From afcc2810b7c03d9e1544c603a8862e45775573af Mon Sep 17 00:00:00 2001
From: George Stagg <george.stagg@posit.co>
Date: Fri, 11 Sep 2026 16:08:41 +0100
Subject: [PATCH] Drop the smctl flag the pinned build does not support

The pinned smtools MSI ships an smctl without --exit-non-zero-on-fail,
so every `smctl sign` invocation failed immediately with
`unknown flag: --exit-non-zero-on-fail`.

That build also exits 0 when signing fails, so the signtool verify and
Get-AuthenticodeSignature checks are what gate the step.
---
 .github/workflows/actions/sign-files/action.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/actions/sign-files/action.yml b/.github/workflows/actions/sign-files/action.yml
index bbcc126e..17d91093 100644
--- a/.github/workflows/actions/sign-files/action.yml
+++ b/.github/workflows/actions/sign-files/action.yml
@@ -121,7 +121,9 @@ runs:
         }
         foreach ($path in $paths) {
           Write-Output "::group::Signing ${path}"
-          smctl sign --keypair-alias $env:SM_KEYPAIR_ALIAS --input $path --digalg SHA256 --sigalg SHA256 --timestamp=true --verbose --exit-non-zero-on-fail
+          # The pinned smctl build exits 0 even when signing fails and lacks
+          # --exit-non-zero-on-fail; the verify steps below are the failure gate.
+          smctl sign --keypair-alias $env:SM_KEYPAIR_ALIAS --input $path --digalg SHA256 --sigalg SHA256 --timestamp=true --verbose
           if ($LASTEXITCODE -ne 0) {
             Write-Output "::error title=Signing error::Error while signing ${path}"
             exit 1