Sign the executables!

.github/workflows/maven.yml

@@ -8,9 +8,9 @@ on:
 
 jobs:
   build_windows:
-    runs-on: windows-latest
+    runs-on: [self-hosted, Windows, x64, code-sign]
     steps:
-      - name: 📩 Set up JDK 11
+      - name: 📩 Grab the code
         uses: actions/checkout@v3
 
       - name: 🏗️ Set up JDK 11
@@ -26,11 +26,15 @@ jobs:
       - name: 📦 Build the Windows artifact
         run: bash build.sh dist-windows
 
-      - name: 🔨 Create installer
+      - name: 🔨 Create Windows installer
         uses: joncloud/[email protected]
         with:
           script-file: "Installer.nsi"
 
+      - name: ✍️ Sign the Windows installer
+        shell: cmd
+        run: C:\signing\sign.bat dist\Casterlabs-Caffeinated-Setup.exe
+
       - name: 🆙 Upload the Windows artifact (x86_64)
         uses: actions/upload-artifact@v3
         with:
@@ -46,7 +50,7 @@ jobs:
   build_macos:
     runs-on: ubuntu-latest
     steps:
-      - name: 📩 Set up JDK 11
+      - name: 📩 Grab the code
         uses: actions/checkout@v3
 
       - name: 🏗️ Set up JDK 11
@@ -77,7 +81,7 @@ jobs:
   build_linux:
     runs-on: ubuntu-latest
     steps:
-      - name: 📩 Set up JDK 11
+      - name: 📩 Grab the code
         uses: actions/checkout@v3
 
       - name: 🏗️ Set up JDK 11

build.sh

@@ -18,6 +18,7 @@ if [[ $@ == *"dist-windows"* ]]; then
     java -jar bundler.jar bundle \
         --arch x86_64 --os windows \
         --id $APP_ID --name $APP_NAME --icon icon.png \
+        --sign 'cmd.exe /C C:\signing\sign.bat Casterlabs-Caffeinated.exe' \
         --java 11 --arg=-Dcaffeinated.channel=stable --dependency target/Casterlabs-Caffeinated-Updater.jar --main $MAIN_CLASS
 
     echo "------------ Finished bundling for Windows ------------"