feat(ci): add reusable workflow for Azure Trusted Signing

[p0wline]

Summary

Reusable workflow for signing Windows artifacts (.exe, .dll, etc.) via Azure Trusted Signing (azure/artifact-signing-action@v2).

Based on the signing POC: https://github.com/p0wline/cosmian-signing-poc

Usage

jobs:
  sign:
    uses: Cosmian/reusable_scripts/.github/workflows/sign-windows-artifacts.yml@main
    with:
      files-folder: target/release
      files-folder-filter: exe
      artifact-name: signed-installers          # optional — omit to skip upload
      signing-account-name: cosmian-codesigning-test
      certificate-profile-name: cosmian-test-profile
    secrets:
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID_POC }}
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID_POC }}
      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET_POC }}

Inputs

Input	Required	Default	Description
files-folder	yes	—	Path to folder containing files to sign
files-folder-filter	no	exe	Comma-separated extension filter
artifact-name	no	""	Upload signed files as artifact (empty = skip)
endpoint	no	https://weu.codesigning.azure.net/	Azure Trusted Signing endpoint
signing-account-name	yes	—	Azure account name
certificate-profile-name	yes	—	Certificate profile

Secrets

AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET — all required.

Note

Azure Trusted Signing uses OV cert. SmartScreen will warn on first download until certificate builds reputation. EV cert needed for immediate bypass.