Skip to content

Check the winget manifest before it is submitted #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chiragjangiir wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Check the winget manifest before it is submitted #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c62e433
Pin the winget publisher action to a commit
chiragjangiir Oct 10, 2026
fe2bffa
Check the winget manifest before it is submitted
chiragjangiir Oct 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,13 @@ jobs:
- id: version
shell: bash
run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
- uses: vedantmgoyal9/winget-releaser@v2
# Pinned to a commit rather than @v2: this action is handed
# WINGET_TOKEN (a PAT that can open PRs on a fork of winget-pkgs), and
# @v2 is a moving tag — it currently resolves to a commit pushed
# 2026-10-07 while the v2 release dates from 2025-01-27, so a tag move
# would run unreviewed code with that token. Bump deliberately:
# gh api repos/vedantmgoyal9/winget-releaser/commits/v2 -q .sha
- uses: vedantmgoyal9/winget-releaser@f29ed1ffd34f91223a2aebaa71beaab0901ff9fd # v2
with:
identifier: ${{ vars.WINGET_PACKAGE_ID }}
installers-regex: '\.exe$'
Expand Down
24 changes: 24 additions & 0 deletions docs/winget.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,21 @@ three YAML files from the latest GitHub release:
node scripts/print-winget-manifest.mjs --out .tmp/winget
```

The generator checks its own output before writing anything: the fields each
file has to carry under the 1.6.0 manifest schemas, the identifier and version
agreeing across the three files, the installer URL naming the versioned asset
the release uploads, the hash being 64 hex characters, the architecture and
installer type being ones winget accepts, and the locale strings staying inside
the schema's length limits. It also refuses a manifest whose `Scope` disagrees
with electron-builder's NSIS config in `package.json` (per-user today), since
that is what decides where winget installs the app. Nothing is written if a
check fails, and the reasons are printed.

That covers the shape winget-pkgs validates on a pull request. It cannot cover
the parts of their pipeline that need Windows — the installer actually running
and uninstalling, and the manual review — so watch the checks on the PR itself
after submitting.

Then either:

- install [wingetcreate](https://github.com/microsoft/winget-create) and submit
Expand All @@ -43,3 +58,12 @@ The [Release workflow](../.github/workflows/release.yml) then runs
`winget-releaser` after each GitHub Release so the manifest stays current.
Leave `WINGET_PACKAGE_ID` empty until the first package is accepted, otherwise
the job would try to update a package that does not exist yet.

The job pins `vedantmgoyal9/winget-releaser` to a commit instead of `@v2`.
That action is handed `WINGET_TOKEN`, and `v2` is a moving tag — it currently
resolves to a commit pushed after the v2 release, so a tag move would run
unreviewed code with the token. Bump the pin on purpose:

```bash
gh api repos/vedantmgoyal9/winget-releaser/commits/v2 -q .sha
```
Loading