espocrm-extensions/OutlookAddin
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): skip compile-time manifest signing (MSB3323)

Browse Source 
The legacy VSTO project carries <SignManifests>true</SignManifests> with
a thumbprint pointing to VS's auto-generated temporary key, which exists
on a developer's machine but never on a CI runner. The release manifests
are signed properly in publish-clickonce via mage with the real Marcus-Law
cert, so /p:SignManifests=false at compile time is the right thing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chaim Marcus
2026-05-11 16:10:59 +00:00
parent 399fd24f4d
commit 0e21be21f3
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+10 -2
View File
@@ -45,7 +45,11 @@ jobs:
# which keeps the NuGet package cache + project.assets.json + assembly
# resolution consistent (avoids NETSDK1064 from a mismatch between a
# standalone `nuget restore` and the later build).
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
# SignManifests=false disables the project's compile-time ClickOnce
# manifest signing (it references VS's auto-generated temporary key
# which doesn't exist on the runner). The release manifests are signed
# later with the real code-signing cert via mage in publish-clickonce.
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m
- name: Test
run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx"
@@ -134,7 +138,11 @@ jobs:
Write-Host "Cert imported."
- name: Build Release (restore + compile)
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
# SignManifests=false disables the project's compile-time ClickOnce
# manifest signing (it references VS's auto-generated temporary key
# which doesn't exist on the runner). The release manifests are signed
# later with the real code-signing cert via mage in publish-clickonce.
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m
# Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool
# picks it by thumbprint, the service runs as LocalSystem so the runtime