ci(signing): verify SignPath test integration

[meiiie]

Summary

Adds a manual, main-only SignPath smoke workflow for Recordly's self-signed test policy. It proves the GitHub connector path without publishing a release or uploading the signed test binary as a distributable asset.

Problem and root cause

The test policy worked through an interactive upload, but the repository had no CI integration. The production policy is still invalid, and the release workflow currently falls back to an unsigned Windows installer when legacy certificate secrets are absent.

Focused change

• Grants only read access to workflow artifacts and repository contents.
• Pins every action to a full commit SHA.
• Builds the small unsigned cursor helper and uploads it as a raw PE for the initial configuration.
• Submits only to test-signing, then verifies Authenticode type, digest status, expected test signer, Code Signing EKU, and timestamp.
• Retains the unsigned workflow artifact for one day and has no release or signed-artifact publication step.

Verification

• actionlint 1.7.12: pass
• zizmor 1.29.0 online/pedantic: no findings
• Local Windows helper build: pass; input is NotSigned
• Verification block: passes against the preserved SignPath result and accepts only its expected UntrustedRoot test status

Risk and rollout

This remains a draft until a repository administrator stores SIGNPATH_API_TOKEN as an Actions secret and the manual run completes on main. The token must not be pasted into the PR or logs. This PR does not modify production signing, the public release workflow, or release assets.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: af8ae88b-e4e2-429d-8694-65ac4158a457

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}