refactor(build): remove self-signing code from build script and update release notes process

.github/workflows/build.yml

@@ -0,0 +1,34 @@
+name: Build executable
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: windows-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: web-panel/pnpm-lock.yaml
+
+      - name: Build unsigned executable
+        shell: pwsh
+        run: ./build.ps1 -Configuration Release
+
+      - name: Upload unsigned executable
+        uses: actions/upload-artifact@v4
+        with:
+          name: WandEnhancer-unsigned
+          path: WandEnhancer/bin/Release/WandEnhancer.exe
+          if-no-files-found: error

.github/workflows/release.yml

@@ -48,7 +48,5 @@ jobs:
           name: ${{ github.ref_name }}
           tag_name: ${{ github.ref_name }}
           body_path: release-notes.md
-          files: |
+          files: CHANGELOG.md
-            WandEnhancer/bin/Release/WandEnhancer.exe
+          fail_on_unmatched_files: true
-            CHANGELOG.md
-          fail_on_unmatched_files: true

CONTRIBUTING.md

@@ -97,7 +97,7 @@ Suggestions for new features or improvements are welcome! Create an Issue descri
    git tag 1.0.8.0
    git push origin 1.0.8.0
    ```
-6. GitHub Actions will validate the version, build the project, extract the matching changelog section, and publish the release automatically.
+6. GitHub Actions will validate the version, build the project, extract the matching changelog section, and publish a notes-only release automatically. Official releases do not attach compiled binaries.
 
 ## Code Style
 

build.ps1

@@ -111,45 +111,5 @@ Invoke-Step 'Build solution' {
     & $msbuild $solutionPath /m /p:Configuration=$Configuration '/p:Platform=Any CPU' /t:Build
 }
 
-# Code-sign the release executable. A self-signed signature notably lowers
-# false-positive AV/VirusTotal detections. The cert is reused across builds and
-# generated on first use, so no secrets or env configuration are required.
-if ($Configuration -eq 'Release') {
-    Write-Host '==> Sign WandEnhancer.exe' -ForegroundColor Cyan
-
-    $exePath = Join-Path $repoRoot "WandEnhancer/bin/$Configuration/WandEnhancer.exe"
-    if (-not (Test-Path $exePath)) {
-        throw "Executable not found for signing: $exePath"
-    }
-
-    $signingSubject = 'CN=Wand-Enhancer'
-    $cert = Get-ChildItem Cert:\CurrentUser\My |
-        Where-Object { $_.Subject -eq $signingSubject -and $_.HasPrivateKey } |
-        Select-Object -First 1
-    if (-not $cert) {
-        $cert = New-SelfSignedCertificate `
-            -Subject $signingSubject `
-            -Type CodeSigningCert `
-            -CertStoreLocation Cert:\CurrentUser\My `
-            -KeyExportPolicy Exportable `
-            -KeyUsage DigitalSignature `
-            -KeyAlgorithm RSA `
-            -KeyLength 2048 `
-            -HashAlgorithm SHA256 `
-            -NotAfter (Get-Date).AddYears(5)
-        Write-Host "Generated self-signed code-signing certificate: $($cert.Subject) [$($cert.Thumbprint)]"
-    }
-
-    $signature = Set-AuthenticodeSignature -FilePath $exePath -Certificate $cert -HashAlgorithm SHA256
-    # A self-signed root is intentionally untrusted, so the status is
-    # 'UnknownError' (untrusted root) even though the signature is embedded.
-    # Only a missing SignerCertificate means signing actually failed.
-    if (-not $signature.SignerCertificate) {
-        throw "Signing failed: $($signature.Status) - $($signature.StatusMessage)"
-    }
-
-    Write-Host "Signed $exePath [$($cert.Thumbprint)] (status: $($signature.Status))"
-}
-
 Write-Host ''
-Write-Host "Build completed successfully ($Configuration)." -ForegroundColor Green
+Write-Host "Build completed successfully ($Configuration)." -ForegroundColor Green