ci: add winget manifest submission workflow#1472
Merged
Merged
Conversation
github-actions
Bot
added
the
github_actions
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow ChangesWinGet Manifest Submission Workflow
Sequence DiagramsequenceDiagram
participant Release as GitHub Release
participant Runner as Windows Runner
participant PS as PowerShell Resolver
participant DotNet as .NET Installer
participant WingetCreate as winget-create CLI
participant GitHubAPI as GitHub API
Release->>Runner: release published / workflow_dispatch triggers
Runner->>PS: run metadata resolution (tag, version, installer URL)
PS-->>Runner: resolved metadata or error
Runner->>DotNet: install .NET 6 runtime
DotNet-->>Runner: .NET ready
Runner->>WingetCreate: download & verify winget-create
Runner->>WingetCreate: run wingetcreate with metadata
alt submit=true
WingetCreate->>GitHubAPI: authenticate with WINGET_CREATE_GITHUB_TOKEN and submit PR
GitHubAPI-->>WingetCreate: submission response
else submit=false
WingetCreate-->>Runner: perform dry-run validation
end
WingetCreate-->>Runner: output result or error
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Coverage Report
File CoverageNo changed files found. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/winget.yml (2)
94-99: 💤 Low valueAvoid shadowing PowerShell's automatic
$argsvariable.
$argsis an automatic variable in PowerShell that contains undeclared parameters. While this works, it can cause confusion and is flagged by PSScriptAnalyzer.♻️ Suggested rename
- $args = @( + $wingetArgs = @( 'update', $env:PACKAGE_IDENTIFIER, '-u', $env:INSTALLER_URL, '-v', $env:VERSION ) if ($shouldSubmit) { if ([string]::IsNullOrWhiteSpace($env:WINGET_CREATE_TOKEN)) { throw 'WINGET_CREATE_GITHUB_TOKEN repository secret is required when submit is enabled.' } - $args += @('-t', $env:WINGET_CREATE_TOKEN, '--submit') + $wingetArgs += @('-t', $env:WINGET_CREATE_TOKEN, '--submit') } - .\wingetcreate.exe `@args` + .\wingetcreate.exe `@wingetArgs`🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/winget.yml around lines 94 - 99, The snippet is shadowing PowerShell's automatic $args; rename the local array (for example to $updateArgs or $packageArgs) and replace all uses in this scope so the script uses the new name instead of $args (e.g., where the array is passed to Start-Process/Invoke-Expression or splatted). Keep the same contents ('update', $env:PACKAGE_IDENTIFIER, '-u', $env:INSTALLER_URL, '-v', $env:VERSION) but use the new variable ($updateArgs) to avoid colliding with the automatic $args.
109-109: 💤 Low valueAdd trailing newline at end of file.
POSIX convention expects files to end with a newline character.
♻️ Add newline
.\wingetcreate.exe `@args` +🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/winget.yml at line 109, Add a trailing newline at the end of the winget.yml workflow file: open .github/workflows/winget.yml, ensure the very last character is a newline (POSIX/EOL), save and commit the change so the file ends with a single newline character.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/winget.yml:
- Line 68: The script currently assigns the API asset endpoint to $installerUrl
using $asset.url which is not a browser-download link; update the assignment to
use the asset's browser_download_url property instead (replace references to
$asset.url with $asset.browser_download_url) so winget-create receives the
actual download URL for the installer.
---
Nitpick comments:
In @.github/workflows/winget.yml:
- Around line 94-99: The snippet is shadowing PowerShell's automatic $args;
rename the local array (for example to $updateArgs or $packageArgs) and replace
all uses in this scope so the script uses the new name instead of $args (e.g.,
where the array is passed to Start-Process/Invoke-Expression or splatted). Keep
the same contents ('update', $env:PACKAGE_IDENTIFIER, '-u', $env:INSTALLER_URL,
'-v', $env:VERSION) but use the new variable ($updateArgs) to avoid colliding
with the automatic $args.
- Line 109: Add a trailing newline at the end of the winget.yml workflow file:
open .github/workflows/winget.yml, ensure the very last character is a newline
(POSIX/EOL), save and commit the change so the file ends with a single newline
character.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 9e56dc96-ed32-463a-ae38-cc282fe980ec
📒 Files selected for processing (1)
.github/workflows/winget.yml
Contributor
There was a problem hiding this comment.
Pull request overview
Adds automation to submit updated WinGet manifests when a stable GitHub Release is published, with a manual dispatch path for overrides/dry runs.
Changes:
- Introduces a new GitHub Actions workflow triggered on
release.published(skipping prereleases) andworkflow_dispatch. - Resolves the release tag/version and MSI installer URL (with a manual installer URL override) before running
wingetcreate update. - Optionally submits the manifest PR to
microsoft/winget-pkgsusing a repository secret token.
Contributor
Rust Tauri Coverage ReportCoverage Details |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/winget.yml:
- Line 22: The workflow is using overly broad permissions ("permissions:
read-all"); change this to least-privilege by replacing that entry with a
fine-grained permission scope required for reading release metadata (e.g., set
the permissions key to "contents: read" or another minimal scope that authorizes
gh release view). Update the permissions block (the "permissions" key that
currently has "read-all") to the chosen minimal permission and ensure the YAML
remains valid.
- Line 35: The WINGET_CREATE_TOKEN is currently defined at job scope so every
step can access the secret; move the WINGET_CREATE_TOKEN environment variable
out of the job-level env and set it only on the specific step that performs the
"Update WinGet manifest" (use the step's env: WINGET_CREATE_TOKEN: ${{
secrets.WINGET_CREATE_GITHUB_TOKEN }}). Update the workflow so other steps
(e.g., tool download) do not inherit WINGET_CREATE_TOKEN and confirm the step
name "Update WinGet manifest" references the step where the token is now scoped.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 51d28be5-5121-4322-ad89-0c9b241aaded
📒 Files selected for processing (1)
.github/workflows/winget.yml
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/winget.yml (2)
22-22:⚠️ Potential issue | 🟠 Major | ⚡ Quick winNarrow workflow permissions to least privilege.
Line 22 uses
read-all, which is broader than needed for this job. Scope it tocontents: read.🔒 Minimal permission scope
-permissions: read-all +permissions: + contents: read🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/winget.yml at line 22, Replace the overly broad "permissions: read-all" entry in the workflow with the least-privilege setting required by this job by changing it to a scoped permission such as "contents: read"; update the permissions block so it no longer uses the global read-all scope but instead declares only "contents: read" to limit access.
33-37:⚠️ Potential issue | 🟠 Major | ⚡ Quick winScope
WINGET_CREATE_TOKENto the submit step only.Line 37 exposes the secret to every step in the job. Keep it only where
wingetcreatesubmission runs.🔐 Limit secret exposure
env: PACKAGE_IDENTIFIER: shm11C3.HardwareVisualizer WINGET_CREATE_VERSION: v1.12.8.0 WINGET_CREATE_SHA256: 8bd738851b524885410112678e3771b341c5c716de60fbbecb88ab0a363ed85d - WINGET_CREATE_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }} @@ - name: Update WinGet manifest env: INSTALLER_URL: ${{ steps.release.outputs.installer-url }} VERSION: ${{ steps.release.outputs.version }} SHOULD_SUBMIT: ${{ inputs.submit || github.event_name == 'release' }} + WINGET_CREATE_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}Also applies to: 98-102
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/winget.yml around lines 33 - 37, Move the secret WINGET_CREATE_TOKEN out of the job-level env block and add it only to the env of the specific step that runs the wingetcreate/submit logic (the step that invokes "wingetcreate" or "submit"); remove any other job-level occurrences (also the duplicate at lines 98-102) so the token is not exposed to every step—leave non-secret vars like WINGET_CREATE_VERSION and WINGET_CREATE_SHA256 at the job level if needed and add WINGET_CREATE_TOKEN under the single step's env: key.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/winget.yml:
- Line 22: Replace the overly broad "permissions: read-all" entry in the
workflow with the least-privilege setting required by this job by changing it to
a scoped permission such as "contents: read"; update the permissions block so it
no longer uses the global read-all scope but instead declares only "contents:
read" to limit access.
- Around line 33-37: Move the secret WINGET_CREATE_TOKEN out of the job-level
env block and add it only to the env of the specific step that runs the
wingetcreate/submit logic (the step that invokes "wingetcreate" or "submit");
remove any other job-level occurrences (also the duplicate at lines 98-102) so
the token is not exposed to every step—leave non-secret vars like
WINGET_CREATE_VERSION and WINGET_CREATE_SHA256 at the job level if needed and
add WINGET_CREATE_TOKEN under the single step's env: key.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: e4004232-7077-4477-8351-dba9150b14f9
📒 Files selected for processing (1)
.github/workflows/winget.yml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/winget.yml:
- Around line 62-73: The workflow currently accepts inputs.installer-url into
$installerUrl without validation; add an early check (before the
asset-resolution block that uses $installerUrl) to validate that the provided
$installerUrl is an HTTPS URL and points to an MSI (case-insensitive .msi
suffix). If validation fails, throw a descriptive error (e.g.,
"inputs.installer-url must be an https:// URL to an .msi") so failures are
immediate; update the code that sets/uses $installerUrl (look for the
$installerUrl variable and the branch that bypasses asset resolution) to run
this validation whenever $installerUrl is non-empty prior to calling
wingetcreate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 17dd8cbb-3e74-4b73-800b-e96d28969e8b
📒 Files selected for processing (1)
.github/workflows/winget.yml
This was referenced May 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
HardwareVisualizer_{VERSION}_x64_en-US.msi, with manual override supportValidation
actionlintagainst.github/workflows/winget.ymlSummary by CodeRabbit