build: enable Azure Artifact Signing for Windows installers

Sign EXE and MSI via electron-builder's win.azureSignOptions, authorized by
OIDC federated credentials between GitHub Actions and Azure. The federated
credential is scoped to the release-candidate workflow's environment, so
the human-gated environment approval and the Azure auth are layered.

AppX is excluded via signExts: the Microsoft Store re-signs during
certification with a Store-issued publisher cert, and matching its CN at
build time isn't feasible.

The wrapper appends --c.win.signExecutable=false when --mode=dev, so PR-time
CI and local dev builds skip signing without needing Azure auth.

Removes the legacy WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD flow.

Author: cwillisf

.github/workflows/release-candidate.yml

@@ -25,6 +25,9 @@ jobs:
     environment: release-candidate
     permissions:
       contents: read
+      # Required for the azure/login OIDC token exchange that authorizes
+      # Azure Artifact Signing on the Windows runners.
+      id-token: write
     strategy:
       # Don't cancel sibling matrix cells when one fails; let each one
       # finish so we get artifacts and full failure signal from every cell.
@@ -52,20 +55,19 @@ jobs:
       run:
         shell: bash
     env:
-      # Temporary workaround: Windows signing is currently broken due to
-      # a security-policy change. See
-      # https://github.com/electron/windows-installer/issues/473
-      # While this is true, the release-candidate job still runs Windows
-      # through the build (so we get an installer artifact) but skips
-      # the signing step.
-      SCRATCH_SHOULD_SIGN: ${{ matrix.os != 'windows-latest' }}
       # Organization-specific identifiers used by electron-builder.yaml's ${env.X}
       # interpolation. Kept in repo Variables so a fork builds with its own values
       # (or fails loudly if unset) rather than colliding with our published artifacts.
       APPX_IDENTITY_NAME: ${{ vars.APPX_IDENTITY_NAME }}
       APPX_PUBLISHER: ${{ vars.APPX_PUBLISHER }}
       APPX_PUBLISHER_DISPLAY_NAME: ${{ vars.APPX_PUBLISHER_DISPLAY_NAME }}
       MSI_UPGRADE_CODE: ${{ vars.MSI_UPGRADE_CODE }}
+      # Azure Artifact Signing parameters for electron-builder's win.azureSignOptions.
+      # OIDC credentials for the signing call are set by the "Azure login" step below.
+      AZURE_SIGNING_ENDPOINT: ${{ vars.AZURE_SIGNING_ENDPOINT }}
+      AZURE_SIGNING_ACCOUNT_NAME: ${{ vars.AZURE_SIGNING_ACCOUNT_NAME }}
+      AZURE_SIGNING_PROFILE_NAME: ${{ vars.AZURE_SIGNING_PROFILE_NAME }}
+      AZURE_SIGNING_PUBLISHER_NAME: ${{ vars.AZURE_SIGNING_PUBLISHER_NAME }}
       # App Store Connect API key — fastlane and electron-builder read
       # different env var names but use the same credentials. The .p8
       # file path (APPLE_API_KEY / APP_STORE_CONNECT_API_KEY_KEY_FILEPATH)
@@ -149,18 +151,21 @@ jobs:
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
         if: matrix.os == 'macos-latest'
         run: bundle exec fastlane prepare_signing
+      - name: Azure login
+        # OIDC exchange that gives electron-builder's Azure Artifact Signing call the
+        # credentials it needs. Federated credential is scoped to this workflow's
+        # 'release-candidate' environment, so no client secret is involved.
+        if: matrix.os == 'windows-latest'
+        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
       - name: Build (signed)
         timeout-minutes: 30 # macOS notarization can take a while
         env:
           NODE_OPTIONS: --max-old-space-size=4096
-          # Only expose Windows code-signing secrets to runs that will use them.
-          # SCRATCH_SHOULD_SIGN is currently false on Windows (temporary workaround above);
-          # both expressions evaluate to '' until Windows signing is re-enabled.
-          WIN_CSC_LINK: ${{ matrix.os == 'windows-latest' && env.SCRATCH_SHOULD_SIGN == 'true' && secrets.WIN_CSC_LINK ||
-            '' }}
-          WIN_CSC_KEY_PASSWORD: ${{ matrix.os == 'windows-latest' && env.SCRATCH_SHOULD_SIGN == 'true' && secrets.WIN_CSC_KEY_PASSWORD
-            || '' }}
-        run: npm run ${{ env.SCRATCH_SHOULD_SIGN == 'true' && 'dist' || 'distDev' }} -- --target=${{ matrix.target }}
+        run: npm run dist -- --target=${{ matrix.target }}
       - name: Zip MAS-Dev build
         if: matrix.target == 'mas-dev'
         run: |

electron-builder.yaml

@@ -46,6 +46,15 @@ win:
   target:
     - appx
     - nsis
+  # AppX is excluded from build-time signing: the Microsoft Store re-signs during
+  # certification with a Store-issued publisher cert, and our build-time cert's
+  # subject would not match the manifest's Publisher attribute.
+  signExts: ["exe", "msi", "!appx", "!appxbundle", "!appxupload"]
+  # azureSignOptions is supplied by scripts/electron-builder-wrapper.js only when
+  # signing is enabled (--mode=dist). Declaring it here would also activate it for
+  # PR CI and local --mode=dev builds, where Azure auth isn't available — and some
+  # signing paths (notably the NSIS uninstaller) ignore signAndEditExecutable, so
+  # gating per-target isn't reliable. Keeping the config off entirely is cleaner.
 appx:
   # Organization-specific identifiers come from environment variables so a fork can build
   # without colliding with our published artifacts. See README for required env vars.

scripts/electron-builder-wrapper.js

@@ -3,8 +3,9 @@
  * Running this script with no command line parameters should build all targets for the current platform.
  * Pass `--target=<short-name>` to build exactly one target instead of the platform default set; the matrix in
  * `release-candidate.yml` uses this to fan a multi-target serial pass out into one runner per target. Valid short
- * names: `mas`, `mas-dev`, `dmg`, `appx`, `nsis`.
- * On Windows, make sure to set CSC_* or WIN_CSC_* environment variables or the NSIS build will fail.
+ * names: `mas`, `mas-dev`, `dmg`, `appx`, `nsis`, `msi`, `installers`, `nsis-x64`.
+ * Windows signing uses Azure Artifact Signing, configured in `electron-builder.yaml`'s `win.azureSignOptions`.
+ * Auth comes from OIDC federated credentials in `release-candidate.yml`; signing is disabled when --mode=dev.
  * On Mac, the CSC_* variables are optional but will be respected if present.
  * See also: https://www.electron.build/code-signing
  */
@@ -46,18 +47,12 @@ const getPlatformFlag = function () {
  * Run `electron-builder` once to build one or more target(s).
  * @param {object} wrapperConfig - overall configuration object for the wrapper script.
  * @param {object} target - the target to build in this call.
- * If the `target.name` is `'nsis'` then the environment must contain code-signing config (CSC_* or WIN_CSC_*).
- * If the `target.name` is `'appx'` then code-signing config will be stripped from the environment if present.
  */
 const runBuilder = function (wrapperConfig, target) {
-    // the AppX build fails if CSC_* or WIN_CSC_* variables are set
+    // Strip CSC_* env vars for AppX (would conflict with the Store-managed cert) and for unsigned builds.
+    // Windows signing itself now goes through Azure (not CSC), so these vars are typically absent anyway.
     const shouldStripCSC = (target.name.indexOf('appx') === 0) || (!wrapperConfig.doSign);
     const childEnvironment = shouldStripCSC ? stripCSC(process.env) : process.env;
-    if (wrapperConfig.doSign &&
-        (target.name.indexOf('nsis') === 0) &&
-        !(childEnvironment.CSC_LINK || childEnvironment.WIN_CSC_LINK)) {
-        throw new Error(`Signing NSIS build requires CSC_LINK or WIN_CSC_LINK`);
-    }
     const platformFlag = getPlatformFlag();
     let allArgs = [platformFlag, target.name];
     if (target.platform === 'darwin') {
@@ -75,6 +70,28 @@ const runBuilder = function (wrapperConfig, target) {
         // APPLE_API_KEY / APPLE_API_KEY_ID / APPLE_API_ISSUER are present in
         // the environment.
     }
+    if (target.platform === 'win32' && wrapperConfig.doSign) {
+        // Supply Azure Artifact Signing config via CLI rather than electron-builder.yaml. Putting it
+        // in YAML would activate signing for every build, including PR CI and local dev where Azure
+        // auth isn't available — and some signing paths (notably the NSIS uninstaller) ignore the
+        // win.signAndEditExecutable flag, so per-target gating isn't reliable.
+        const required = [
+            'AZURE_SIGNING_ENDPOINT',
+            'AZURE_SIGNING_ACCOUNT_NAME',
+            'AZURE_SIGNING_PROFILE_NAME',
+            'AZURE_SIGNING_PUBLISHER_NAME'
+        ];
+        const missing = required.filter(name => !childEnvironment[name]);
+        if (missing.length > 0) {
+            throw new Error(`Azure signing requires env vars: ${missing.join(', ')}`);
+        }
+        allArgs.push(
+            `--c.win.azureSignOptions.endpoint=${childEnvironment.AZURE_SIGNING_ENDPOINT}`,
+            `--c.win.azureSignOptions.codeSigningAccountName=${childEnvironment.AZURE_SIGNING_ACCOUNT_NAME}`,
+            `--c.win.azureSignOptions.certificateProfileName=${childEnvironment.AZURE_SIGNING_PROFILE_NAME}`,
+            `--c.win.azureSignOptions.publisherName=${childEnvironment.AZURE_SIGNING_PUBLISHER_NAME}`
+        );
+    }
     if (!wrapperConfig.doPackage) {
         allArgs.push('--dir', '--c.compression=store');
     }