From e8ee1b8d3d94e80a80279a8ee1ff57b9f893d37b Mon Sep 17 00:00:00 2001
From: Chaim <chaim@marcus-law.co.il>
Date: Mon, 11 May 2026 16:43:13 +0000
Subject: [PATCH] fix(ci): resolve mage/signtool inside same step (GITHUB_ENV
 not propagated by act_runner)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitea/workflows/build.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index a53e4dd..9c8a4cf 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -224,6 +224,20 @@ jobs:
           try {
               $thumb = $env:THUMB
 
+              Write-Host "=== STEP 0: resolve mage.exe + signtool.exe ==="
+              $mage = Get-ChildItem 'C:\Program Files (x86)\Microsoft SDKs\Windows' -Recurse -Filter mage.exe -ErrorAction SilentlyContinue |
+                  Sort-Object FullName -Descending | Select-Object -First 1
+              if (-not $mage) { throw "mage.exe not found" }
+              $env:MAGE = $mage.FullName
+              Write-Host "  MAGE: $($env:MAGE)"
+              $signtool = Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin' -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
+                  Where-Object { $_.FullName -like '*\x64\*' } |
+                  Sort-Object { [version](Split-Path -Leaf (Split-Path -Parent (Split-Path -Parent $_.FullName))) } -Descending |
+                  Select-Object -First 1
+              if (-not $signtool) { throw "signtool.exe not found" }
+              $env:SIGNTOOL = $signtool.FullName
+              Write-Host "  SIGNTOOL: $($env:SIGNTOOL)"
+
               Write-Host "=== STEP A: cert into stores ==="
               $inUser = Get-ChildItem Cert:\CurrentUser\My -EA SilentlyContinue | ? { $_.Thumbprint -eq $thumb }
               if (-not $inUser) {