Trigger signing rehearsal via branch-scoped push

workflow_dispatch requires the file on the default branch; keep the
rehearsal off main by triggering on pushes to this branch that touch
this workflow file, defaulting to the test-signing policy.

.github/workflows/windows-signing-rehearsal.yml

@@ -13,6 +13,14 @@
 name: Windows signing rehearsal
 
 on:
+  # Why: workflow_dispatch only works for files on the default branch, and this
+  # rehearsal must stay off main. Trigger on pushes that touch this file on the
+  # rehearsal branch instead; re-run by amending the trigger comment below.
+  push:
+    branches:
+      - Jinwoo-H/code-signing-windows
+    paths:
+      - .github/workflows/windows-signing-rehearsal.yml
   workflow_dispatch:
     inputs:
       signing-policy-slug:
@@ -27,6 +35,8 @@ on:
         type: string
         default: windows-inner-binaries-zip
 
+# Trigger nonce: 1
+
 jobs:
   rehearse:
     # Why: SignPath origin verification requires GitHub-hosted runners, and
@@ -162,8 +172,8 @@ jobs:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: c37aa192-a27a-4377-9c90-5d6c95912dc0
           project-slug: orca
-          signing-policy-slug: ${{ inputs.signing-policy-slug }}
-          artifact-configuration-slug: ${{ inputs.inner-artifact-configuration-slug }}
+          signing-policy-slug: ${{ inputs.signing-policy-slug || 'test-signing' }}
+          artifact-configuration-slug: ${{ inputs.inner-artifact-configuration-slug || 'windows-inner-binaries-zip' }}
           github-artifact-id: ${{ steps.upload-unsigned-inner.outputs.artifact-id }}
           wait-for-completion: false
 
@@ -235,7 +245,7 @@ jobs:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: c37aa192-a27a-4377-9c90-5d6c95912dc0
           project-slug: orca
-          signing-policy-slug: ${{ inputs.signing-policy-slug }}
+          signing-policy-slug: ${{ inputs.signing-policy-slug || 'test-signing' }}
           artifact-configuration-slug: github-actions-windows-installer
           github-artifact-id: ${{ steps.upload-unsigned-installer.outputs.artifact-id }}
           wait-for-completion: false
@@ -294,7 +304,7 @@ jobs:
       - name: Verify signatures end to end
         shell: pwsh
         env:
-          SIGNING_POLICY: ${{ inputs.signing-policy-slug }}
+          SIGNING_POLICY: ${{ inputs.signing-policy-slug || 'test-signing' }}
         run: |
           $report = New-Object System.Collections.Generic.List[string]
           $failures = New-Object System.Collections.Generic.List[string]
@@ -344,7 +354,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: windows-signing-rehearsal-${{ inputs.signing-policy-slug }}-${{ github.run_id }}
+          name: windows-signing-rehearsal-${{ inputs.signing-policy-slug || 'test-signing' }}-${{ github.run_id }}
           path: |
             signing-evidence.txt
             inner-signing-list.txt