CM-70024: sync the new signing cert by keypair alias

certsync without an alias only synced the first keypair the account
returns (the old cert), so signtool still had no match for the new
thumbprint. Restore --keypair-alias, sourced from SM_KEYPAIR_ALIAS_NEW.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: omer-roth

.github/workflows/build_executable.yml

@@ -238,17 +238,18 @@ jobs:
           SM_HOST: ${{ secrets.SM_HOST }}
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
           SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          # TODO(CM-70024): revert to SM_CODE_SIGNING_CERT_SHA1_HASH once the new cert is confirmed working
+          # TODO(CM-70024): revert to the non-_NEW secrets once the new cert is confirmed working
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS_NEW }}
           SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH_NEW }}
         run: |
           :: setup SSM KSP
           curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o smtools-windows-x64.msi
           msiexec /i smtools-windows-x64.msi /quiet /qn
           C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
 
-          :: sync every cert in the account into the Windows store; signtool /sha1 below
-          :: selects the right one, so there is no keypair alias to keep in sync on renewal
-          smctl windows certsync
+          :: certsync without an alias only syncs the first keypair the account returns,
+          :: so the alias is required to get the current signing cert into the store
+          smctl windows certsync --keypair-alias=%SM_KEYPAIR_ALIAS%
 
           :: sign executable (in onedir mode the exe lives inside the collected directory)
           set "EXE_PATH=.\dist\cycode-cli.exe"