build(ci): automate winget submissions via after_release.yml#47
Merged
Conversation
Adds the workflow that submits a winget-pkgs PR on every stable
release. Hands-off after the tag push:
* Separate workflow from `release.yml` so the build/release path
stays focused on artifact production. after_release.yml fires
on the GitHub Release publish event (downstream of
softprops/action-gh-release running in release.yml's `release`
job).
* Pre-step syncs the maintainer's winget-pkgs fork against
upstream master via GitHub's `/merge-upstream` endpoint —
avoids non-fast-forward errors when the fork has drifted.
* Main step: `vedantmgoyal9/winget-releaser@19e706d4c9121098010096f9c495a70a7518b30f`
(SHA-pinned, `# v2`). Action handles manifest rendering, fork
operations, and PR creation against `microsoft/winget-pkgs`.
* `max-versions-to-keep: 5` bounds the per-version directories
so the upstream tree doesn't accumulate every historical
Baudrun release forever.
* Stable-only gate: `if: !github.event.release.prerelease`
(and `!contains(inputs.tag_name, '-')` on the
workflow_dispatch path). Pre-releases already skip the MSI
build in release.yml's existing `contains('-')` gates, so
there's no MSI to submit anyway, and winget itself has no
pre-release channel.
* `workflow_dispatch` trigger with required `tag_name` input
lets us re-fire a submission if the release-event trigger
races against a slow Release publish or hits a transient
GitHub API blip on the fork-PR step.
* `if: github.repository_owner == 'packetThrower'` guards
against forks accidentally running the publish path.
Setup (one-time, already done):
* Fine-grained PAT scoped to `packetThrower/winget-pkgs` with
`Contents: read and write` + `Pull requests: read and write`,
stored as repo secret `WINGET_TOKEN`.
`packaging/windows/winget/README.md` gets a new "automated via
CI" section ahead of the existing manual paths, which are
demoted to fallback (emergency-override + reference) status.
The first automated submission will be v0.13.0's stable tag.
If it succeeds, it includes arm64 again (re-added implicitly
since the template already had it — fde581f only removed arm64
from the rendered/0.12.4/ snapshot, never the template).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the workflow that submits a winget-pkgs PR on every stable release.
Flow
vX.Y.Z, no hyphen).release.ymlbuilds artifacts including the per-arch.msi, then itsreleasejob publishes the GitHub Release viasoftprops/action-gh-release.after_release.yml::publish_winget.packetThrower/winget-pkgsfork against upstream via/merge-upstream, then runswinget-releaserwhich renders the templates, commits undermanifests/p/packetThrower/Baudrun/<version>/on the fork, opens the PR.Hands-off after the tag push.
Skip conditions
if: !github.event.release.prerelease(or!contains(inputs.tag_name, '-')on the dispatch path). Pre-releases already skip MSI inrelease.yml, so there's no MSI to submit; winget itself has no pre-release channel.if: github.repository_owner == 'packetThrower'. TheWINGET_TOKENsecret isn't set on a fork anyway, but fail-fast is friendlier than a mid-action 401.Manual escape hatch
workflow_dispatchinputtag_namelets us re-fire if the release-event trigger races against a slow Release publish or hits a GitHub API blip on the fork-PR step. Same flow, just manually re-entered tag.Setup (done out-of-band)
packetThrower/winget-pkgsfork withContents: read+write+Pull requests: read+write, stored as repo secretWINGET_TOKEN.Documentation
packaging/windows/winget/README.mdgets a new "automated via CI" section. The existingwingetcreatemanual flow stays as the emergency-override path; the in-repo render flow stays as reference. No content lost.Test plan
actionlintclean on the new workflowwinget-releaserSHA pin (19e706d4c9121098010096f9c495a70a7518b30f,# v2)Risk
winget-releaseris well-established.wingetcreateif first-run fails.🤖 Generated with Claude Code