Maximilian Roos 8f55d15301 fix(release): preserve signed Windows zip filename, match checksum format (#3556) ...

## Summary
- The SignPath action's `skip-decompress` defaults to `false`, so it
would have extracted the returned zip's contents as loose files into
`target/distrib/` instead of saving back a signed
`worktrunk-x86_64-pc-windows-msvc.zip`. The checksum step would have
silently hashed the still-unsigned zip, and the release would have
shipped unsigned Windows binaries with no CI failure to flag it.
- `sha256sum` without `-b` omits the `*` binary-mode marker;
cargo-dist's own checksums use `<hash> *<filename>` (confirmed against a
real release asset). Added `-b` to match.

Confirmed via `gh run view` on #3553's own CI run that
`build-local-artifacts` is skipped on PRs in this repo, so this code
path has never actually executed — this is the first real fix before it
runs for real on a tagged release.

## Test plan
- [x] `actionlint .github/workflows/release.yaml` — no new warnings
(same pre-existing shellcheck style notes as before)
- [x] Verified `skip-decompress` behavior against the action's own
`action.yml` input spec
- [x] Verified checksum format against a real downloaded release asset
(`v0.68.0`)

> _This was written by Claude Code on behalf of Max_

2026-07-23 16:13:30 -07:00

..

actions

…

aur

…

scripts

…

workflows

…

.codecov.yaml

…

benchmark-failure.md

…

CLAUDE.md

…

dependabot.yaml

…

nightly-failure.md

…