We build a catalogue of Windows and Android software, and part of the pipeline checks the Authenticode signature on every binary we ingest. It works by shelling out to Get-AuthenticodeSignature and mapping the result onto our own verdict enum.
On windows-latest, every single binary came back INVALID. Signed ones, deliberately tampered ones, and files that were not executables at all. The whole job finished in 4.3 seconds.
Four of the five self-test cases failed loudly. The fifth passed. That fifth one is the interesting part, and it is the reason this took three CI round trips instead of one.
The cause: two PowerShells, one module path
GitHub's Windows runners execute every step under PowerShell 7:
