Build the exe on a runner with build provenance

The 1.1.0 exe was built on my machine and the only thing backing it was a
sha256 I pasted into the release notes by hand. That is worth about as much as
my word. A windows-latest job that builds it, smoke tests it against the real
telecine fixture in a directory with no Python and no source tree, and runs
actions/attest-build-provenance gives anyone a chain from the tag to the binary
they can check with gh attestation verify.

README now says what the unsigned exe looks like on first run, because the
people most likely to download it are the ones least likely to have seen that
blue box before and shrugged at it.

Author: Booyaka101

.github/workflows/release.yml

@@ -0,0 +1,74 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Tag to build
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  exe:
+    runs-on: windows-latest
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install -e ".[dev]"
+      - run: pyinstaller --clean --noconfirm scanverdict.spec
+
+      - run: choco install ffmpeg -y --no-progress
+
+      # The exe has to work on a machine with no Python and no source tree, so
+      # run it from a directory that has neither.
+      - name: Run the built exe
+        shell: bash
+        run: |
+          python tests/make_fixtures.py "$RUNNER_TEMP/fixtures"
+          mkdir -p "$RUNNER_TEMP/smoke"
+          cp dist/scanverdict.exe "$RUNNER_TEMP/fixtures/telecine.mkv" "$RUNNER_TEMP/smoke/"
+          cd "$RUNNER_TEMP/smoke"
+          ./scanverdict.exe --version
+          ./scanverdict.exe telecine.mkv | tee out.txt
+          grep -q "verdict: telecine_3_2" out.txt
+          grep -q "verified:" out.txt
+          ./scanverdict.exe missing.mkv && exit 1 || test $? -eq 1
+
+      - name: Checksum
+        shell: bash
+        run: sha256sum dist/scanverdict.exe | tee dist/scanverdict.exe.sha256
+
+      # Ties this exact binary to this workflow run and this commit. `gh
+      # attestation verify` checks it without anyone trusting the build machine.
+      - uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: dist/scanverdict.exe
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: scanverdict-exe
+          path: |
+            dist/scanverdict.exe
+            dist/scanverdict.exe.sha256
+
+      - name: Attach to the release
+        if: startsWith(github.ref, 'refs/tags/v') || inputs.ref != ''
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="${{ inputs.ref || github.ref_name }}"
+          gh release upload "$tag" dist/scanverdict.exe dist/scanverdict.exe.sha256 \
+            --clobber --repo "$GITHUB_REPOSITORY"

README.md

@@ -31,6 +31,21 @@ If you would rather not have Python at all, grab `scanverdict.exe` from the
 [releases page](https://github.com/Booyaka101/scanverdict/releases) and run it from a
 command prompt. One file, no installer.
 
+The exe is not code signed, so the first time you run it Windows shows a blue "Windows
+protected your PC" box with only a Don't run button. Click **More info** and then **Run
+anyway**. A signing certificate costs a few hundred a year and this is a free tool, so
+that box is not going away. What you can check instead is where the binary came from:
+every exe from v1.1.1 on is built by GitHub Actions and carries a build attestation tying
+it to the workflow run and the commit, which you can verify yourself with
+[gh](https://cli.github.com/):
+
+```
+gh attestation verify scanverdict.exe --repo Booyaka101/scanverdict
+```
+
+That is a stronger claim than a checksum I paste in by hand, because I never touch the
+binary.
+
 **You need ffmpeg and ffprobe on PATH.** All decoding happens through them. Windows builds
 are at [gyan.dev](https://www.gyan.dev/ffmpeg/builds/); on macOS `brew install ffmpeg`, on
 Debian and Ubuntu `apt install ffmpeg`. If they are missing, scanverdict says so and exits