feat(codesign): migrate to Azure Trusted Signing (#1878)

.github/workflows/build-check.yaml

@@ -163,9 +163,6 @@ jobs:
       - name: Package
         if: matrix.config.publishArtifacts
         run: cmake --build --preset ${{ matrix.config.buildPreset }} --target package
-        env:
-          CODESIGN_CERTIFICATE_BASE64: ${{ secrets.CODESIGN_CERTIFICATE_BASE64 }}
-          CODESIGN_PASSWORD: ${{ secrets.CODESIGN_PASSWORD }}
 
       - name: Upload ZIP Artifacts
         if: matrix.config.publishArtifacts
@@ -205,7 +202,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Dependencies
-        run: brew install libarchive ninja
+        run: brew install libarchive
 
       - name: Install Qt
         uses: jurplel/install-qt-action@v4

.github/workflows/release.yaml

@@ -15,6 +15,7 @@ jobs:
   build-windows:
     name: ${{ matrix.config.name }}
     runs-on: ${{ matrix.config.os }}
+    environment: release
     permissions:
       attestations: write
       contents: write
@@ -86,11 +87,33 @@ jobs:
           wix extension add --global WixToolset.UI.wixext/5.0.2
           wix extension add --global WixToolset.Util.wixext/5.0.2
 
+      - name: Log in to Azure
+        uses: azure/login@v2
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Install Trusted Signing client
+        shell: pwsh
+        run: |
+          $dir = Join-Path $env:RUNNER_TEMP 'trusted-signing-client'
+          New-Item -ItemType Directory -Force -Path $dir | Out-Null
+          nuget install Microsoft.Trusted.Signing.Client -OutputDirectory $dir -ExcludeVersion
+          $dlib = Get-ChildItem -Path $dir -Filter 'Azure.CodeSigning.Dlib.dll' -Recurse |
+              Where-Object { $_.FullName -match '[\\/]x64[\\/]' } |
+              Select-Object -First 1 -ExpandProperty FullName
+          if (-not $dlib) {
+              throw 'x64 Azure.CodeSigning.Dlib.dll not found in installed package.'
+          }
+          "CODESIGN_AZURE_DLIB=$dlib" >> $env:GITHUB_ENV
+
       - name: Package
         run: cmake --build --preset ${{ matrix.config.buildPreset }} --target package
         env:
-          CODESIGN_CERTIFICATE_BASE64: ${{ secrets.CODESIGN_CERTIFICATE_BASE64 }}
-          CODESIGN_PASSWORD: ${{ secrets.CODESIGN_PASSWORD }}
+          CODESIGN_AZURE_ENDPOINT: ${{ vars.CODESIGN_AZURE_ENDPOINT }}
+          CODESIGN_AZURE_ACCOUNT: ${{ vars.CODESIGN_AZURE_ACCOUNT }}
+          CODESIGN_AZURE_PROFILE: ${{ vars.CODESIGN_AZURE_PROFILE }}
 
       - name: Attest Build Provenance
         uses: actions/attest@v4