Add check for game capture signatures

[sandboxcoder]

No description provided.

[Copilot]

🟡 Changes recommended

The new CI script should handle its top-level async Promise deterministically, and the added Windows job likely needs the same gating as other expensive jobs to preserve the workflow’s existing skip-when-non-testable behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a Windows CI verification step to ensure the obs-studio-node Game Capture binaries shipped/consumed by the repo are Authenticode-signed and published by the expected issuer (“OBS Project, LLC”), helping detect unsigned/tampered/untrusted binaries early in the pipeline.

Changes:

• Introduces a CI script that checks Authenticode signature validity and publisher for the win-capture dependency binaries via PowerShell.
• Adds a new GitHub Actions job on windows-2022 to run the signature verification and includes it in the required results collation.

File summaries

File	Description
scripts/ci/verify_game_signatures.ts	New TypeScript CI script that validates Authenticode signatures and expected publisher for required win-capture binaries.
.github/workflows/tests.yml	Adds a Windows job to execute the new signature verification script and makes it part of the workflow’s required job collation.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[bundlemon]

BundleMon

Unchanged files (4)

Status	Path	Size	Limits
✅	renderer.(hash).js	10.48MB	-
✅	vendors~renderer.(hash).js	4.67MB	-
✅	updater.js	115.29KB	-
✅	guest-api.js	40.23KB	-

No change in files bundle size

Final result: ✅

View report in BundleMon website ➡️

---

Current branch size history | Target branch size history

[Copilot]

🟡 Changes recommended

The new CI script’s PowerShell stderr/CLIXML parsing can produce unhelpful raw XML “details,” reducing diagnosability when the check fails.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new CI job’s gating condition can skip signature verification on dependency-only PRs (e.g., yarn.lock/package.json updates), which undermines the intended protection for obs-studio-node binary changes.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

[CLAassistant]

All committers have signed the CLA.

[Copilot]

🟡 Changes recommended

CI now executes a new ts-node-based script path that diverges from existing repo scripting conventions and should be adjusted to reduce fragility.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new CI job is currently misconfigured (artifact/checkout/dependency ordering), which will cause the workflow to fail or run without the required files.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new CI job is currently wired such that it can be skipped or fail due to missing build/artifact preparation and execution context (extraction/working directory/prepare gating).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new CI job is currently misconfigured (artifact extraction / working-directory) and its gating conflicts with its dependency on the build job, so it won’t reliably run or verify the intended binaries.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/tests.yml:90

• verify-game-capture-binary-signatures is configured to run on dependency-only PRs (has-dependency-changes == 'true'), but it needs: prepare-frontend-tests and that job currently does not run for dependency-only changes. That means this verification either won’t run or won’t have an artifact to verify in the exact scenario it’s intended to cover. Update the prepare-frontend-tests job gate to include has-dependency-changes (or adjust the dependency/if logic so an artifact is always produced when this job runs).

    needs: [testable-changes, prepare-frontend-tests]
    if: needs.testable-changes.outputs.has-testable-changes == 'true' || needs.testable-changes.outputs.has-dependency-changes == 'true' || github.event_name == 'push'
    runs-on: windows-2022

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The new verification job is still effectively skipped on dependency-only PRs due to its dependency on prepare-frontend-tests, and the job also lacks Node/Corepack setup needed to reliably run Yarn Berry + ts-node on GitHub-hosted Windows runners.

Review details

Suppressed comments (2)

.github/workflows/tests.yml:90

• verify-game-capture-binary-signatures is intended to run on dependency-only PRs (via has-dependency-changes), but it needs: [testable-changes, prepare-frontend-tests] while prepare-frontend-tests is still gated only on has-testable-changes (or push). On PRs that only touch package.json/yarn.lock, prepare-frontend-tests will be skipped, which causes this job to be skipped as well, so signatures won’t be verified in the exact scenario this job is meant to cover. Update the prepare-frontend-tests job condition to also run when has-dependency-changes == 'true' (or adjust the dependency graph so this job can still get a build artifact).

  verify-game-capture-binary-signatures:
    name: 'Verify Game Capture Binary Signatures'
    needs: [testable-changes, prepare-frontend-tests]
    if: needs.testable-changes.outputs.has-testable-changes == 'true' || needs.testable-changes.outputs.has-dependency-changes == 'true' || github.event_name == 'push'
    runs-on: windows-2022

.github/workflows/tests.yml:110

• This job runs yarn ts-node ... on a GitHub-hosted Windows runner, but it doesn’t set up the Node/Yarn toolchain (unlike prepare-frontend-tests, which pins Node 22). Without actions/setup-node (and Corepack for Yarn Berry), this step can fail depending on the runner image defaults or future image updates.

    steps:
      - name: 'Download Test Build'
        uses: actions/download-artifact@v4
        with:
          name: frontend-test-build
          path: ${{ runner.temp }}/frontend-test-artifact
      - name: 'Prepare Test Runner'
        run: |
          $projectDirectory = Join-Path $env:RUNNER_TEMP 'frontend-test-project'
          New-Item -ItemType Directory -Force -Path $projectDirectory | Out-Null
          7z x "$env:RUNNER_TEMP\frontend-test-artifact\frontend-test-build.7z" "-o$projectDirectory" -y -bb0
          Set-Location $projectDirectory

          if (-not (Test-Path package.json)) {
            throw "Test build does not contain package.json at $projectDirectory"
          }
        shell: powershell
      - name: 'Run Game Capture Binary Signature Verification'
        run: yarn ts-node scripts/ci/verify_game_signatures.ts
        working-directory: ${{ runner.temp }}/frontend-test-project

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new workflow job runs Yarn/ts-node without the same pinned Node setup used elsewhere in the workflow, which can lead to inconsistent CI behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The new Windows verification job relies on yarn/ts-node without setting up a deterministic Node/Yarn runtime, which can make CI fragile on hosted runner image updates.

Review details

Suppressed comments (1)

.github/workflows/tests.yml:91

• This job runs yarn ts-node ... but doesn’t pin/setup Node (and therefore Yarn/Corepack) like prepare-frontend-tests does. On windows-2022 hosted runners this can become flaky as the image changes. Add actions/setup-node@v4 to make the runtime deterministic.

    runs-on: windows-2022
    steps:

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new GitHub-hosted Windows verification job is missing the workflow’s established Node/Yarn setup step (and a job timeout), which can make the check unreliable or hang longer than necessary.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/tests.yml:110

• This new GitHub-hosted Windows job runs yarn ts-node ... but (unlike prepare-frontend-tests and es-lint-strict-nulls) does not set up/pin Node or ensure Corepack-managed Yarn is available. This can become flaky or run against an unexpected Yarn/Node version on windows-2022 images; add actions/setup-node before invoking yarn.

      - name: 'Run Game Capture Binary Signature Verification'
        run: yarn ts-node scripts/ci/verify_game_signatures.ts
        working-directory: ${{ runner.temp }}/frontend-test-project

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The new verify-binary job includes a HEVC “encoder” check that can incorrectly pass on decoder-only support, and the job currently lacks deterministic Node/Yarn setup on GitHub-hosted Windows runners.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/tests.yml:110

• verify-binary runs yarn ts-node ... on a GitHub-hosted Windows runner but doesn’t set up the pinned Node version (22.18.0) or ensure Yarn/Corepack is available, unlike the other GH-hosted Windows jobs in this workflow. This can lead to non-deterministic failures if the runner image’s preinstalled Node/Yarn changes.

      - name: 'Run Game Capture Binary Signature Verification'
        run: yarn ts-node scripts/ci/verify_game_signatures.ts
        working-directory: ${{ runner.temp }}/frontend-test-project

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The new verification job invokes yarn ts-node on a GitHub-hosted Windows runner without setting up Node/Corepack, which can make the job fail due to missing or mismatched Yarn tooling.

Review details

Suppressed comments (1)

.github/workflows/tests.yml:110

• verify-binary runs yarn ts-node ... on a GitHub-hosted windows-2022 runner without first setting up Node/Corepack. Since this repo pins Yarn via packageManager: yarn@3.1.1, the yarn command may be missing or resolve to the wrong version on the runner, causing the signature check to fail before it even runs. Add a setup-node step and invoke Yarn via corepack for a deterministic toolchain.

      - name: 'Run Game Capture Binary Signature Verification'
        run: yarn ts-node scripts/ci/verify_game_signatures.ts
        working-directory: ${{ runner.temp }}/frontend-test-project

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite