更新

wechat_rpa/build_windows_exe.ps1

@@ -83,6 +83,11 @@ foreach ($requiredFile in $requiredRuntimeFiles) {
 }
 Write-Output "Embedded browser and VC runtime files verified"
 
+# 有证书时给主程序签名（无证书自动跳过）。签名要在自检前完成，
+# 保证自检跑的就是最终分发的那个文件。
+& (Join-Path $projectRoot "sign_artifact.ps1") -Path $exe
+if ($LASTEXITCODE -ne 0) { throw "Code signing step failed" }
+
 $selfCheck = Start-Process -FilePath $exe -ArgumentList "--packaging-self-check" -PassThru -WindowStyle Hidden
 try {
     if (-not $selfCheck.WaitForExit(90000)) {