I've actually got an action for this (based on fork, so can't take full credit): https://github.com/mscrivo/signtool-code-sign

you can see a usage example here: https://github.com/mscrivo/OotD/blob/main/.github/workflows/...