fix(ci): sign the standalone Server artifact and stop rebuilding win7 branches

.github/workflows/dev-build.yml

@@ -33,6 +33,9 @@ on:
       - develop
       - main
       - 'release-please--*'
+      # The Windows 7 port lives in its own repository with dev-build-win7.yml; branches named for
+      # it are pushed here from that work and would only rebuild an artifact nobody asked for.
+      - 'win7*'
     tags-ignore:
       - '**'
     paths-ignore:
@@ -127,7 +130,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dev-tsf-${{ matrix.name }}
-          retention-days: 7
+          retention-days: ${{ env.DEV_ARTIFACT_RETENTION }}
           # Same layout convention as the release workflow: download-artifact restores the
           # directory contents where Prepare-PackageFiles.ps1 expects them.
           path: ${{ matrix.build_dir }}/Release
@@ -218,13 +221,43 @@ jobs:
       - name: Embed the Server uiAccess manifest
         shell: pwsh
         run: ./scripts/ci/embed-server-manifest.ps1 -BuildDir server/build-release/bin/Release
+      # component=server uploads this directory as an installable artifact with no package job to
+      # sign it. Windows ignores uiAccess=true without a trusted signature, so the binary would
+      # install and then silently lose the privilege. component=all leaves it unsigned on purpose:
+      # Prepare-PackageFiles.ps1 copies these files into the payload and sign-dev-build.ps1 signs
+      # the copies, so signing here would only add a second signing pass over the same bytes.
+      - name: Sign the Server build for the standalone artifact
+        if: ${{ (inputs.component || 'all') == 'server' }}
+        shell: pwsh
+        env:
+          DEV_CERT_PATH: ${{ runner.temp }}/dev-server-certificate.cer
+        run: |
+          # -Include 只有在 -Path 带通配符或同时给 -Recurse 时才生效，这里显式计算再交给参数，
+          # 免得把一条空列表传进脚本后它才在内部报错。
+          $targets = @(
+            Get-ChildItem -LiteralPath 'server/build-release/bin/Release' -Recurse -File |
+              Where-Object { $_.Extension -in @('.exe', '.dll') } |
+              ForEach-Object FullName
+          )
+          if ($targets.Count -eq 0) { throw 'No EXE or DLL found to sign under server/build-release/bin/Release.' }
+          ./installer/sign-dev-build.ps1 -FilePath $targets
       - name: Upload the Server build
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dev-server
-          retention-days: 7
+          retention-days: ${{ env.DEV_ARTIFACT_RETENTION }}
           path: server/build-release/bin/Release
           if-no-files-found: error
+      # The certificate has to travel with the standalone Server artifact too, or nobody can import
+      # the trust that the signature above depends on.
+      - name: Upload the signing certificate
+        if: ${{ (inputs.component || 'all') == 'server' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dev-server-certificate
+          retention-days: ${{ env.DEV_ARTIFACT_RETENTION }}
+          path: ${{ runner.temp }}/dev-server-certificate.cer
+          if-no-files-found: error
 
   package:
     name: Package installer
@@ -321,7 +354,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dev-installer
-          retention-days: 7
+          retention-days: ${{ env.DEV_ARTIFACT_RETENTION }}
           path: |
             ${{ steps.asset.outputs.installer_path }}
             ${{ runner.temp }}/dev-build.cer