feat(release): submit to WinGet automatically - #71
Merged
Merged
Conversation
WinGet was the one package manager left to a person: the workflow printed "submit with wingetcreate" and stopped. WinGet takes packages by pull request to microsoft/winget-pkgs, so publishing means a PR bot. tools/release/submit-winget.mjs is PairUX's proven flow (pairux.com's scripts/lib/package-managers/winget.ts, whose Profullstack.PairUX PRs Microsoft has merged), ported to this repo's release tools: fork winget-pkgs under the token's account, sync the fork, put the three generated manifests on a branch, close any open PR of ours for the package, open a cross-fork PR titled "New package" or "New version" as the upstream tree says. --dry-run prints the plan and touches nothing. The Submit job runs it when PKG_SUBMIT_TOKEN is set, as pairux.com does; the Actions GITHUB_TOKEN cannot fork another organisation's repository. The version is read from the manifest, and a run without WinGet manifests skips. v0.2.0 was submitted by hand from a local gh login with this script: microsoft/winget-pkgs#439881. Before submitting, the InstallerSha256 was matched against the release's SHA256SUMS.txt and every URL in the manifests answered. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan9 finding(s) HIGH/CRITICAL: 4 | MEDIUM: 5
Snippets are redacted; ThreatCrush never prints matched credential material. |
… in place The first 0.2.0 submission branched from the fork's own master, which held 36 commits upstream never took, so microsoft/winget-pkgs#439881 arrived with PairUX files and was rejected for containing more than one application. Branch from upstream's master instead and never touch the fork's; build the single commit (tree + commit) before moving the branch, because resetting an open PR's head to bare master closes the PR; reuse the open PR from the same branch instead of closing it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WinGet was the one package manager still left to a person: the workflow printed "submit with wingetcreate" and stopped. WinGet accepts packages only as pull requests to
microsoft/winget-pkgs, so publishing there means running a PR bot.tools/release/submit-winget.mjsis PairUX's proven flow, ported into this repo's release tools. PairUX'sProfullstack.PairUXPRs have been merged by Microsoft. The script:winget-pkgsunder the token's account and syncs the fork--dry-runprints the plan and touches nothing.In CI, the Submit job runs it when a
PKG_SUBMIT_TOKENsecret is set, as pairux.com does. The built-in ActionsGITHUB_TOKENcan't fork another organisation's repository, so a personal token is needed. The step reads the version from the manifest itself, and skips when a run has no WinGet manifests.v0.2.0 is already submitted, by hand with this script from a local
ghlogin: microsoft/winget-pkgs#439881. Before submitting, I checked that the installer's SHA-256 matches the release'sSHA256SUMS.txtand that every URL in the manifests answers.🤖 Generated with Claude Code