Require code signing for releases; bump setup-msbuild to v3

.github/workflows/release.yml

@@ -70,7 +70,7 @@ jobs:
       # The build step never fails the job (it only sets an output on success),
       # so a VSIX build failure can never block the cross-platform app release.
       - name: Add MSBuild to PATH
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
         continue-on-error: true
 
       - name: Build SSMS extension
@@ -127,28 +127,28 @@ jobs:
           curl -sS -f "https://ssmsgallery.azurewebsites.net/api/upload" \
             -F "file=@releases/PlanViewer.Ssms.vsix"
 
-      # ── SignPath code signing (Windows only, skipped if secret not configured) ──
-      - name: Check if signing is configured
-        id: signing
+      # ── SignPath code signing (Windows). Signing is REQUIRED for a release:
+      #    if the SignPath token is missing the job fails loudly rather than
+      #    silently shipping unsigned binaries. ──
+      - name: Verify signing is configured
         shell: bash
+        env:
+          SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
         run: |
-          if [ -n "${{ secrets.SIGNPATH_API_TOKEN }}" ]; then
-            echo "ENABLED=true" >> $GITHUB_OUTPUT
-          else
-            echo "ENABLED=false" >> $GITHUB_OUTPUT
-            echo "::warning::SIGNPATH_API_TOKEN not configured — releasing unsigned binaries"
+          if [ -z "$SIGNPATH_API_TOKEN" ]; then
+            echo "::error::SIGNPATH_API_TOKEN missing — signing is required for a release; aborting."
+            exit 1
           fi
+          echo "SignPath token present — Windows binaries will be signed."
 
       - name: Upload Windows build for signing
-        if: steps.signing.outputs.ENABLED == 'true'
         id: upload-unsigned
         uses: actions/upload-artifact@v6
         with:
           name: App-unsigned
           path: publish/win-x64/
 
       - name: Sign Windows build
-        if: steps.signing.outputs.ENABLED == 'true'
         uses: signpath/github-action-submit-signing-request@v2
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
@@ -161,7 +161,6 @@ jobs:
           output-artifact-directory: 'signed/win-x64'
 
       - name: Replace unsigned Windows build with signed
-        if: steps.signing.outputs.ENABLED == 'true'
         shell: pwsh
         run: |
           Remove-Item -Recurse -Force publish/win-x64