From fc17c57b6bef355f9860f359c1c3851bb7deff6d Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Thu, 2 Jul 2026 11:42:44 -0700
Subject: [PATCH] Fix Windows SignPath PSGallery preflight (#7135)

* Verify Windows app executable signing

* Isolate Windows signing verifier tests

* Handle direct Windows installer extraction

* Fix SignPath PowerShell gallery preflight

---------

Co-authored-by: Neil <neil@stably.ai>
---
 .github/workflows/release-cut.yml                         | 5 +++++
 config/scripts/package-electron-runtime-contract.test.mjs | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 957ae1704fa..2822b71e9dc 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -889,6 +889,11 @@ jobs:
         if: matrix.platform == 'win'
         shell: pwsh
         run: |
+          # Why: Some hosted Windows images start without PSGallery registered.
+          if ($null -eq (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) {
+            Register-PSRepository -Default -InstallationPolicy Trusted
+          }
+
           Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
 
           $trimChars = [char[]]@([System.IO.Path]::DirectorySeparatorChar, [System.IO.Path]::AltDirectorySeparatorChar)
diff --git a/config/scripts/package-electron-runtime-contract.test.mjs b/config/scripts/package-electron-runtime-contract.test.mjs
index d3b3e1226a6..e18765e99d1 100644
--- a/config/scripts/package-electron-runtime-contract.test.mjs
+++ b/config/scripts/package-electron-runtime-contract.test.mjs
@@ -194,6 +194,10 @@ describe('Electron runtime package contract', () => {
 
     expect(installStep.if).toBe("matrix.platform == 'win'")
     expect(installStep.shell).toBe('pwsh')
+    expect(installRun).toContain(
+      'if ($null -eq (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue))'
+    )
+    expect(installRun).toContain('Register-PSRepository -Default -InstallationPolicy Trusted')
     expect(installRun).toContain('Set-PSRepository -Name PSGallery -InstallationPolicy Trusted')
     expect(installRun).toMatch(/\$env:PSModulePath -split \[System\.IO\.Path\]::PathSeparator/)
     expect(installRun).toContain(