Step-level if: conditions cannot read the secrets context, which made
GitHub reject the workflow file outright (startup failure, zero jobs).
The signing waterfall now keys off job-level env booleans mirrored from
the credential secrets - a pattern actionlint accepts.
Forks do not inherit repository secrets, and the previous hardwired
Azure Trusted Signing steps failed the Windows job outright on a fork.
Each signing step is now gated on its credentials being present and the
pipeline falls through: Azure Trusted Signing (upstream setup, unchanged
when the secrets exist) -> PFX certificate from WINDOWS_PFX_BASE64 /
WINDOWS_PFX_PASSWORD via signtool with RFC-3161 timestamping -> unsigned
with a note in the job summary. The build and installer assembly always
complete.
- IMAGEEMBED: pack raster images into OLE2FRAME entities so a .dwg is
self-contained; 'Embed Image' entry in the XREF attach menu; control/MCP
op embed_image for external tools; dxf_name for OLE2FRAME queries.
- Scene: populate_images_from_document now rebuilds OLE2FRAME and PDF
underlay models too (they used to vanish after any XREF op).
- Printing: add PRINTER_ENUM_NETWORK pass when listing printers; GDI
spooler fallback (hayro raster at 300 DPI + StretchDIBits) for hosts
whose PDF handler registers no print verb; DEVMODE orientation with a
90-degree raster rotation fallback for v4 drivers; fix the fit-scale
precedence bug that printed blank pages.
- PDF export dialogs on Windows use the async file dialog so the native
overwrite confirmation no longer deadlocks the UI thread.
- Plot dialog: persist the chosen printer (saved on selection) and the
picked plot window across sessions; page setups with no device no
longer reset the output device.
- Community fonts: detect unresolvable .shx references on open and offer
a download from the repository's fonts/ folder (contribution guide in
fonts/README.md); custom font source URL setting for intranet font
servers; downloaded fonts resolve from the per-user fonts directory.
huanld