From aa6b0f6277f0699224ba2350747193a2d20766dd Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Mon, 12 Oct 2026 19:49:40 -0500
Subject: [PATCH] fix(releases): scope bootstrap parameters under Actions pwsh

GitHub prepends ErrorActionPreference to inline pwsh scripts, so a top-level param block is no longer first. Invoke the parameterized bootstrap inside a script block and test the actual default shell preamble. The previous standalone test missed this execution context.

Co-Authored-By: Codex GPT-6 <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
---
 .github/workflows/release-velopack.yml | 44 ++++++++++++++------------
 tools/VelopackSigning.Tests.ps1        |  3 +-
 2 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/release-velopack.yml b/.github/workflows/release-velopack.yml
index 9808409..7fbc39a 100644
--- a/.github/workflows/release-velopack.yml
+++ b/.github/workflows/release-velopack.yml
@@ -373,27 +373,29 @@ jobs:
         if: inputs.sign
         shell: pwsh
         run: |
-          param(
-             [string]$PackageDirectory = $env:RUNNER_TEMP,
-             [string]$InstallRoot = $env:LOCALAPPDATA
-          )
-          $ErrorActionPreference = 'Stop'
-          $version = '0.9.1-beta.26227.3'
-          $package = Join-Path $PackageDirectory "sign.$version.nupkg"
-          $destination = Join-Path $InstallRoot "ArtifactSigning/sign/sign.$version"
-          if (Test-Path -LiteralPath $destination) { throw 'Artifact Signing CLI directory already exists; use a fresh release runner.' }
-          Invoke-WebRequest -Uri "https://api.nuget.org/v3-flatcontainer/sign/$version/sign.$version.nupkg" -OutFile $package
-          if ((Get-FileHash -LiteralPath $package -Algorithm SHA256).Hash -ne '34FD0D4AEABDBC363A48883881865B4DD65E6C11BA916028082FA23F3E1B1BA1')
-          {
-             throw 'Artifact Signing CLI package checksum mismatch.'
-          }
-          dotnet nuget verify $package --all
-          if ($LASTEXITCODE -ne 0) { throw 'Artifact Signing CLI NuGet signature verification failed.' }
-          [IO.Compression.ZipFile]::ExtractToDirectory($package, $destination)
-          if (-not (Test-Path -LiteralPath (Join-Path $destination 'tools/net8.0/any/sign.dll') -PathType Leaf))
-          {
-             throw 'Artifact Signing CLI package is missing its executable.'
-          }
+          & {
+             param(
+                [string]$PackageDirectory = $env:RUNNER_TEMP,
+                [string]$InstallRoot = $env:LOCALAPPDATA
+             )
+             $ErrorActionPreference = 'Stop'
+             $version = '0.9.1-beta.26227.3'
+             $package = Join-Path $PackageDirectory "sign.$version.nupkg"
+             $destination = Join-Path $InstallRoot "ArtifactSigning/sign/sign.$version"
+             if (Test-Path -LiteralPath $destination) { throw 'Artifact Signing CLI directory already exists; use a fresh release runner.' }
+             Invoke-WebRequest -Uri "https://api.nuget.org/v3-flatcontainer/sign/$version/sign.$version.nupkg" -OutFile $package
+             if ((Get-FileHash -LiteralPath $package -Algorithm SHA256).Hash -ne '34FD0D4AEABDBC363A48883881865B4DD65E6C11BA916028082FA23F3E1B1BA1')
+             {
+                throw 'Artifact Signing CLI package checksum mismatch.'
+             }
+             dotnet nuget verify $package --all
+             if ($LASTEXITCODE -ne 0) { throw 'Artifact Signing CLI NuGet signature verification failed.' }
+             [IO.Compression.ZipFile]::ExtractToDirectory($package, $destination)
+             if (-not (Test-Path -LiteralPath (Join-Path $destination 'tools/net8.0/any/sign.dll') -PathType Leaf))
+             {
+                throw 'Artifact Signing CLI package is missing its executable.'
+             }
+          } @args
 
       # Signs the app's own executables and DLLs (and the CLI) before packing, so the
       # binaries inside the installer, the portable zip, and the update packages are
diff --git a/tools/VelopackSigning.Tests.ps1 b/tools/VelopackSigning.Tests.ps1
index fe48a1d..948c198 100644
--- a/tools/VelopackSigning.Tests.ps1
+++ b/tools/VelopackSigning.Tests.ps1
@@ -20,7 +20,8 @@ BeforeAll `
    $dependencyEnd = $dependencyStart
    while($dependencyEnd -lt $lines.Count -and $lines[$dependencyEnd].StartsWith('          ')) { $dependencyEnd++ }
    $script:Bootstrap = Join-Path $TestDrive 'sign-dependency.ps1'
-   [IO.File]::WriteAllLines($script:Bootstrap, @($lines[$dependencyStart..($dependencyEnd - 1)] | ForEach-Object { $_.Substring(10) }))
+   # GitHub's default pwsh shell prepends this statement to every inline run body.
+   [IO.File]::WriteAllLines($script:Bootstrap, @('$ErrorActionPreference = "stop"') + @($lines[$dependencyStart..($dependencyEnd - 1)] | ForEach-Object { $_.Substring(10) }))
    $script:OldTool = $env:K22_VPK_SIGN_TOOL
    $env:K22_VPK_SIGN_TOOL = 'Invoke-WrapperTool'
 
-- 
2.54.0