Add Windows binary signing with Azure Trusted Signing

[Copilot]

Note

Blocked: waiting for Azure Artifact Signing (formerly Trusted Signing) to support individual developers in Norway.

As of 2026-07-24, Public Trust certificates require an organization in a supported country/region — Norway was added to that list on 2026-07-23, alongside Switzerland. Individual developers must still be located in the USA or Canada, and Microsoft has stated individual onboarding for Public Trust is paused with no announced timeline for expansion.

Since Prism is signed by an individual, not a registered company, we can't complete identity validation yet. Keeping this PR open until that changes.

• Quickstart: Set up Artifact Signing — the country/region list lives under Prerequisites
• Artifact Signing FAQ — "What if my country/region isn't listed…"
• Microsoft Q&A: individual identity validation unavailable outside USA/Canada
• Microsoft Q&A: Switzerland (EFTA) added 2026-07-23

Implements code signing for Windows executables in the CI pipeline using Azure Trusted Signing with OIDC authentication.

Changes

• Permissions: Added id-token: write for Azure OIDC authentication
• Azure Login: Authenticates using federated credentials (client-id, tenant-id, subscription-id)
• Signing: Signs Windows EXE with SHA256 digests and RFC3161 timestamping via Azure/trusted-signing-action@v0
• Verification: Validates signature using signtool verify before artifact upload

Workflow Order

The signing steps execute after PyInstaller build but before artifact upload:

Build → Store binary → Azure login → Sign → Verify → Upload artifact

All three new steps are Windows-conditional (env.OS_NAME == 'windows').

Original prompt

Add windows binary signing to testing.yml

- name: Azure login (windows)
  if: env.OS_NAME == 'windows'
  uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- name: Sign Windows EXE (windows)
  if: env.OS_NAME == 'windows'
  uses: Azure/trusted-signing-action@v0
  with:
    endpoint: ${{ secrets.AZURE_CODESIGNING_ENDPOINT }}
    trusted-signing-account-name: ${{ secrets.AZURE_CODESIGNING_ACCOUNT_NAME }}
    certificate-profile-name: ${{ secrets.AZURE_CODESIGNING_CERT_PROFILE_NAME }}
    files: ${{ env.BUILD_RESULT_NAME }}
    file-digest: SHA256
    timestamp-rfc3161: http://timestamp.acs.microsoft.com
    timestamp-digest: SHA256
    description: Prism
    description-url: https://github.com/Amund211/prism

- name: Verify Windows EXE signature (windows)
  if: env.OS_NAME == 'windows'
  shell: pwsh
  run: |
    signtool verify /pa /tw /v "${{ env.BUILD_RESULT_NAME }}"

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.