Sign the binary for windows

Author: bruno-at-orange

.github/workflows/pack-pip.yaml

@@ -8,6 +8,11 @@ on:
         type: choice
         default: None  # no publishing to any Package Index by default
         options: [None, testpypi, pypi]
+      signature-activation:
+        type: boolean
+        required: true
+        default: false
+        description: Sign khisto binary
   push:
     tags: ['*']
   pull_request:
@@ -31,6 +36,8 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm, windows-2025-vs2026, windows-11-vs2026-arm, macos-15-intel, macos-15]
+    env:
+      SIGN_WINDOWS_WHEELS: ${{ github.event_name == 'workflow_dispatch' && inputs.signature-activation }}
     steps:
       - uses: actions/checkout@v6
 
@@ -59,7 +66,36 @@ jobs:
           uv sync --python .test-env --group dev --no-install-project
           uv run --python .test-env pytest tests/ --no-cov
 
-      - uses: actions/upload-artifact@v6
+      - name: Install wheel package for signing
+        if: runner.os == 'Windows' && env.SIGN_WINDOWS_WHEELS == 'true'
+        run: python -m pip install wheel
+      - name: Unpack khisto wheel
+        if: runner.os == 'Windows' && env.SIGN_WINDOWS_WHEELS == 'true'
+        run: |
+          mkdir -p wheelhouse/unpacked
+          python -m wheel unpack wheelhouse/khisto-*.whl --dest wheelhouse/unpacked
+      - name: Setup SM_CLIENT_CERT_FILE from base64 secret data
+        if: runner.os == 'Windows' && env.SIGN_WINDOWS_WHEELS == 'true'
+        run: |
+          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
+          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
+      - name: Sign unpacked wheel binaries
+        if: runner.os == 'Windows' && env.SIGN_WINDOWS_WHEELS == 'true'
+        uses: digicert/code-signing-software-trust-action@v1.2.1
+        with:
+          input: wheelhouse/unpacked/
+          keypair-alias: ${{ env.KEYPAIR }}
+          simple-signing-mode: true
+        env:
+          SM_HOST: ${{ secrets.SM_HOST }}
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+      - name: Repack signed wheels
+        if: runner.os == 'Windows' && env.SIGN_WINDOWS_WHEELS == 'true'
+        run: |
+          rm wheelhouse/khisto-*.whl
+          python -m wheel pack wheelhouse/unpacked/khisto-* --dest-dir wheelhouse
+      - uses: actions/upload-artifact@v7
         with:
           name: pkg-wheel-${{ matrix.os }}
           path: wheelhouse/*.whl