From 9f595c8ece5f45c28e62f303a3f1c0571ce88e14 Mon Sep 17 00:00:00 2001 From: Chaim Date: Mon, 11 May 2026 16:12:52 +0000 Subject: [PATCH] fix(ci): override ManifestCertificateThumbprint with Marcus-Law cert VSTO refuses to build with SignManifests=false. Override the project's hardcoded VS-temporary-key thumbprint with our real code-signing cert (already imported into LocalMachine\My during runner setup). Co-Authored-By: Claude Opus 4.7 (1M context) --- .gitea/workflows/build.yml | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index e22c36e..0f52b10 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -45,11 +45,12 @@ jobs: # which keeps the NuGet package cache + project.assets.json + assembly # resolution consistent (avoids NETSDK1064 from a mismatch between a # standalone `nuget restore` and the later build). - # SignManifests=false disables the project's compile-time ClickOnce - # manifest signing (it references VS's auto-generated temporary key - # which doesn't exist on the runner). The release manifests are signed - # later with the real code-signing cert via mage in publish-clickonce. - run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m + # VSTO mandates SignManifests=true (the build aborts otherwise). The + # project's hardcoded ManifestCertificateThumbprint points to VS's + # auto-generated temporary key which doesn't exist on the runner, so + # override it with the real Marcus-Law cert that lives in + # LocalMachine\My (migrated there by 2-install-windows-runner.ps1). + run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m - name: Test run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx" @@ -138,11 +139,12 @@ jobs: Write-Host "Cert imported." - name: Build Release (restore + compile) - # SignManifests=false disables the project's compile-time ClickOnce - # manifest signing (it references VS's auto-generated temporary key - # which doesn't exist on the runner). The release manifests are signed - # later with the real code-signing cert via mage in publish-clickonce. - run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m + # VSTO mandates SignManifests=true (the build aborts otherwise). The + # project's hardcoded ManifestCertificateThumbprint points to VS's + # auto-generated temporary key which doesn't exist on the runner, so + # override it with the real Marcus-Law cert that lives in + # LocalMachine\My (migrated there by 2-install-windows-runner.ps1). + run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m # Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool # picks it by thumbprint, the service runs as LocalSystem so the runtime