fix(ci): import cert to CurrentUser\My + patch csproj thumbprint

VSTO's ResolveKeySource target reads ManifestCertificateThumbprint
directly from csproj XML (not from /p: overrides) and looks for it
under Cert:\CurrentUser\My (not LocalMachine\My). Import the cert
to CurrentUser\My before build and patch the csproj XML to use the
real Marcus-Law thumbprint instead of VS's temporary-key thumbprint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -40,17 +40,47 @@ jobs:
           Write-Host "Using MSBuild from $msbuildDir"
           Add-Content -Path $env:GITHUB_PATH -Value $msbuildDir
 
+      - name: Import code-signing cert into CurrentUser\My
+        # The VSTO ResolveKeySource target reads ManifestCertificateThumbprint
+        # straight from the csproj XML and looks for it under Cert:\CurrentUser\My
+        # (not LocalMachine\My). Import the real Marcus-Law cert there.
+        shell: powershell
+        env:
+          PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
+          PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
+          THUMB:   ${{ secrets.CODESIGN_THUMBPRINT }}
+        run: |
+          $existing = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
+              Where-Object { $_.Thumbprint -eq $env:THUMB }
+          if ($existing) { Write-Host "Cert already in CurrentUser\My."; return }
+          $pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
+          $tmp = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx"
+          [IO.File]::WriteAllBytes($tmp, $pfxBytes)
+          $pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
+          Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null
+          Remove-Item -Force $tmp
+          Write-Host "Cert imported into CurrentUser\My."
+
+      - name: Patch csproj to use real cert thumbprint
+        # VS's compile-time manifest signing reads the thumbprint from the
+        # csproj XML (not from /p: overrides), so we rewrite it in place to
+        # point at our Marcus-Law cert.
+        shell: powershell
+        env:
+          THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
+        run: |
+          $csproj = 'src/OutlookAddin/OutlookAddin.csproj'
+          $orig   = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
+          $content = Get-Content $csproj -Raw
+          $patched = $content -replace [regex]::Escape($orig), $env:THUMB
+          if ($patched -eq $content) { Write-Warning "Thumbprint $orig not present in csproj." }
+          else { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched: $orig -> $env:THUMB" }
+
       - name: Build (restore + compile)
         # `msbuild /restore` runs restore and build in the same MSBuild process,
-        # which keeps the NuGet package cache + project.assets.json + assembly
-        # resolution consistent (avoids NETSDK1064 from a mismatch between a
-        # standalone `nuget restore` and the later build).
-        # VSTO mandates SignManifests=true (the build aborts otherwise). The
-        # project's hardcoded ManifestCertificateThumbprint points to VS's
-        # auto-generated temporary key which doesn't exist on the runner, so
-        # override it with the real Marcus-Law cert that lives in
-        # LocalMachine\My (migrated there by 2-install-windows-runner.ps1).
-        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m
+        # so the package cache + project.assets.json + assembly resolution stay
+        # consistent (avoids NETSDK1064).
+        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
 
       - name: Test
         run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx"
@@ -113,7 +143,7 @@ jobs:
           "versionUscore=$($version -replace '\.','_')" | Out-File -Append $env:GITHUB_OUTPUT
           Write-Host "Version: $version"
 
-      - name: Ensure code-signing cert in LocalMachine\My
+      - name: Ensure code-signing cert in CurrentUser\My AND LocalMachine\My
         shell: powershell
         env:
           THUMB:    ${{ secrets.CODESIGN_THUMBPRINT }}
@@ -121,6 +151,19 @@ jobs:
           PFX_PWD:  ${{ secrets.CODESIGN_CERT_PASSWORD }}
         run: |
           $thumb = $env:THUMB
+          # Import to CurrentUser\My (where VSTO ResolveKeySource looks).
+          $inUser = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
+              Where-Object { $_.Thumbprint -eq $thumb }
+          if (-not $inUser) {
+              $pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
+              $tmp = Join-Path $env:TEMP "cs-$([Guid]::NewGuid()).pfx"
+              [IO.File]::WriteAllBytes($tmp, $pfxBytes)
+              $pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
+              Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null
+              Remove-Item -Force $tmp
+              Write-Host "Imported into CurrentUser\My."
+          } else { Write-Host "Already in CurrentUser\My." }
+
           $found = Get-ChildItem Cert:\LocalMachine\My -ErrorAction SilentlyContinue |
               Where-Object { $_.Thumbprint -eq $thumb }
           if ($found) {
@@ -138,13 +181,20 @@ jobs:
           Remove-Item -Force $tmpPfx
           Write-Host "Cert imported."
 
+      - name: Patch csproj to use real cert thumbprint
+        shell: powershell
+        env:
+          THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
+        run: |
+          $csproj = 'src/OutlookAddin/OutlookAddin.csproj'
+          $orig   = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
+          $content = Get-Content $csproj -Raw
+          $patched = $content -replace [regex]::Escape($orig), $env:THUMB
+          if ($patched -ne $content) { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched csproj." }
+          else { Write-Warning "Original thumbprint not present in csproj." }
+
       - name: Build Release (restore + compile)
-        # VSTO mandates SignManifests=true (the build aborts otherwise). The
-        # project's hardcoded ManifestCertificateThumbprint points to VS's
-        # auto-generated temporary key which doesn't exist on the runner, so
-        # override it with the real Marcus-Law cert that lives in
-        # LocalMachine\My (migrated there by 2-install-windows-runner.ps1).
-        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m
+        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
 
       # Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool
       # picks it by thumbprint, the service runs as LocalSystem so the runtime