Use electron-builder directly

.github/workflows/build.yml

@@ -73,35 +73,13 @@ jobs:
                   echo "VITE_OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}" >> $GITHUB_ENV
                   echo "VITE_LANGFUSE_PUBLIC_KEY=${{ secrets.LANGFUSE_PUBLIC_KEY }}" >> $GITHUB_ENV
                   echo "VITE_LANGFUSE_SECRET_KEY=${{ secrets.LANGFUSE_SECRET_KEY }}" >> $GITHUB_ENV
-
-            # Build and sign Windows separately using Azure Trusted Signing
-            - name: Build Electron App (Windows only)
-              if: startsWith(matrix.os, 'windows')
-              working-directory: apps/studio
-              run: |
-                  bun run build && npx electron-builder --win
-                  echo "RELEASE_VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Azure Trusted Signing (Windows only)
-              if: startsWith(matrix.os, 'windows')
-              uses: azure/[email protected]
-              with:
-                  azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-                  azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
-                  azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
-                  endpoint: ${{ secrets.AZURE_ENDPOINT }}
-                  code-signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
-                  certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
-                  file-digest: SHA256
-                  files-folder: apps/studio/release/${{ env.RELEASE_VERSION }}
-                  files-folder-filter: exe
+                  echo "AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}" >> $GITHUB_ENV
+                  echo "AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}" >> $GITHUB_ENV
+                  echo "AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}" >> $GITHUB_ENV
 
             - name: Build and Release Electron App
               uses: samuelmeuli/action-electron-builder@v1
               with:
-                  skip_build: ${{ startsWith(matrix.os, 'windows') }} # Skip build for Windows since we build and sign separately
                   package_root: apps/studio
                   github_token: ${{ secrets.GITHUB_TOKEN }}
                   release: ${{ startsWith(github.ref, 'refs/tags/v') }}

apps/studio/electron-builder.json5

@@ -23,6 +23,12 @@
             },
         ],
         artifactName: '${productName}-setup.${ext}',
+        azureSignOptions: {
+            publisherName: 'On Off, Inc',
+            certificateProfileName: 'public-trust-onlook',
+            codeSigningAccountName: 'trusted-onlook',
+            endpoint: 'https://eus.codesigning.azure.net/',
+        }
     },
     linux: {
         target: [