From 13fd1221a6d801f94a847e905c2d8e1344206fd9 Mon Sep 17 00:00:00 2001
From: Dylan Murray <dylan@britevue.com>
Date: Mon, 30 Mar 2026 21:38:31 -0400
Subject: [PATCH] Add debugging to windows release action

---
 .github/workflows/release.yml | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ff86088..a30ac96 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -191,12 +191,29 @@ jobs:
           npm run build
           npx electron-builder --win --publish never
 
+      - name: Add signtool to PATH
+        if: matrix.platform == 'windows-2022'
+        shell: pwsh
+        run: |
+          $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" -ErrorAction SilentlyContinue | Sort-Object -Descending | Select-Object -First 1 -ExpandProperty FullName
+          if (-not $signtool) { throw "signtool.exe not found" }
+          $dir = Split-Path $signtool
+          Write-Host "Adding signtool dir to PATH: $dir"
+          echo $dir | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+      - name: Verify DigiCert certificate access
+        if: matrix.platform == 'windows-2022'
+        shell: cmd
+        run: |
+          smctl keypair ls
+
       - name: Sign Windows executables with DigiCert (KSP)
         if: matrix.platform == 'windows-2022'
         shell: cmd
         run: |
           for %%f in ("release\*.exe") do (
-            smctl sign --fingerprint %SM_FINGERPRINT% --input "%%f"
+            echo Signing %%f ...
+            smctl sign --fingerprint %SM_FINGERPRINT% --input "%%f" --verbose
           )
 
       - name: Verify Windows Signatures
@@ -207,7 +224,7 @@ jobs:
           if (-not $signtool) { throw "signtool.exe not found. Ensure Windows 10 SDK is installed on the runner." }
           $files = Get-ChildItem -Path release\ -Filter *.exe | Select-Object -ExpandProperty FullName
           foreach ($file in $files) {
-            & $signtool verify /pa "$file"
+            signtool verify /pa "$file"
           }
 
       - name: Upload Windows Artifacts