feat(switchdash): build unsigned Windows releases (CHOO-1468)

[amaudruz]

Jira: CHOO-1468

First slice of the Windows umbrella: produce a Windows build that people can actually install. Signing is explicitly out of scope — the agreed tradeoff is that users click through a SmartScreen warning.

Why there was no Windows build

Not a missing runner. The config demanded signing and there was nothing to sign with.

electron-builder.config.ts set azureSignOptions unconditionally — publisher General Action, Inc., account switchdash, profile switchdash-public, all inherited from the upstream fork and none of them ours. electron-builder picks its signing backend from that key's presence, never checking whether credentials exist, so every --win build committed to Azure Trusted Signing and died in PowerShell.

macOS already solves the same problem (hasDeveloperIdCert gates notarization, ad-hoc signs otherwise). Windows never got an equivalent.

The non-obvious part

Dropping the signing isn't sufficient on its own. publisherName also gets stamped into app-update.yml, and NsisUpdater.verifySignature checks a downloaded installer's Authenticode signature against it. An unsigned build that still named a publisher would reject every update it downloaded.

Removing the key fixes both: computedPublisherName resolves to null, so the manifest carries no publisher and the updater skips verification.

Verified against app-builder-lib@26.15.2 rather than assumed — WindowsSignToolManager.initialize() is a no-op, cscInfo resolves to null without a cert, and signFile logs no signing info identified, signing is skipped and returns.

Why remove rather than gate on an env var

An AZURE_CLIENT_ID gate would have kept a config that cannot work (wrong publisher, wrong account) and made build success depend on ambient environment — that variable appearing on a runner for any unrelated reason would flip the build to the Azure path and hard-fail it. Restoring signing means supplying a real identity, which means editing these lines regardless.

Changes

• Remove azureSignOptions from electron-builder.config.ts and electron-builder.canary.config.ts, with a comment on why it must not return unaccompanied.
• Add a build-windows job on windows-latest to switchdash-release.yml, mirroring the macOS job. Publishes .exe, .msi, .blockmap, latest.yml. shell: bash at job level (runner defaults to pwsh).
• INSTALL.md: Windows install steps, the SmartScreen click-through, AV quarantine, and that AppLocker/WDAC block unsigned binaries outright with no click-through. Notes Docker-backed features stay macOS/Linux only.
• Release notes cover both platforms.

Testing

The Windows job has not run yet. It can't be exercised locally — no Wine, and the msi target needs it off-Windows. Native module rebuild (better-sqlite3, node-pty compiling against MSVC) is the likeliest failure point. Suggest a workflow_dispatch run before tagging.

Out of scope

Docker CLI resolution on Windows (per product decision — managed local/remote servers aren't needed on Windows yet), orphaned child processes on session teardown, SSH key auth, secrets file permissions. Each is a separate slice under the umbrella.

Noticed, not fixed

• INSTALL.md says macOS builds are unsigned and need a Gatekeeper bypass; the workflow's release notes say signed and notarized. Contradiction predates this branch.
• The workflow header cites VITE_SWITCHDASH_AUTOUPDATE=off as disabling auto-update. That variable exists nowhere in the repo; auto-update is live.

🤖 Generated with Claude Code

[semgrep-code-sandbox-quantum]

Semgrep found 4 github-actions-mutable-action-tag findings:

• .github/workflows/switchdash-release.yml
  • L227 - Triage
  • L230 - Triage
  • L235 - Triage
  • L287 - Triage

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.