Pin SimplySign installer digest and signer

[frathe]

The Windows release workflow now requires a reviewed SHA-256 digest and Authenticode signer thumbprint for the SimplySign Desktop installer. Missing, malformed or mismatched pins stop the signing job before installation.

The pinned setup action installs the verified SimplySignDesktop.msi already in the workspace and skips its download step. Its reserved .invalid fallback URL makes a missing local installer fail. The signing guide documents both protected-environment variables and this local-file handoff.

Validation: focused release-workflow regressions in scripts/msixstage and scripts/updaternotices, YAML parsing and installer-handoff structural checks, formatting, and whitespace checks. GoLand found only the existing HTTP timestamp-URL weak warning outside this change. PR CI does not execute the credentialed Windows signing job; a signed test-tag release remains an explicit qualification step in the guide and todos.md.

[github-actions]

Qodana for Go

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions

[frathe]

Removed the unused loopback server and corrected the local-installer documentation. The pinned action skips downloading when SimplySignDesktop.msi exists, so the workflow retains the verified local file and a reserved .invalid fallback URL. SHA-256 and signer-thumbprint pins remain enforced.

Validation: both focused release-workflow tests passed, YAML and installer-handoff structural checks passed, formatting and whitespace checks passed. GoLand reported only the pre-existing HTTP timestamp-URL weak warning. PR CI does not exercise the credentialed signing job.

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T18:40:19.514916Z	35e1520	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-16T18:43:02.594100Z	35e1520	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 35e1520770

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 35e1520770

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[frathe]

Review loop completed for 35e1520770e758e48435650e7e3f282e282f8c39.

• Fixed the unused-listener finding: removed the loopback server, retained the verified local installer and both reviewed pins, restored the reserved .invalid fallback, and corrected the signing guide and PR description.
• Fresh Codex code review: no findings.
• Fresh Codex security review: no security issues.
• All 13 CI checks passed. The downloaded post-suppression Qodana SARIF report contains zero findings. Completed CodeQL Go/Actions analyses report zero results, and the PR has zero open code-scanning alerts.
• No unresolved review threads. Local focused release-workflow tests, YAML/handoff checks, formatting and whitespace checks passed; GoLand reported only the pre-existing timestamp-URL weak warning.

The protected-environment pin configuration and a credentialed signed test-tag release remain explicit qualification steps in todos.md and the signing guide. PR CI does not execute that signing job. No merge or release was performed.