Set TAURI_WINDOWS_SIGNTOOL_PATH for Windows signing

.github/workflows/multiOSReleases.yml

@@ -30,6 +30,15 @@ on:
         options:
           - "true"
           - "false"
+      prerelease:
+        description: "GitHub release prerelease flag (keep = leave the release as-is)"
+        required: false
+        default: "keep"
+        type: choice
+        options:
+          - "keep"
+          - "true"
+          - "false"
   release:
     types: [created]
 
@@ -299,13 +308,13 @@ jobs:
         run: |
           Write-Host "Setting up DigiCert KeyLocker environment..."
 
-          # Decode client certificate
+          # Decode client certificate (RUNNER_TEMP: arm64 runners have no D: drive)
           $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
+          $certPath = Join-Path $env:RUNNER_TEMP "Certificate_pkcs12.p12"
           [IO.File]::WriteAllBytes($certPath, $certBytes)
 
           # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_FILE=$certPath" >> $env:GITHUB_ENV
           echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
           echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
           echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
@@ -425,6 +434,25 @@ jobs:
       # Windows cert store first. --keypair-alias goes direct through PKCS11 and works
       # without certsync. All real-world working Tauri+smctl examples use this flag.
       #
+      # Tauri's bundler needs signtool.exe to VERIFY bundled dlls/exes even when a
+      # custom signCommand does the signing; its auto-lookup fails on arm64 hosts.
+      - name: Locate signtool for Tauri
+        if: ${{ startsWith(matrix.platform, 'windows') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        shell: pwsh
+        run: |
+          $signtool = (Get-Command signtool.exe -ErrorAction SilentlyContinue).Source
+          if (-not $signtool) {
+            $signtool = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin" -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
+              Where-Object { $_.FullName -match '\\(arm64|x64)\\' } |
+              Sort-Object FullName | Select-Object -Last 1 -ExpandProperty FullName
+          }
+          if ($signtool) {
+            Write-Host "Using signtool: $signtool"
+            echo "TAURI_WINDOWS_SIGNTOOL_PATH=$signtool" >> $env:GITHUB_ENV
+          } else {
+            Write-Error "signtool.exe not found on runner"
+          }
+
       # smctl reads SM_HOST, SM_API_KEY, SM_CLIENT_CERT_FILE, SM_CLIENT_CERT_PASSWORD
       # from env (set by prior DigiCert setup step). No --config-file needed.
       - name: Configure Windows code signing
@@ -916,4 +944,6 @@ jobs:
             ./artifacts/**/*.AppImage
             ./artifacts/latest.json
           draft: false
-          prerelease: false
+          # Empty = keep the release's existing prerelease flag (action treats
+          # empty as undefined); dispatch input can force true/false.
+          prerelease: ${{ github.event.inputs.prerelease != 'keep' && github.event.inputs.prerelease || '' }}