Prepare QSfera production release

Desktop/.github/workflows/main.yml

@@ -57,6 +57,8 @@ jobs:
       CRAFT_TARGET: ${{ matrix.target }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       CRAFT_PACKAGE_SYMBOLS: ${{  github.event_name != 'pull_request' }}
+      SIGN_PACKAGE: ${{ secrets.QSFERA_DESKTOP_SIGN_PACKAGE }}
+      CRAFT_CODESIGN_CERTIFICATE: ${{ secrets.QSFERA_DESKTOP_CODESIGN_CERTIFICATE }}
 
     container: ${{ matrix.container }}
 
@@ -188,11 +190,25 @@ jobs:
     - name: Package
       if: matrix.target  != 'macos-clang-arm64'
       run: |
+        $requireSigning = "${{ matrix.os }}" -eq "windows-latest" -and "${{ github.ref_type }}" -eq "tag" -and "${{ inputs.releaseChannel }}" -ne "beta"
+        if ("${{ matrix.os }}" -eq "windows-latest") {
+          $validationArgs = @()
+          if ($requireSigning) {
+            $validationArgs += "-RequireSigning"
+          }
+          & "${env:GITHUB_WORKSPACE}/scripts/validate-production-release.ps1" @validationArgs
+        }
         & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --no-cache --package opencloud/opencloud-desktop
 
     - name: Package Appx
       if: ${{ matrix.os  == 'windows-latest' && github.event_name != 'pull_request' }}
       run: |
+        $requireSigning = "${{ github.ref_type }}" -eq "tag" -and "${{ inputs.releaseChannel }}" -ne "beta"
+        $validationArgs = @()
+        if ($requireSigning) {
+          $validationArgs += "-RequireSigning"
+        }
+        & "${env:GITHUB_WORKSPACE}/scripts/validate-production-release.ps1" @validationArgs
         & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --no-cache --package --options "[Packager]PackageType=AppxPackager" --options "[Packager]Destination=${{ github.workspace }}/appx/" opencloud/opencloud-desktop
 
     - name: Prepare artifacts