From ac4e97859a056011befa7b4ed9de25de6f3a80b7 Mon Sep 17 00:00:00 2001
From: Chirag Aggarwal <chirag@appwrite.io>
Date: Mon, 11 May 2026 11:29:57 +0530
Subject: [PATCH] fix(publish): surface osslsigncode output when verify fails

Drop set -e from the verify step so the assignment of
osslsigncode's captured stderr/stdout no longer aborts the script
before echoing it. Track exit codes per file and aggregate so both
binaries are reported even if the first fails. Also fail with
::error:: annotations for visibility in the Actions UI.
---
 .github/workflows/publish.yml | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d393ab7..d8e9f7f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -94,23 +94,26 @@ jobs:
 
       - name: Verify Windows signatures
         run: |
-          set -euo pipefail
+          set -uo pipefail
 
           verify_signature() {
             local file="$1"
-            local output
-
+            local output rc
             output="$(osslsigncode verify -in "$file" 2>&1)"
+            rc=$?
+            echo "--- $file (osslsigncode exit $rc) ---"
             echo "$output"
 
-            if ! grep -Fq "Succeeded" <<< "$output"; then
-              echo "$file signature verification failed"
-              exit 1
+            if [ "$rc" -ne 0 ] || ! grep -Fq "Succeeded" <<< "$output"; then
+              echo "::error::$file signature verification failed"
+              return 1
             fi
           }
 
-          verify_signature build/appwrite-cli-win-x64.exe
-          verify_signature build/appwrite-cli-win-arm64.exe
+          final=0
+          verify_signature build/appwrite-cli-win-x64.exe || final=1
+          verify_signature build/appwrite-cli-win-arm64.exe || final=1
+          exit "$final"
 
       - name: Setup Node.js
         uses: actions/setup-node@v6