From b712b6e43be26971949c90e473384d1858a7dfc6 Mon Sep 17 00:00:00 2001
From: DarkSky <darksky2048@gmail.com>
Date: Sat, 4 Jul 2026 01:59:51 +0800
Subject: [PATCH] fix: test & lint

---
 .github/workflows/windows-signer.yml | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/windows-signer.yml b/.github/workflows/windows-signer.yml
index 1e08144594..dfec72c9d6 100644
--- a/.github/workflows/windows-signer.yml
+++ b/.github/workflows/windows-signer.yml
@@ -15,13 +15,29 @@ jobs:
       ARCHIVE_DIR: ${{ github.run_id }}-${{ github.run_attempt }}-${{ inputs.artifact-name }}
       AFFINE_SIGNER_ADDR: ${{ secrets.AFFINE_SIGNER_ADDR }}
       AFFINE_SIGNER_TOKEN: ${{ secrets.AFFINE_SIGNER_TOKEN }}
-      TS_AUTH_KEY: ${{ secrets.AFFINE_SIGNER_TS_AUTH_KEY }}
       TS_RS_EXPERIMENT: this_is_unstable_software
     steps:
       - uses: actions/download-artifact@v4
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{ env.ARCHIVE_DIR }}
+      - name: Connect Tailscale
+        uses: tailscale/github-action@v4
+        with:
+          authkey: ${{ secrets.AFFINE_SIGNER_TS_AUTH_KEY }}
+          hostname: affine-signer-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Check signer connectivity
+        shell: pwsh
+        run: |
+          $Parts = "$env:AFFINE_SIGNER_ADDR".Split(':')
+          if ($Parts.Count -ne 2) {
+            throw "AFFINE_SIGNER_ADDR must be host:port, got $env:AFFINE_SIGNER_ADDR"
+          }
+
+          $Result = Test-NetConnection -ComputerName $Parts[0] -Port ([int]$Parts[1])
+          if (!$Result.TcpTestSucceeded) {
+            throw "Unable to connect to signer at $env:AFFINE_SIGNER_ADDR"
+          }
       - name: Download remote signer client
         shell: pwsh
         run: |
@@ -77,7 +93,8 @@ jobs:
             --token "$env:AFFINE_SIGNER_TOKEN" `
             --workdir '${{ env.ARCHIVE_DIR }}/out' `
             --files '${{ inputs.files }}' `
-            --cert windows-signer-public.cer
+            --cert windows-signer-public.cer `
+            --plain-tcp
       - name: collect signed file diff
         shell: powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0}
         run: |