fix(ci): import cert to CurrentUser\My + patch csproj thumbprint
VSTO's ResolveKeySource target reads ManifestCertificateThumbprint directly from csproj XML (not from /p: overrides) and looks for it under Cert:\CurrentUser\My (not LocalMachine\My). Import the cert to CurrentUser\My before build and patch the csproj XML to use the real Marcus-Law thumbprint instead of VS's temporary-key thumbprint. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
+66
-16
@@ -40,17 +40,47 @@ jobs:
|
||||
Write-Host "Using MSBuild from $msbuildDir"
|
||||
Add-Content -Path $env:GITHUB_PATH -Value $msbuildDir
|
||||
|
||||
- name: Import code-signing cert into CurrentUser\My
|
||||
# The VSTO ResolveKeySource target reads ManifestCertificateThumbprint
|
||||
# straight from the csproj XML and looks for it under Cert:\CurrentUser\My
|
||||
# (not LocalMachine\My). Import the real Marcus-Law cert there.
|
||||
shell: powershell
|
||||
env:
|
||||
PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
|
||||
PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
|
||||
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
||||
run: |
|
||||
$existing = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.Thumbprint -eq $env:THUMB }
|
||||
if ($existing) { Write-Host "Cert already in CurrentUser\My."; return }
|
||||
$pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
|
||||
$tmp = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx"
|
||||
[IO.File]::WriteAllBytes($tmp, $pfxBytes)
|
||||
$pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
|
||||
Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null
|
||||
Remove-Item -Force $tmp
|
||||
Write-Host "Cert imported into CurrentUser\My."
|
||||
|
||||
- name: Patch csproj to use real cert thumbprint
|
||||
# VS's compile-time manifest signing reads the thumbprint from the
|
||||
# csproj XML (not from /p: overrides), so we rewrite it in place to
|
||||
# point at our Marcus-Law cert.
|
||||
shell: powershell
|
||||
env:
|
||||
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
||||
run: |
|
||||
$csproj = 'src/OutlookAddin/OutlookAddin.csproj'
|
||||
$orig = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
|
||||
$content = Get-Content $csproj -Raw
|
||||
$patched = $content -replace [regex]::Escape($orig), $env:THUMB
|
||||
if ($patched -eq $content) { Write-Warning "Thumbprint $orig not present in csproj." }
|
||||
else { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched: $orig -> $env:THUMB" }
|
||||
|
||||
- name: Build (restore + compile)
|
||||
# `msbuild /restore` runs restore and build in the same MSBuild process,
|
||||
# which keeps the NuGet package cache + project.assets.json + assembly
|
||||
# resolution consistent (avoids NETSDK1064 from a mismatch between a
|
||||
# standalone `nuget restore` and the later build).
|
||||
# VSTO mandates SignManifests=true (the build aborts otherwise). The
|
||||
# project's hardcoded ManifestCertificateThumbprint points to VS's
|
||||
# auto-generated temporary key which doesn't exist on the runner, so
|
||||
# override it with the real Marcus-Law cert that lives in
|
||||
# LocalMachine\My (migrated there by 2-install-windows-runner.ps1).
|
||||
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m
|
||||
# so the package cache + project.assets.json + assembly resolution stay
|
||||
# consistent (avoids NETSDK1064).
|
||||
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
|
||||
|
||||
- name: Test
|
||||
run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx"
|
||||
@@ -113,7 +143,7 @@ jobs:
|
||||
"versionUscore=$($version -replace '\.','_')" | Out-File -Append $env:GITHUB_OUTPUT
|
||||
Write-Host "Version: $version"
|
||||
|
||||
- name: Ensure code-signing cert in LocalMachine\My
|
||||
- name: Ensure code-signing cert in CurrentUser\My AND LocalMachine\My
|
||||
shell: powershell
|
||||
env:
|
||||
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
||||
@@ -121,6 +151,19 @@ jobs:
|
||||
PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
|
||||
run: |
|
||||
$thumb = $env:THUMB
|
||||
# Import to CurrentUser\My (where VSTO ResolveKeySource looks).
|
||||
$inUser = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.Thumbprint -eq $thumb }
|
||||
if (-not $inUser) {
|
||||
$pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
|
||||
$tmp = Join-Path $env:TEMP "cs-$([Guid]::NewGuid()).pfx"
|
||||
[IO.File]::WriteAllBytes($tmp, $pfxBytes)
|
||||
$pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
|
||||
Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null
|
||||
Remove-Item -Force $tmp
|
||||
Write-Host "Imported into CurrentUser\My."
|
||||
} else { Write-Host "Already in CurrentUser\My." }
|
||||
|
||||
$found = Get-ChildItem Cert:\LocalMachine\My -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.Thumbprint -eq $thumb }
|
||||
if ($found) {
|
||||
@@ -138,13 +181,20 @@ jobs:
|
||||
Remove-Item -Force $tmpPfx
|
||||
Write-Host "Cert imported."
|
||||
|
||||
- name: Patch csproj to use real cert thumbprint
|
||||
shell: powershell
|
||||
env:
|
||||
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
||||
run: |
|
||||
$csproj = 'src/OutlookAddin/OutlookAddin.csproj'
|
||||
$orig = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
|
||||
$content = Get-Content $csproj -Raw
|
||||
$patched = $content -replace [regex]::Escape($orig), $env:THUMB
|
||||
if ($patched -ne $content) { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched csproj." }
|
||||
else { Write-Warning "Original thumbprint not present in csproj." }
|
||||
|
||||
- name: Build Release (restore + compile)
|
||||
# VSTO mandates SignManifests=true (the build aborts otherwise). The
|
||||
# project's hardcoded ManifestCertificateThumbprint points to VS's
|
||||
# auto-generated temporary key which doesn't exist on the runner, so
|
||||
# override it with the real Marcus-Law cert that lives in
|
||||
# LocalMachine\My (migrated there by 2-install-windows-runner.ps1).
|
||||
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m
|
||||
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
|
||||
|
||||
# Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool
|
||||
# picks it by thumbprint, the service runs as LocalSystem so the runtime
|
||||
|
||||
Reference in New Issue
Block a user