Vitor Pamplona
8a183d1cbd
Mirrors the Homebrew cask change. The old design stored a classic `public_repo` PAT as WINGET_TOKEN and handed it to the third-party vedantmgoyal9/winget-releaser action: a token with write access to every public repo the owning account can reach, given to code we do not control, in a place any push-access collaborator could read it from (a pushed branch containing a workflow runs with repo secrets). - CI (bump-winget.yml, now "Sync Winget Manifest Reference") uses GITHUB_TOKEN only: downloads the MSI, computes the sha256, reads the ProductCode from the MSI Property table via msitools, and opens an in-repo PR syncing desktopApp/packaging/winget/. Runs on ubuntu (1x billing) rather than Windows since msitools reads the Property table fine. - scripts/bump-winget.sh does the upstream PR. It needs NO new token: it drives `gh`, which a maintainer already has authenticated, and it does not need wingetcreate (Windows-only) because the manifests are plain YAML — so it runs from macOS or Linux. Add the three reference manifests under desktopApp/packaging/winget/, matching the schema 1.12.0 shape used upstream. All three validate against Microsoft's published JSON schemas. Validation caught one real bug worth noting: an all-digit 64-char InstallerSha256 parses as a YAML *integer* and fails the schema's `string` type, so it is written quoted. ProductCode is re-read every release because jpackage regenerates it per build; it is the ARP key `winget upgrade` matches on. Drops the last package-manager PAT from the secret inventory.
33 lines
1.5 KiB
YAML
33 lines
1.5 KiB
YAML
# Reference Winget installer manifest for the Amethyst desktop app.
|
|
#
|
|
# InstallerUrl / InstallerSha256 / ProductCode are rewritten on each stable
|
|
# release by .github/workflows/bump-winget.yml, which downloads the published MSI,
|
|
# hashes it, and reads the ProductCode out of the MSI's Property table.
|
|
#
|
|
# InstallerType is `wix` because jpackage builds the MSI with the WiX Toolset.
|
|
# ProductCode matters: it is the ARP key winget uses to detect an existing
|
|
# install, so `winget upgrade` misbehaves without it. jpackage regenerates it per
|
|
# build, which is why CI re-reads it every release rather than pinning it here.
|
|
# (UpgradeCode is the stable one — see `upgradeUuid` in desktopApp/build.gradle.kts,
|
|
# which must never change.)
|
|
# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
|
|
|
|
PackageIdentifier: VitorPamplona.Amethyst
|
|
PackageVersion: 1.13.1
|
|
Platform:
|
|
- Windows.Desktop
|
|
MinimumOSVersion: 10.0.0.0
|
|
InstallerType: wix
|
|
Scope: machine
|
|
UpgradeBehavior: install
|
|
Installers:
|
|
- Architecture: x64
|
|
InstallerUrl: https://github.com/vitorpamplona/amethyst/releases/download/v1.13.1/amethyst-desktop-1.13.1-windows-x64.msi
|
|
# Quoted deliberately: an all-digit 64-char value is a YAML *integer*, which
|
|
# fails the schema's `string` type. Quoting makes it a string whatever the
|
|
# digest happens to be.
|
|
InstallerSha256: '0000000000000000000000000000000000000000000000000000000000000000'
|
|
ProductCode: '{00000000-0000-0000-0000-000000000000}'
|
|
ManifestType: installer
|
|
ManifestVersion: 1.12.0
|