ci: add preliminary windows build setup

js/forge.config.ts

@@ -41,7 +41,20 @@ const config: ForgeConfig = {
   rebuildConfig: {},
   makers: [
     new MakerSquirrel((arch) => ({
-      remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`
+      remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`,
+      // Windows code signing via Azure Trusted Signing. Dormant unless the workflow
+      // provisions the dlib + metadata file and exports these env vars, so local
+      // `yarn make` and unsigned CI builds both work unchanged.
+      windowsSign: process.env.AZURE_METADATA_JSON_PATH ? {
+        signWithParams: [
+          '/v',
+          '/fd', 'SHA256',
+          '/tr', 'http://timestamp.acs.microsoft.com',
+          '/td', 'SHA256',
+          '/dlib', process.env.AZURE_DLIB_PATH,
+          '/dmdf', process.env.AZURE_METADATA_JSON_PATH,
+        ].join(' '),
+      } : undefined,
     })),
     new MakerZIP((arch) => ({
       macUpdateManifestBaseUrl: `https://storage.googleapis.com/flowy-releases/llink/darwin/${arch}`