espocrm-extensions/OutlookAddin
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): override ManifestCertificateThumbprint with Marcus-Law cert

Browse Source 
VSTO refuses to build with SignManifests=false. Override the project's
hardcoded VS-temporary-key thumbprint with our real code-signing cert
(already imported into LocalMachine\My during runner setup).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chaim Marcus
2026-05-11 16:12:52 +00:00
parent 0e21be21f3
commit 9f595c8ece
1 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+12 -10
View File
@@ -45,11 +45,12 @@ jobs:
# which keeps the NuGet package cache + project.assets.json + assembly
# resolution consistent (avoids NETSDK1064 from a mismatch between a
# standalone `nuget restore` and the later build).
# SignManifests=false disables the project's compile-time ClickOnce
# manifest signing (it references VS's auto-generated temporary key
# which doesn't exist on the runner). The release manifests are signed
# later with the real code-signing cert via mage in publish-clickonce.
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m
# VSTO mandates SignManifests=true (the build aborts otherwise). The
# project's hardcoded ManifestCertificateThumbprint points to VS's
# auto-generated temporary key which doesn't exist on the runner, so
# override it with the real Marcus-Law cert that lives in
# LocalMachine\My (migrated there by 2-install-windows-runner.ps1).
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m
- name: Test
run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx"
@@ -138,11 +139,12 @@ jobs:
Write-Host "Cert imported."
- name: Build Release (restore + compile)
# SignManifests=false disables the project's compile-time ClickOnce
# manifest signing (it references VS's auto-generated temporary key
# which doesn't exist on the runner). The release manifests are signed
# later with the real code-signing cert via mage in publish-clickonce.
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m
# VSTO mandates SignManifests=true (the build aborts otherwise). The
# project's hardcoded ManifestCertificateThumbprint points to VS's
# auto-generated temporary key which doesn't exist on the runner, so
# override it with the real Marcus-Law cert that lives in
# LocalMachine\My (migrated there by 2-install-windows-runner.ps1).
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m
# Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool
# picks it by thumbprint, the service runs as LocalSystem so the runtime