ci: Sign Windows binaries only on tag push

  Our Windows installer includes a number of other binaries such as DLLs
  that need to be signed as well as our own executable.
  In total, we need to sign 24 files.

  Since our code signing certificate comes with a limited number of
  signatures and additional ones are costly, we'll sign binaries only
  when doing a release thus when building a tag.

.appveyor.yml

@@ -34,7 +34,7 @@ before_build:
   - ps: if ($env:BUILD_JOB -eq "build") { pwsh -NoProfile -ExecutionPolicy Unrestricted -Command .\build\windows\setup-keylocker.ps1 }
 
 build_script:
-  - ps: $env:SKIP_CODE_SIGNING=($env:APPVEYOR_REPO_BRANCH -ne "master")
+  - ps: $env:SIGN_CODE=( ($env:APPVEYOR_REPO_BRANCH -eq "master" ) -and ($env:APPVEYOR_REPO_TAG -eq 'true') )
   - ps: if ($env:BUILD_JOB -eq "build") { yarn dist }
 
 artifacts:

build/windows/customSign.js

@@ -2,7 +2,7 @@
 'use strict'
 
 exports.default = async function (configuration) {
-  if (process.env.SKIP_CODE_SIGNING === 'True') {
+  if (process.env.SIGN_CODE !== 'True') {
     // eslint-disable-next-line no-console
     console.log('Skipping code signing')
     return