feat(desktop): sign every Windows release artifact (#1548)

tools/dev/src/desktop.rs

@@ -173,7 +173,41 @@ pub fn smoke_build_desktop() -> Result<()> {
     .map(drop)
 }
 
+fn packages_for_windows(args: &[String]) -> bool {
+    if args.iter().any(|arg| arg == "--win") {
+        return true;
+    }
+    if args.iter().any(|arg| arg == "--mac" || arg == "--linux") {
+        return false;
+    }
+    cfg!(target_os = "windows")
+}
+
+fn host_electron_arch() -> Result<&'static str> {
+    match env::consts::ARCH {
+        "x86_64" => Ok("x64"),
+        "aarch64" => Ok("arm64"),
+        other => bail!(
+            "cannot package the desktop app for Windows on host architecture {other}; set ELECTRON_ARCH to x64 or arm64"
+        ),
+    }
+}
+
+fn packaging_env(args: &[String]) -> Result<Vec<(String, Option<String>)>> {
+    if !packages_for_windows(args)
+        || env::var_os("ELECTRON_ARCH").is_some()
+        || args.iter().any(|arg| arg == "--x64" || arg == "--arm64")
+    {
+        return Ok(Vec::new());
+    }
+    Ok(vec![(
+        "ELECTRON_ARCH".to_owned(),
+        Some(host_electron_arch()?.to_owned()),
+    )])
+}
+
 pub fn package_desktop(args: &[String]) -> Result<()> {
+    let env = packaging_env(args)?;
     build_desktop(false)?;
     let mut builder_args = vec![
         "pnpm".to_owned(),
@@ -189,6 +223,7 @@ pub fn package_desktop(args: &[String]) -> Result<()> {
         &refs,
         RunOptions {
             cwd: DESKTOP_DIR.as_path(),
+            env,
             ..RunOptions::default()
         },
     )