From 1d327f430df49f5e52ef1bc391bb19ca8fa0dafb Mon Sep 17 00:00:00 2001
From: wgqqqqq <wgq0617@gmail.com>
Date: Mon, 10 Aug 2026 16:52:10 +0800
Subject: [PATCH] fix(ci): pass public key when signing Windows installer

---
 .github/workflows/desktop-package.yml |  1 +
 scripts/check-github-config.test.mjs  | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/.github/workflows/desktop-package.yml b/.github/workflows/desktop-package.yml
index 32a861682..907ebbb2f 100644
--- a/.github/workflows/desktop-package.yml
+++ b/.github/workflows/desktop-package.yml
@@ -520,6 +520,7 @@ jobs:
         env:
           BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
         run: bash scripts/sign-release-assets.sh release-manual-assets/*.exe
 
       - name: Collect updater assets
diff --git a/scripts/check-github-config.test.mjs b/scripts/check-github-config.test.mjs
index 35885c242..b694ec6c3 100644
--- a/scripts/check-github-config.test.mjs
+++ b/scripts/check-github-config.test.mjs
@@ -275,3 +275,21 @@ test('keeps Rust CI independent, restore-only on PRs, and target-focused', () =>
     'cargo test --locked -p tool-runtime --lib search::',
   );
 });
+
+test('passes the verification key when signing the versioned Windows installer', () => {
+  const workflow = yaml.parse(
+    readFileSync(
+      path.join(repoRoot, '.github/workflows/desktop-package.yml'),
+      'utf8',
+    ),
+  );
+  const signingStep = workflow.jobs['upload-release-assets'].steps.find(
+    (step) => step.name === 'Sign versioned Windows installer',
+  );
+
+  assert.equal(
+    signingStep?.env?.BITFUN_SIGNING_PUBKEY,
+    '${{ secrets.TAURI_UPDATER_PUBKEY }}',
+    'release signatures must be self-verified with the configured public key',
+  );
+});