Windows codesigning for Bun's executable

.github/workflows/release.yml

@@ -50,9 +50,44 @@ on:
         default: false
 
 jobs:
+  codesign-windows:
+    name: Codesign Windows
+    runs-on: windows-latest
+    if: ${{ github.repository_owner == 'oven-sh' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Download Windows artifacts
+        run: gh release download "${{ env.BUN_VERSION }}" --pattern "bun-windows-*.zip"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Import Certificate
+        shell: pwsh
+        run: |
+          $path = "$env:TEMP\bun.pfx"
+          [IO.File]::WriteAllBytes($path, [Convert]::FromBase64String("${{ secrets.WINDOWS_CODESIGN_CERT }}"))
+          "CERT_PATH=$path" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+      - name: Sign executables
+        shell: pwsh
+        run: |
+          $password = "${{ secrets.WINDOWS_CODESIGN_PASSWORD }}"
+          foreach ($zip in Get-ChildItem -Filter 'bun-windows-*.zip') {
+            $dir = Join-Path $env:TEMP ([IO.Path]::GetFileNameWithoutExtension($zip.Name))
+            Expand-Archive $zip.FullName -DestinationPath $dir -Force
+            Get-ChildItem $dir -Filter '*.exe' -Recurse | ForEach-Object {
+              & signtool sign /f $env:CERT_PATH /p $password /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 $_.FullName
+            }
+            Compress-Archive -Path (Join-Path $dir '*') -DestinationPath $zip.FullName -Force
+            Remove-Item $dir -Recurse -Force
+          }
+      - name: Upload Windows artifacts
+        run: gh release upload "${{ env.BUN_VERSION }}" bun-windows-*.zip --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   sign:
     name: Sign Release
     runs-on: ubuntu-latest
+    needs: codesign-windows
     if: ${{ github.repository_owner == 'oven-sh' }}
     permissions:
       contents: write