ci: single-step build with transcript so logs always upload

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -40,45 +40,57 @@ jobs:
           Write-Host "Using MSBuild from $msbuildDir"
           Add-Content -Path $env:GITHUB_PATH -Value $msbuildDir
 
-      - name: Import code-signing cert into CurrentUser\My
-        # The VSTO ResolveKeySource target reads ManifestCertificateThumbprint
-        # straight from the csproj XML and looks for it under Cert:\CurrentUser\My
-        # (not LocalMachine\My). Import the real Marcus-Law cert there.
+      - name: Prepare + Build (single-step with full transcript)
         shell: powershell
         env:
           PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
           PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
           THUMB:   ${{ secrets.CODESIGN_THUMBPRINT }}
         run: |
+          $ErrorActionPreference = 'Continue'
+          Start-Transcript -Path build.console.log -IncludeInvocationHeader -Force
+
+          try {
+              # --- 1. Cert into CurrentUser\My (VSTO target needs it there) ---
+              Write-Host "=== STEP 1: Import cert into CurrentUser\My ==="
               $existing = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
                   Where-Object { $_.Thumbprint -eq $env:THUMB }
-          if ($existing) { Write-Host "Cert already in CurrentUser\My."; return }
+              if ($existing) {
+                  Write-Host "Cert $env:THUMB already in CurrentUser\My."
+              } else {
                   $pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
                   $tmp = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx"
                   [IO.File]::WriteAllBytes($tmp, $pfxBytes)
                   $pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
-          Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null
+                  Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd -ErrorAction Stop | Out-Null
                   Remove-Item -Force $tmp
-          Write-Host "Cert imported into CurrentUser\My."
+                  Write-Host "Imported into CurrentUser\My."
+              }
 
-      - name: Patch csproj to use real cert thumbprint
-        # VS's compile-time manifest signing reads the thumbprint from the
-        # csproj XML (not from /p: overrides), so we rewrite it in place to
-        # point at our Marcus-Law cert.
-        shell: powershell
-        env:
-          THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
-        run: |
+              # Verify what's in the store now
+              Write-Host "Certs in CurrentUser\My:"
+              Get-ChildItem Cert:\CurrentUser\My | ForEach-Object {
+                  Write-Host "  $($_.Thumbprint) $($_.Subject)"
+              }
+
+              # --- 2. Patch csproj ---
+              Write-Host "=== STEP 2: Patch csproj ==="
               $csproj = 'src/OutlookAddin/OutlookAddin.csproj'
               $orig   = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
               $content = Get-Content $csproj -Raw
+              if ($content -match [regex]::Escape($orig)) {
                   $patched = $content -replace [regex]::Escape($orig), $env:THUMB
-          if ($patched -eq $content) { Write-Warning "Thumbprint $orig not present in csproj." }
-          else { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched: $orig -> $env:THUMB" }
+                  Set-Content -Path $csproj -Value $patched -NoNewline
+                  Write-Host "Patched csproj: $orig -> $env:THUMB"
+              } else {
+                  Write-Host "Thumbprint $orig already replaced (or not present)."
+              }
+              # Verify
+              Write-Host "Resulting ManifestCertificateThumbprint:"
+              (Get-Content $csproj | Select-String 'ManifestCertificateThumbprint') -join "`n" | Write-Host
 
-      - name: Build (restore + compile)
-        shell: powershell
-        run: |
+              # --- 3. Build ---
+              Write-Host "=== STEP 3: msbuild /restore /t:Build ==="
               $msbuildArgs = @(
                   'OutlookAddin.sln',
                   '/restore',
@@ -87,12 +99,18 @@ jobs:
                   '/p:Platform="Any CPU"',
                   '/m',
                   '/flp:logfile=build.log;verbosity=detailed',
-            '/flp1:logfile=build-errors.log;errorsonly',
-            '/flp2:logfile=build-warnings.log;warningsonly'
+                  '/flp1:logfile=build-errors.log;errorsonly'
               )
-          & msbuild @msbuildArgs 2>&1 | Tee-Object -FilePath build.console.log
+              & msbuild @msbuildArgs
               $code = $LASTEXITCODE
               Write-Host "msbuild exit code: $code"
+          } catch {
+              Write-Host "FATAL: $($_.Exception.Message)"
+              Write-Host $_.ScriptStackTrace
+              $code = 1
+          } finally {
+              Stop-Transcript
+          }
           if ($code -ne 0) { exit $code }
 
       - name: Upload build logs
@@ -101,10 +119,10 @@ jobs:
         with:
           name: build-logs-run${{ github.run_id }}
           path: |
+            build.console.log
             build.log
             build-errors.log
-            build-warnings.log
-            build.console.log
+            src/OutlookAddin/OutlookAddin.csproj
           retention-days: 7
           if-no-files-found: warn