Update signed Windows release assets (#343)

* Update signed Windows release assets

* Address signed asset release feedback

* Harden signed release asset publishing

* Align SignPath executable artifact layout

* Split SignPath executable configurations

* Submit raw SignPath executable artifacts

* Remove redundant signed executables artifact

* Handle raw SignPath outputs

* Validate release signing tags early

* Tighten release signing asset updates

* Align release installer source archive

* Simplify SignPath dispatch inputs

* Constrain test signing branch refs

---------

Co-authored-by: nbauma109 <nbauma109@github.com>

Author: nbauma109

.github/workflows/publish-chocolatey.yml

@@ -1,9 +1,6 @@
 name: Publish Chocolatey package
 
 on:
-  release:
-    types:
-      - published
   workflow_dispatch:
     inputs:
       tag:
@@ -12,7 +9,7 @@ on:
         type: string
 
 concurrency:
-  group: publish-chocolatey-${{ github.event.release.tag_name || github.event.inputs.tag }}
+  group: publish-chocolatey-${{ github.event.inputs.tag }}
   cancel-in-progress: false
 
 permissions:
@@ -34,21 +31,14 @@ jobs:
         shell: pwsh
         env:
           INPUT_TAG: ${{ github.event.inputs.tag }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-          GITHUB_EVENT_NAME: ${{ github.event_name }}
-          GITHUB_REF_VALUE: ${{ github.ref }}
         run: |
-          $tag = if ($env:RELEASE_TAG) { $env:RELEASE_TAG } else { $env:INPUT_TAG }
+          $tag = $env:INPUT_TAG
           if ([string]::IsNullOrWhiteSpace($tag)) {
             throw "A release tag is required."
           }
 
           $version = $tag -replace '^v', ''
-          $checkoutRef = if ($env:GITHUB_EVENT_NAME -eq 'workflow_dispatch') {
-            $env:GITHUB_REF_VALUE
-          } else {
-            "refs/tags/$tag"
-          }
+          $checkoutRef = "refs/tags/$tag"
           "tag=$tag" >> $env:GITHUB_OUTPUT
           "version=$version" >> $env:GITHUB_OUTPUT
           "checkout_ref=$checkoutRef" >> $env:GITHUB_OUTPUT

.github/workflows/publish-winget.yml

@@ -1,9 +1,6 @@
 name: Submit WinGet manifest
 
 on:
-  release:
-    types:
-      - released
   workflow_dispatch:
     inputs:
       tag:
@@ -12,7 +9,7 @@ on:
         type: string
 
 concurrency:
-  group: publish-winget-${{ github.event.release.tag_name || github.event.inputs.tag }}
+  group: publish-winget-${{ github.event.inputs.tag }}
   cancel-in-progress: false
 
 permissions:
@@ -35,11 +32,8 @@ jobs:
         shell: pwsh
         env:
           INPUT_TAG: ${{ github.event.inputs.tag }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-          GITHUB_EVENT_NAME: ${{ github.event_name }}
-          GITHUB_REF_VALUE: ${{ github.ref }}
         run: |
-          $tag = if ($env:RELEASE_TAG) { $env:RELEASE_TAG } else { $env:INPUT_TAG }
+          $tag = $env:INPUT_TAG
           if ([string]::IsNullOrWhiteSpace($tag)) {
             throw "A release tag is required."
           }
@@ -50,11 +44,7 @@ jobs:
           } else {
             $env:WINGET_PACKAGE_IDENTIFIER
           }
-          $checkoutRef = if ($env:GITHUB_EVENT_NAME -eq 'workflow_dispatch') {
-            $env:GITHUB_REF_VALUE
-          } else {
-            "refs/tags/$tag"
-          }
+          $checkoutRef = "refs/tags/$tag"
 
           "tag=$tag" >> $env:GITHUB_OUTPUT
           "version=$version" >> $env:GITHUB_OUTPUT