From 57840f83a96dd017b13b74b0aa10803b22626328 Mon Sep 17 00:00:00 2001
From: Badcuban <108198679+badcuban@users.noreply.github.com>
Date: Thu, 23 Jul 2026 01:13:29 -0400
Subject: [PATCH] Stabilize Windows trusted signing setup

---
 .github/workflows/release.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e5248cc4..3f673e69 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -420,6 +420,26 @@ jobs:
             throw "Windows Azure Trusted Signing is missing required environment values: $($missing -join ', ')"
           }
 
+      - name: Prepare Azure Trusted Signing module
+        shell: pwsh
+        run: |
+          $moduleVersion = "0.5.8"
+          $moduleRoot = Join-Path $env:RUNNER_TEMP "trusted-signing-modules"
+          New-Item -ItemType Directory -Path $moduleRoot -Force | Out-Null
+          Save-Module `
+            -Name TrustedSigning `
+            -RequiredVersion $moduleVersion `
+            -Repository PSGallery `
+            -Path $moduleRoot `
+            -Force
+
+          $env:PSModulePath = "$moduleRoot$([IO.Path]::PathSeparator)$env:PSModulePath"
+          "PSModulePath=$env:PSModulePath" |
+            Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+          Import-Module TrustedSigning -RequiredVersion $moduleVersion -Force
+          Get-Command Invoke-TrustedSigning -ErrorAction Stop | Out-Null
+
       - name: Build Windows installer
         env:
           THREADLINES_DESKTOP_SIGNED: ${{ vars.THREADLINES_DESKTOP_SIGNED == 'true' && 'true' || 'false' }}