From 63e9e1c465176b84c225df6747ef99eda04c630e Mon Sep 17 00:00:00 2001
From: Dan Berkowitz <dan.berkowitz@oxidecomputer.com>
Date: Mon, 21 Sep 2026 14:57:41 -0700
Subject: [PATCH] Publish to winget on release

Adds a publish-winget job to the release workflow, gated identically to
publish-homebrew-formula, that opens a PR against microsoft/winget-pkgs
for each new release.

Uses vedantmgoyal9/winget-releaser (a wrapper around komac), which bases
the new manifests on the previous version already in winget-pkgs. That
means the zip/nested-portable layout, the oxide.exe command alias and the
locale metadata all carry over without being restated here.

Two bits of local knowledge are encoded: our tags carry build metadata
(v0.18.0+2026073100.0.0) while the winget PackageVersion is the bare
semver (0.18.0), and the installer regex has to select the Windows zip
without also matching its .sha256 sidecar.

Requires a WINGET_TOKEN repository secret, which does not exist yet: a
classic PAT with public_repo scope (fine-grained tokens are not supported
by the action) belonging to an account with write access to the
oxidecomputer/winget-pkgs fork.
---
 .github/workflows/release.yml | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 696a4fc0..bfd0fd04 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -333,15 +333,40 @@ jobs:
           done
           git push
 
+  publish-winget:
+    needs:
+      - plan
+      - host
+    runs-on: "ubuntu-22.04"
+    if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
+    steps:
+      # Our tags carry build metadata (e.g. v0.18.0+2026073100.0.0) but the
+      # winget PackageVersion is the bare semver (0.18.0).
+      - id: version
+        env:
+          TAG: ${{ needs.plan.outputs.tag }}
+        run: |
+          echo "version=$(echo "${TAG#v}" | cut -d+ -f1)" >> "$GITHUB_OUTPUT"
+      # Bases the new manifests on the previous version in winget-pkgs, so the
+      # zip/nested-portable layout and locale metadata carry over untouched.
+      - uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
+        with:
+          identifier: OxideComputer.OxideCLI
+          version: ${{ steps.version.outputs.version }}
+          installers-regex: 'windows-msvc\.zip$'
+          release-notes-url: "https://github.com/oxidecomputer/oxide.rs/releases/tag/${{ needs.plan.outputs.tag }}"
+          token: ${{ secrets.WINGET_TOKEN }}
+
   announce:
     needs:
       - plan
       - host
       - publish-homebrew-formula
+      - publish-winget
     # use "always() && ..." to allow us to wait for all publish jobs while
     # still allowing individual publish jobs to skip themselves (for prereleases).
     # "host" however must run to completion, no skipping allowed!
-    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') }}
+    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') && (needs.publish-winget.result == 'skipped' || needs.publish-winget.result == 'success') }}
     runs-on: "ubuntu-22.04"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}