new plugin signing and checking

build-plugin.sh

@@ -67,4 +67,15 @@ else
   exit 1
 fi
 
+# Optional: sign the plugin if PLUGIN_SIGN_KEY is set
+if [[ -n "${PLUGIN_SIGN_KEY:-}" ]]; then
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  if command -v bun >/dev/null 2>&1; then
+    echo "[sign] Signing plugin with key: ${PLUGIN_SIGN_KEY}"
+    bun run "${SCRIPT_DIR}/Overlord-Server/scripts/plugin-sign.ts" --key "${PLUGIN_SIGN_KEY}" "${ZIP_OUT}"
+  else
+    echo "[warn] bun not found, skipping plugin signing" >&2
+  fi
+fi
+
 echo "[ok] ${ZIP_OUT}"