From b66dbfdd4376015df6dcd507e1f58e76680e604c Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Thu, 6 Aug 2026 11:14:50 +0800
Subject: [PATCH] =?UTF-8?q?emrg:=20=E4=BF=AE=E5=A4=8D=20windows=20?=
 =?UTF-8?q?=E6=9E=84=E5=BB=BA=E5=A4=B1=E8=B4=A5=20=E2=80=94=20=E7=A9=BA=20?=
 =?UTF-8?q?CSC=5FLINK=20=E8=A7=A6=E5=8F=91=20electron-builder=20=E7=AD=BE?=
 =?UTF-8?q?=E5=90=8D=E5=88=86=E6=94=AF=EF=BC=88v0.2.7=20=E6=A0=B9=E5=9B=A0?=
 =?UTF-8?q?=202/2=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-release.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index e9964a6b..77ff1b5e 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -109,13 +109,17 @@ jobs:
       - name: Build GUI (electron-builder)
         working-directory: emrg/gui
         shell: bash
-        env:
-          # macOS 签名：CSC_LINK+CSC_KEY_PASSWORD 激活 electron-builder 自动 codesign
-          # （含 hardened runtime；Secret 未配时为空 → 不签名，保持现状降级）
-          CSC_LINK: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }}
-          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_PASSWORD || '' }}
         run: |
           npm ci
+          # macOS 签名：仅在 macOS + 有证书时导出 CSC_LINK/CSC_KEY_PASSWORD，
+          # 激活 electron-builder 自动 codesign（含 hardened runtime）。
+          # ⚠️ 不可在 step env 里设空字符串：electron-builder 对空 CSC_LINK 仍走签名分支
+          # （path.resolve("") = 工作目录 → "WIN_CSC_LINK is not correct ... not a file"，
+          # v0.2.7 windows job 失败根因）。未设置 = 不签名，保持降级。
+          if [ "$RUNNER_OS" = "macOS" ] && [ -n "${MACOS_SIGNING_P12_BASE64:-}" ]; then
+            export CSC_LINK="file:///tmp/signing.p12"
+            export CSC_KEY_PASSWORD="$MACOS_SIGNING_P12_PASSWORD"
+          fi
           npm run dist
 
       # ── 捆绑 git/gh（§6 R59：macOS/Linux 源码编译，Windows portable）──