[qqrm]

Why

The WinGet publisher used a Linux runner for a Windows-only validator, reused the release credential, and sent raw YAML to a Contents API field that requires Base64. The existing checks did not exercise these paths.

Changes

• Run all WinGet validation/publication paths on windows-2025, using pinned official Microsoft WinGet client/bootstrap module 1.29.380.
• Confine WINGET_TOKEN to the submission step. The normal release pipeline invokes a separate job after GitHub Release and crate publication, with only contents: read; RELEASE_TOKEN remains dedicated to the version-PR writer.
• Validate and upload exactly the same UTF-8/CRLF manifest bytes, Base64-encoded for the GitHub Contents API.
• Bind release-event submissions to the event's exact stable tag, serialize writers with release-dev, and build manifest branches from Microsoft's current master.
• Refuse incomplete PR searches, closed/overlapping submissions, stale releases, and orphaned branches. Recheck releases and competing submissions immediately before opening a PR.
• Add --validate-only and make the real Windows validator a required part of workflow-security-gate.
• Keep only WinGet's package directory on PATH; the Windows integration run caught and fixed a Store-alias collision with Python.

Validation

Checked head: 8f1874d7a6dc83f67e2f5b62f539f8961b4859a3.

• 84 Python tests pass, including 37 publication tests and 8 workflow permission/policy tests.
• Strict API/process stubs verify one fork branch, three Base64 file uploads, and one upstream PR; unexpected network calls, commands, upstream writes, or merge attempts fail the tests.
• Negative cases cover validation failures, permissions/HTTP 403, bad assets/hash/PE headers, missing credentials, duplicate/closed/overlapping PRs, incomplete search results, and release/PR changes during uploads.
• The Windows run downloaded the actual v1.0.26 executable, verified its uploaded size, SHA-256 and x64 PE header, then successfully executed winget validate --manifest on all three generated manifests. No GitHub writes were requested.
• Workflow Security passed, including actionlint, zizmor, Linux policy tests, Windows stub tests and real WinGet validation.
• Full CI, CodeQL, Windows Input Regression and Spell Check passed.

Publication setup

A separate WINGET_TOKEN is required, with permission to write manifest branches in qqrm/winget-pkgs and open PRs in microsoft/winget-pkgs. Do not substitute RELEASE_TOKEN.

After merge and credential setup, run Backfill WinGet manifest on dev with an empty release tag. It selects the latest stable release and checks existing catalog entries and PRs before submission. This automation never merges a PR in microsoft/winget-pkgs.