fix(ci): minisign install

Author: streamer45

.github/workflows/marketplace-build.yml

@@ -24,6 +24,7 @@ env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
   SHERPA_ONNX_VERSION: "1.12.17"
+  MINISIGN_VERSION: "0.12"
   MARKETPLACE_VERSION: ${{ inputs.version }}
   RELEASE_TAG: ${{ inputs.release_tag }}
   REGISTRY_BASE_URL: ${{ inputs.registry_base_url || format('https://{0}.github.io/streamkit/registry', github.repository_owner) }}
@@ -40,7 +41,28 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y cmake pkg-config libclang-dev wget libopenblas-dev zstd minisign patchelf python3-yaml
+          sudo apt-get install -y cmake pkg-config libclang-dev wget libopenblas-dev zstd patchelf python3-yaml
+
+      - name: Install minisign
+        run: |
+          tar_path="/tmp/minisign-${MINISIGN_VERSION}-linux.tar.gz"
+          wget -O "${tar_path}" \
+            https://github.com/jedisct1/minisign/releases/download/${MINISIGN_VERSION}/minisign-${MINISIGN_VERSION}-linux.tar.gz
+          extract_dir="/tmp/minisign-${MINISIGN_VERSION}"
+          mkdir -p "${extract_dir}"
+          python3 -m tarfile -e "${tar_path}" "${extract_dir}"
+          preferred="${extract_dir}/minisign-linux/x86_64/minisign"
+          if [ -x "${preferred}" ]; then
+            minisign_path="${preferred}"
+          else
+            minisign_path="$(find "${extract_dir}" -type f -name minisign -print -quit)"
+          fi
+          if [ -z "${minisign_path}" ]; then
+            echo "minisign binary not found in ${extract_dir}"
+            exit 1
+          fi
+          sudo install -m 0755 "${minisign_path}" /usr/local/bin/minisign
+          minisign -h >/dev/null
 
       - name: Install sherpa-onnx
         run: |

.github/workflows/marketplace-release.yml

@@ -25,6 +25,9 @@ env:
 jobs:
   marketplace:
     uses: ./.github/workflows/marketplace-build.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
       version: ${{ inputs.version }}
       release_tag: ${{ inputs.release_tag || format('marketplace-v{0}', inputs.version) }}

.github/workflows/release.yml

@@ -82,6 +82,9 @@ jobs:
 
   marketplace:
     uses: ./.github/workflows/marketplace-build.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
       version: ${{ github.ref_name }}
       release_tag: ${{ github.ref_name }}