Sign the PowerShell installer in Windows releases (#51158)

## What changed

Extend the Windows signing action with an `additional-files` input and sign `scripts/install/install.ps1` with Azure Trusted Signing in the x64 release job. Stage the architecture-independent installer after compression so it remains a plain script, and publish the signed artifact as `install.ps1` instead of copying the unsigned source.

## Testing

The Windows release workflow verifies that the installer has a valid Authenticode signature and a timestamp certificate before staging it, failing the job if either check fails.

GitOrigin-RevId: 6f16a084b8f350fbf3644c36d75651a6f4b88506

.github/actions/windows-code-sign/action.yml

@@ -1,5 +1,5 @@
 name: windows-code-sign
-description: Sign Windows binaries with Azure Trusted Signing.
+description: Sign Windows release files with Azure Trusted Signing.
 inputs:
   target:
     description: Target triple for the artifacts to sign.
@@ -7,6 +7,9 @@ inputs:
   binaries:
     description: Space-delimited binary basenames to sign.
     default: "codex codex-responses-api-proxy codex-windows-sandbox-setup codex-command-runner"
+  additional-files:
+    description: Newline-delimited absolute paths to additional files to sign.
+    default: ""
   client-id:
     description: Azure Trusted Signing client ID.
     required: true
@@ -42,6 +45,7 @@ runs:
       env:
         TARGET: ${{ inputs.target }}
         BINARIES: ${{ inputs.binaries }}
+        ADDITIONAL_FILES: ${{ inputs.additional-files }}
       run: |
         set -euo pipefail
 
@@ -50,10 +54,13 @@ runs:
           for binary in ${BINARIES}; do
             echo "${CARGO_TARGET_DIR}/${TARGET}/release/${binary}.exe"
           done
+          if [[ -n "$ADDITIONAL_FILES" ]]; then
+            printf '%s\n' "$ADDITIONAL_FILES"
+          fi
           echo "EOF"
         } >> "$GITHUB_OUTPUT"
 
-    - name: Sign Windows binaries with Azure Trusted Signing
+    - name: Sign Windows release files with Azure Trusted Signing
       uses: azure/trusted-signing-action@1d365fec12862c4aa68fcac418143d73f0cea293 # v0.5.11
       with:
         endpoint: ${{ inputs.endpoint }}

.github/workflows/rust-release-windows.yml

@@ -384,11 +384,13 @@ jobs:
             ls -lh "$CARGO_TARGET_DIR/${{ matrix.target }}/release/${binary}.exe"
           done
 
-      - name: Sign Windows binaries with Azure Trusted Signing
+      - name: Sign Windows release files with Azure Trusted Signing
         uses: ./.github/actions/windows-code-sign
         with:
           target: ${{ matrix.target }}
           binaries: ${{ env.WINDOWS_BINARIES }}
+          # The installer is architecture-independent; sign it only in the x64 job.
+          additional-files: ${{ matrix.target == 'x86_64-pc-windows-msvc' && format('{0}/scripts/install/install.ps1', github.workspace) || '' }}
           client-id: ${{ secrets.AZURE_ARTIFACT_SIGNING_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_ARTIFACT_SIGNING_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_ARTIFACT_SIGNING_SUBSCRIPTION_ID }}
@@ -617,6 +619,18 @@ jobs:
             "${GITHUB_WORKSPACE}/.github/workflows/zstd" -T0 -19 "$dest/$base"
           ' _
 
+      - name: Verify and stage signed PowerShell installer
+        if: matrix.target == 'x86_64-pc-windows-msvc'
+        shell: powershell
+        run: |
+          $installer = Join-Path $env:GITHUB_WORKSPACE 'scripts/install/install.ps1'
+          $signature = Get-AuthenticodeSignature $installer
+          if ($signature.Status -ne 'Valid' -or $null -eq $signature.TimeStamperCertificate) {
+            throw "Installer signature is invalid or missing a timestamp: $($signature.Status)"
+          }
+          # Stage after compression so the installer remains a plain script.
+          Copy-Item $installer 'dist/${{ matrix.target }}/install.ps1'
+
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: ${{ matrix.target }}

.github/workflows/rust-release.yml

@@ -1674,7 +1674,7 @@ jobs:
       - name: Stage installer scripts
         run: |
           cp scripts/install/install.sh dist/install.sh
-          cp scripts/install/install.ps1 dist/install.ps1
+          mv dist/x86_64-pc-windows-msvc/install.ps1 dist/install.ps1
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3