ci(release): require trusted Windows signing

.gitlab-ci.yml

@@ -206,10 +206,32 @@ package-windows:
   before_script:
     - npm ci
   script:
+    - |
+      $ErrorActionPreference = 'Stop'
+      if ([string]::IsNullOrWhiteSpace($env:WIN_CSC_PFX_FILE) -or -not (Test-Path -LiteralPath $env:WIN_CSC_PFX_FILE -PathType Leaf)) {
+        throw 'WIN_CSC_PFX_FILE must be a protected GitLab file variable containing the production code-signing PFX.'
+      }
+      if ((Get-Item -LiteralPath $env:WIN_CSC_PFX_FILE).Length -le 0) {
+        throw 'WIN_CSC_PFX_FILE is empty.'
+      }
+      if ([string]::IsNullOrWhiteSpace($env:WIN_CSC_KEY_PASSWORD)) {
+        throw 'WIN_CSC_KEY_PASSWORD must be a protected, masked GitLab variable.'
+      }
+      if ([string]::IsNullOrWhiteSpace($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT)) {
+        throw 'WIN_CSC_EXPECTED_SIGNER_SUBJECT must be a protected GitLab variable.'
+      }
+      if ($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -match '(?i)Everything2EverythingDev') {
+        throw 'The local Everything2EverythingDev certificate is not a production signing identity.'
+      }
+      $env:CSC_LINK = (Resolve-Path -LiteralPath $env:WIN_CSC_PFX_FILE).Path
+      $env:CSC_KEY_PASSWORD = $env:WIN_CSC_KEY_PASSWORD
     - node scripts/ci/sync-version.mjs --check --tag "$CI_COMMIT_TAG"
     - npm run build --workspace=@d3ro/desktop
     - cd apps/desktop
     - npx electron-builder --win --x64 --config electron-builder.yml
+    - cd ../..
+    - $releaseVersion = node -p "require('./release/product-version.json').version"
+    - '& scripts/ci/verify-windows-release-artifact.ps1 -ExpectedVersion $releaseVersion -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -ReleaseDirectory "apps/desktop/release/$releaseVersion"'
   artifacts:
     name: "d3ro-voice-windows-$CI_COMMIT_TAG"
     paths: