Repository navigation
ci: harden WinGet manifest generation and PR validation - #16
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b551cf79d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 3 potential issues.
2 flags not posted on this PR by your GitHub settings — view them in Devin Review. (Configure)
ruslanlap
changed the title
|
@codex review Please re-review the latest head. The PFX fallback was removed; the latest changes also gate workflow_run on success and pass/validate the manual release tag via environment variables. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ff7623bdc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| workflow_dispatch: | ||
| pull_request: | ||
| branches: [master] | ||
| paths: |
There was a problem hiding this comment.
When a PR changes only Directory.Packages.props, global.json, or nuget.config, none of these path filters match, so the new MSIX validation workflow does not run. Because this repository centrally declares every NuGet version in Directory.Packages.props, dependency-only PRs— including the updates configured in .github/dependabot.yml—receive no compile or packaging validation. Add the root build inputs to this paths list.
Useful? React with 👍 / 👎.
| TAG="${{ github.event.inputs.release_tag }}" | ||
| TAG="$MANUAL_RELEASE_TAG" | ||
| else | ||
| TAG=$(gh api repos/${{ github.repository }}/releases/latest --jq '.tag_name') |
There was a problem hiding this comment.
When an older release workflow is rerun after a newer release exists, or two release runs overlap, this branch ignores the triggering workflow_run and queries the repository-wide releases/latest endpoint. The job then downloads and hashes the newer release rather than packaging the release whose workflow just completed. Carry the release tag from the upstream run, for example in a run artifact, instead of resolving it globally.
Useful? React with 👍 / 👎.
| - A publicly trusted PFX code-signing certificate via `SIGNING_CERT_BASE64` and | ||
| `SIGNING_CERT_PASSWORD`. |
There was a problem hiding this comment.
After the PFX fallback was removed, the release workflow unconditionally requires the SignPath token and repository variables and contains no SIGNING_CERT_* path. These instructions therefore tell operators that configuring a trusted PFX is sufficient even though the release will fail during SignPath preflight. Document SignPath as the sole release-signing mechanism, or explicitly distinguish the non-publishing build-msix.yml PFX support.
Useful? React with 👍 / 👎.
1 participant
Summary
Hardens the WinGet publishing path without changing the existing SignPath release-signing flow.
Changes
release_taginput as data, validate its format, and avoid expression interpolation into PowerShell.msixbundleInstallerSha256andSignatureSha256automaticallywinget/folders0x800B0109 / CERT_E_UNTRUSTEDROOTblocker and the corrected submission flowScope
This PR deliberately keeps SignPath-only release signing unchanged. A generic PFX fallback is unsafe for the current MSIX because the certificate subject must match the package manifest Publisher. That identity should only be changed once the actual trusted signing certificate identity is known.
Current upstream blocker
microsoft/winget-pkgs#431811 has confirmed that the only remaining validation blocker for v1.0.4 is the untrusted certificate chain.