Install minisign for Windows release finalize

[AnthonyRonning]

Summary

• install a pinned Windows minisign binary before Windows release finalize steps
• verify the downloaded minisign archive SHA-256 before extraction
• apply the same setup to desktop master builds and tagged release builds

Verification

• git diff --check
• bash -n scripts/ci/_common.sh scripts/ci/desktop-windows-release.sh
• nix flake check
• pre-commit hook via nix develop .#ci: Prettier, web build, bun test

This follows up the signed Windows build where Tauri/Azure bundling succeeded, but finalize failed because minisign was unavailable on the non-Nix Windows runner.

---

Summary by CodeRabbit

• Chores
  • Windows build and release workflows now include a required setup step for signature tooling, improving reliability of Windows packaging and updater preparation.
  • Added a new Windows CI installation script that securely downloads and verifies the tool before use, with support for both x64 and ARM64 runners.

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	fa13f07
Status:	✅  Deploy successful!
Preview URL:	https://c9e57f68.maple-ca8.pages.dev
Branch Preview URL:	https://fix-windows-minisign-finaliz.maple-ca8.pages.dev

View logs

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9665840e-60b1-4381-b31f-addf6a87677a

📥 Commits

Reviewing files that changed from the base of the PR and between 5e6a05f and fa13f07.

📒 Files selected for processing (3)

• .github/workflows/desktop-build.yml
• .github/workflows/release.yml
• scripts/ci/install-windows-minisign.ps1

---

📝 Walkthrough

Walkthrough

Adds a Windows minisign installation script that verifies a pinned archive before extraction, then wires it into the desktop build and release Windows jobs immediately before updater signature and checksum finalization.

Changes

Windows minisign installation

Layer / File(s)	Summary
Install minisign on Windows scripts/ci/install-windows-minisign.ps1	The script sets strict PowerShell behavior, downloads and verifies a pinned minisign archive, extracts the architecture-matched binary, updates GITHUB_PATH when available, and runs minisign -v.
Run installer in Windows jobs .github/workflows/desktop-build.yml, .github/workflows/release.yml	Both Windows workflows add an “Install minisign” step that runs the new PowerShell script before finalizing updater signatures and checksums.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• OpenSecretCloud/Maple#575: Adjusts the Windows artifact verification path in the same desktop/release pipeline area that now installs minisign.

Poem

I hopped through CI, light as a beam,
Verified minisign with a checksum gleam.
Windows runners now hum and sigh,
With signed-up paths that pass on by.
🐇✨

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: installing minisign for Windows finalize steps.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/windows-minisign-finalize

---

_{Comment @coderabbitai help to get the list of available commands.}