Merge branch 'master' into jgrpp-beta

# Conflicts:
#	.github/workflows/commit-checker.yml
#	src/company_cmd.cpp
#	src/console_cmds.cpp
#	src/crashlog.cpp
#	src/lang/english.txt
#	src/lang/german.txt
#	src/lang/indonesian.txt
#	src/lang/japanese.txt
#	src/lang/korean.txt
#	src/lang/swedish.txt
#	src/linkgraph/linkgraphjob.cpp
#	src/linkgraph/mcf.cpp
#	src/network/core/tcp.cpp
#	src/network/core/tcp.h
#	src/network/core/tcp_game.h
#	src/network/core/udp.h
#	src/network/network.cpp
#	src/network/network_admin.cpp
#	src/network/network_admin.h
#	src/network/network_chat_gui.cpp
#	src/network/network_client.cpp
#	src/network/network_client.h
#	src/network/network_func.h
#	src/network/network_internal.h
#	src/network/network_server.cpp
#	src/network/network_server.h
#	src/newgrf.cpp
#	src/newgrf_station.cpp
#	src/order_gui.cpp
#	src/rail_cmd.cpp
#	src/saveload/saveload.cpp
#	src/settings.cpp
#	src/settings_gui.cpp
#	src/settings_internal.h
#	src/settings_type.h
#	src/station_cmd.cpp
#	src/stdafx.h
#	src/table/currency_settings.ini
#	src/table/misc_settings.ini
#	src/table/settings.h.preamble
#	src/table/settings.ini
#	src/terraform_cmd.cpp
#	src/timetable_gui.cpp
#	src/train_cmd.cpp
#	src/tree_cmd.cpp
#	src/water_cmd.cpp

.github/workflows/ci-build.yml

@@ -325,34 +325,8 @@ jobs:
 
     if: always() && github.event_name == 'pull_request'
 
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
 
     steps:
-    - name: Get check suite ID
-      id: check_suite_id
-      uses: octokit/request-action@v2.x
-      with:
-        route: GET /repos/{repository}/actions/runs/{run_id}
-        repository: ${{ github.repository }}
-        run_id: ${{ github.run_id }}
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Get check runs
-      id: check_runs
-      uses: octokit/request-action@v2.x
-      with:
-        route: GET /repos/{repository}/check-suites/{check_suite_id}/check-runs
-        repository: ${{ github.repository }}
-        check_suite_id: ${{ fromJson(steps.check_suite_id.outputs.data).check_suite_id }}
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
     - name: Check annotations
-      shell: bash
-      run: |
-        echo '[
-        ${{ toJson(fromJson(steps.check_runs.outputs.data).check_runs.*.output.title) }}, ${{ toJson(fromJson(steps.check_runs.outputs.data).check_runs.*.output.summary) }}
-        ]' | jq '.[0] as $t | .[1] as $s | reduce range(.[0] | length) as $i ([]; . + [if $t[$i] then $t[$i] + ": " + $s[$i] else empty end]) | .[]'
-
-        exit $(echo '${{ toJson(fromJson(steps.check_runs.outputs.data).check_runs.*.output.annotations_count) }}' | jq 'add')
+      uses: OpenTTD/actions/annotation-check@v2

.github/workflows/release.yml

@@ -750,6 +750,21 @@ jobs:
       with:
         arch: ${{ matrix.host }}
 
+    - name: Import code signing certificate
+      shell: powershell
+      # If this is run on a fork, there may not be a certificate set up - continue in this case
+      continue-on-error: true
+      run: |
+        $tempFile = [System.IO.Path]::GetTempFileName()
+        $bytes = [System.Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_P12)
+        [IO.File]::WriteAllBytes($tempFile, $bytes)
+        $pwd = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
+        Import-PfxCertificate -FilePath $tempFile -CertStoreLocation Cert:\CurrentUser\My -Password $pwd
+        Remove-Item $tempFile
+      env:
+        WINDOWS_CERTIFICATE_P12: ${{ secrets.WINDOWS_CERTIFICATE_P12 }}
+        WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+
     - name: Build (with installer)
       if: needs.source.outputs.is_tag == 'true'
       shell: bash
@@ -765,12 +780,15 @@ jobs:
           -DOPTION_USE_NSIS=ON \
           -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \
           -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DWINDOWS_CERTIFICATE_COMMON_NAME="${WINDOWS_CERTIFICATE_COMMON_NAME}" \
           # EOF
         echo "::endgroup::"
 
         echo "::group::Build"
         cmake --build .
         echo "::endgroup::"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
 
     - name: Build (without installer)
       if: needs.source.outputs.is_tag != 'true'
@@ -786,12 +804,15 @@ jobs:
           -DCMAKE_TOOLCHAIN_FILE="c:\vcpkg\scripts\buildsystems\vcpkg.cmake" \
           -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \
           -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DWINDOWS_CERTIFICATE_COMMON_NAME="${WINDOWS_CERTIFICATE_COMMON_NAME}" \
           # EOF
         echo "::endgroup::"
 
         echo "::group::Build"
         cmake --build .
         echo "::endgroup::"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
 
     - name: Create bundles
       shell: bash
@@ -813,6 +834,17 @@ jobs:
         rm -f bundles/*.sha256
         echo "::endgroup::"
 
+    - name: Sign installer
+      if: needs.source.outputs.is_tag == 'true'
+      shell: bash
+      # If this is run on a fork, there may not be a certificate set up - continue in this case
+      continue-on-error: true
+      run: |
+        cd ${GITHUB_WORKSPACE}/build/bundles
+        ../../os/windows/sign.bat *.exe "${WINDOWS_CERTIFICATE_COMMON_NAME}"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
+
     - name: Store bundles
       uses: actions/upload-artifact@v2
       with: