From 0e21be21f383fa710133e44ea2a3945c623b5163 Mon Sep 17 00:00:00 2001 From: Chaim Date: Mon, 11 May 2026 16:10:59 +0000 Subject: [PATCH] fix(ci): skip compile-time manifest signing (MSB3323) The legacy VSTO project carries true with a thumbprint pointing to VS's auto-generated temporary key, which exists on a developer's machine but never on a CI runner. The release manifests are signed properly in publish-clickonce via mage with the real Marcus-Law cert, so /p:SignManifests=false at compile time is the right thing. Co-Authored-By: Claude Opus 4.7 (1M context) --- .gitea/workflows/build.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index eac3107..e22c36e 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -45,7 +45,11 @@ jobs: # which keeps the NuGet package cache + project.assets.json + assembly # resolution consistent (avoids NETSDK1064 from a mismatch between a # standalone `nuget restore` and the later build). - run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m + # SignManifests=false disables the project's compile-time ClickOnce + # manifest signing (it references VS's auto-generated temporary key + # which doesn't exist on the runner). The release manifests are signed + # later with the real code-signing cert via mage in publish-clickonce. + run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m - name: Test run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx" @@ -134,7 +138,11 @@ jobs: Write-Host "Cert imported." - name: Build Release (restore + compile) - run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m + # SignManifests=false disables the project's compile-time ClickOnce + # manifest signing (it references VS's auto-generated temporary key + # which doesn't exist on the runner). The release manifests are signed + # later with the real code-signing cert via mage in publish-clickonce. + run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m # Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool # picks it by thumbprint, the service runs as LocalSystem so the runtime