHA256SUMS-windows-signed.txt
          cat SHA256SUMS-windows-signed.txt

      - name: Upload signed assets as a workflow artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: windows-amd64-signed
          path: dist/release/
          if-no-files-found: error

      - name: Upload signed assets to the GitHub Release
        if: github.ref_type == 'tag' || inputs.tag != ''
        uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836 # v2.3.3
        with:
          tag_name: ${{ needs.build.outputs.version }}
          files: dist/release/*
          fail_on_unmatched_files: true
          # Only the `-signed` assets are touched; the release itself, its notes
          # and every CircleCI-published asset are left as they are.
          overwrite_files: true