add signatures for plugin

Author: peterjah

.github/workflows/plugin.yml

@@ -121,6 +121,15 @@ jobs:
           OS: ${{ matrix.target }}
           ARCH: ${{ matrix.arch }}
 
+      - name: Sign Macos binary
+        uses: massalabs/massa/.github/actions/sign-macos@ccc3f02e34544f722634a6fb7732cc4bb515e90b
+        if: ${{ runner.os == 'macOS' }}
+        with:
+          paths: "plugin/build/deweb-plugin"
+          certificate-p12-base64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
+          certificate-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
+          signing-identity: ${{ vars.APPLE_DEVELOPER_ID_APPLICATION }}
+
       - name: Rename Plugin artifact
         run: mv build/deweb-plugin${{ matrix.ext }} deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}${{ matrix.ext }}
 
@@ -138,11 +147,59 @@ jobs:
         run: |
           cd platform_${{ matrix.target }}_${{ matrix.arch }}
           zip -r ../deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}.zip *
-          cd ..
-          ls -la deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}.zip
+
+      - name: Notarize zip for MacOS ${{ matrix.arch }}
+        uses: massalabs/massa/.github/actions/notarize-macos@ccc3f02e34544f722634a6fb7732cc4bb515e90b
+        if: matrix.target == 'darwin'
+        with:
+          paths: "./plugin/deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}.zip"
+          apple-id: ${{ secrets.APPLE_ID }}
+          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
+          apple-app-password: ${{ secrets.APPLE_APP_PASSWORD }}
 
       - name: Upload Plugin zip package
         uses: actions/upload-artifact@v4
         with:
           name: deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}
           path: plugin/deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}.zip
+
+  sign-windows-binary:
+    name: Sign Windows binary
+    needs: build
+    runs-on: windows-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Download Windows artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: deweb-plugin_windows_amd64
+          path: .
+
+      - name: Unzip Plugin zip package
+        shell: bash
+        run: |
+          unzip deweb-plugin_windows_amd64.zip -d windows-package
+
+      - name: Sign Windows binary
+        uses: massalabs/station/.github/actions/sign-file-digicert@413d4c0bbd042d5e797fbb66bcd2c96be5c3e71a
+        with:
+          files: ./windows-package/deweb-plugin_windows_amd64.exe
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_CERT_FINGERPRINT: ${{ secrets.SM_CERT_FINGERPRINT }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: zip again
+        shell: pwsh
+        run: |
+          Compress-Archive -Path "windows-package\*" -DestinationPath "deweb-plugin_windows_amd64.zip" -Force
+
+      - name: Upload signed Windows zip (overwrite original)
+        uses: actions/upload-artifact@v4
+        with:
+          name: deweb-plugin_windows_amd64
+          path: ./deweb-plugin_windows_amd64.zip
+          overwrite: true