ci: make sign seperate step

.github/workflows/release.yml

@@ -77,35 +77,59 @@ jobs:
             cp "target/$TARGET/release/pumpkin" "dist/pumpkin-${{ runner.arch }}-${{ runner.os }}-musl"
           fi
 
-      - name: Upload unsigned executable for SignPath (Windows only)
+      - name: Upload unsigned Windows executable
         if: runner.os == 'Windows'
-        id: upload_unsigned
         uses: actions/upload-artifact@v7
         with:
           name: unsigned-${{ runner.arch }}-${{ runner.os }}
           path: dist/pumpkin-*
-          retention-days: 1
+          retention-days: 14
 
-      - name: Submit SignPath signing request (Windows only)
-        if: runner.os == 'Windows'
+      - name: Export executable
+        if: runner.os != 'Windows'
+        uses: actions/upload-artifact@v7
+        with:
+          name: pumpkin-${{ runner.arch }}-${{ runner.os }}
+          compression-level: 9
+          path: dist/pumpkin-*
+
+  sign_windows_release:
+    name: Sign Windows release
+    permissions:
+      actions: read
+    needs: build_release
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os:
+          - windows-latest
+          - windows-11-arm
+    steps:
+      - name: Find unsigned artifact
+        id: artifact
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ARTIFACT_NAME: unsigned-${{ runner.arch }}-${{ runner.os }}
+        run: |
+          ARTIFACT_ID=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/artifacts" \
+            --jq '.artifacts | map(select(.name == env.ARTIFACT_NAME and .expired == false)) | first.id')
+          test -n "$ARTIFACT_ID"
+          echo "id=$ARTIFACT_ID" >> "$GITHUB_OUTPUT"
+
+      - name: Submit SignPath signing request
         uses: signpath/github-action-submit-signing-request@v2
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
           organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
           project-slug: '${{ secrets.SIGNPATH_PROJECT_SLUG }}'
           signing-policy-slug: '${{ secrets.SIGNPATH_RELEASE_SIGNING_POLICY_SLUG || secrets.SIGNPATH_SIGNING_POLICY_SLUG }}'
-          github-artifact-id: '${{ steps.upload_unsigned.outputs.artifact-id }}'
+          github-artifact-id: '${{ steps.artifact.outputs.id }}'
           wait-for-completion: true
-          output-artifact-directory: dist/signed/
+          output-artifact-directory: dist/
 
-      - name: Overwrite with signed version (Windows only)
-        if: runner.os == 'Windows'
-        shell: bash
-        run: |
-          cp dist/signed/* dist/
-          rm -rf dist/signed/
-
-      - name: Export executable
+      - name: Export signed executable
         uses: actions/upload-artifact@v7
         with:
           name: pumpkin-${{ runner.arch }}-${{ runner.os }}
@@ -148,7 +172,7 @@ jobs:
     name: Publish GitHub Release
     permissions:
       contents: write
-    needs: [build_release, build_android_release]
+    needs: [build_release, sign_windows_release, build_android_release]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7