ci(publish): wire winget job via komac (D3 §3d)
Add the 4th publish.yaml sibling job: opens a PR to microsoft/winget-pkgs with komac (pinned 2.16.0 prebuilt) for LazyEvaluation.RdbmsPlayground (portable, x64 + arm64). Unlike scoop/homebrew it's a PR into Microsoft's central, human-gated catalog - async and validated on their side. - Auth: a classic public_repo GitHub PAT on a dedicated bot account (lazyeval-ci; fine-grained tokens can't open the cross-fork PR - komac #310), as the WINGET_GITHUB_TOKEN secret, job-scoped and passed to the API guards via a 0600 curl config file (never argv). - Idempotent via two guards before submitting (already-merged version + already-open PR) so a repeated publish dispatch can't open a duplicate. - No actions/checkout (komac works off URLs + the GitHub API). Docs: ADR-0056 Amendment 4 - the model, the one-time manual `komac new` bootstrap recipe (flags verified vs komac 2.16.0), and first-run learnings: the fork must pre-exist, and a direct single-exe portable takes its PATH alias from Commands[0] (not PortableCommandAlias, which is nested-only). Plus README index + requirements D3. Wiring only; going live needs the bootstrap PR (#391335, submitted) to merge.
This commit is contained in:
claude@clouddev1
@@ -238,3 +238,82 @@ needed for *browser-download* trust, not for the package-manager paths,
|
||||
which are all working now.
|
||||
|
||||
**Remaining D3:** winget only.
|
||||
|
||||
## Amendment 4 — 2026-06-20: winget (D3 §3d) — the last package manager
|
||||
|
||||
winget wired as the fourth `publish.yaml` sibling job, **completing the D3
|
||||
package-manager set** (crates.io/binstall, Scoop, Homebrew, winget; plus the
|
||||
install scripts + direct binaries).
|
||||
|
||||
**Model — fundamentally unlike Scoop/Homebrew.** winget has no
|
||||
self-hosted-source equivalent: its default catalog is the central,
|
||||
**human-gated** GitHub repo `microsoft/winget-pkgs`, and you get in by
|
||||
**opening a PR** of manifests into it. So the job submits a PR (via
|
||||
**komac**, pinned `2.16.0`, prebuilt glibc binary — the CI image has no
|
||||
cargo) and **Microsoft's pipeline validates async** (schema, SHA256,
|
||||
AV/SmartScreen scan, sandbox install) + moderator review. It is *not* live
|
||||
on dispatch like the bucket/tap.
|
||||
|
||||
**PackageIdentifier `LazyEvaluation.RdbmsPlayground`** (publisher segment =
|
||||
the publishing entity / `lazyeval` org / license holder — consistent with
|
||||
everything else). Bare-exe → winget **`portable`** installer type; x64
|
||||
(`-pc-windows-gnu`) + arm64 (`-pc-windows-gnullvm`), komac infers arch +
|
||||
type from the binaries.
|
||||
|
||||
**Auth — a dedicated GitHub bot, classic token.** komac needs a **classic
|
||||
`public_repo` PAT**; **fine-grained tokens cannot open the cross-fork PR**
|
||||
(komac #310 — the PR is created on the *target* repo you don't administer,
|
||||
which the fine-grained model can't express). A classic `public_repo` token
|
||||
can't be scoped to one repo, so it lives on a **dedicated GitHub bot
|
||||
account** (a leak can't reach other repos — the lazyeval-ci reasoning), as
|
||||
the `WINGET_GITHUB_TOKEN` secret, referenced **only** in the `winget` job
|
||||
(job-level scoping keeps it away from the crates.io / lazyeval tokens) and
|
||||
passed to the API guards via a 0600 curl config file (never argv).
|
||||
|
||||
**Idempotency — stronger than the others need.** A re-submitted version
|
||||
would open a *duplicate* PR, so before submitting the job guards on **both**
|
||||
(1) already-merged versions (`contents` API on
|
||||
`manifests/l/LazyEvaluation/RdbmsPlayground/<ver>`) and (2) an already-open
|
||||
PR for the id+version (`search/issues`). Either → clean skip, so a repeated
|
||||
`publish` dispatch is safe even mid-review.
|
||||
|
||||
**Signing:** none required to *submit* (only MSIX needs it; ours is
|
||||
portable). The unsigned binary may earn an AV/SmartScreen **manual-review
|
||||
label** on the first PR — usually clears; a nudge toward Trusted Signing
|
||||
(the UK Ltd clears the 3-year-history bar) but not a blocker. Continues the
|
||||
parked Developer-ID/notarization posture.
|
||||
|
||||
**One-time bootstrap (manual — NOT in CI, because `komac new` is
|
||||
interactive).** Run once to create the package in winget-pkgs, then CI
|
||||
`komac update` handles every release after:
|
||||
|
||||
```
|
||||
komac token update # paste the bot's classic public_repo PAT at the prompt (not in argv/history)
|
||||
komac new LazyEvaluation.RdbmsPlayground \
|
||||
-v 0.2.0 \
|
||||
-u https://git.lazyeval.net/oli/rdbms-playground/releases/download/v0.2.0/rdbms-playground-v0.2.0-x86_64-pc-windows-gnu.exe \
|
||||
https://git.lazyeval.net/oli/rdbms-playground/releases/download/v0.2.0/rdbms-playground-v0.2.0-aarch64-pc-windows-gnullvm.exe \
|
||||
--publisher "Lazy Evaluation Ltd" --package-name "RDBMS Playground" \
|
||||
--moniker rdbms-playground --license "MIT OR Apache-2.0" \
|
||||
--package-url https://relplay.org -s
|
||||
```
|
||||
komac downloads the two exes, detects the bare binary as **`portable`**, and
|
||||
**prompts for the command alias — enter `rdbms-playground`** so users get
|
||||
that on PATH (not the long versioned filename). `-s` opens the PR; fill any
|
||||
remaining prompts. (Flags verified against komac 2.16.0: `-v/--version`,
|
||||
`-u/--urls`, `-s/--submit`; the alias has no flag and is prompted.) Once
|
||||
that first PR merges, the CI job's `komac update` takes over.
|
||||
|
||||
**Bootstrap learnings (2026-06-21, first real run).** GitHub bot account =
|
||||
`lazyeval-ci`. Its fork **`lazyeval-ci/winget-pkgs` must exist *before*
|
||||
`komac new`** — komac's auto-fork races on winget-pkgs (one of GitHub's
|
||||
largest repos) and fails with *"Could not resolve to a Repository
|
||||
'lazyeval-ci/winget-pkgs'"*; fork it manually (web **Fork**, or `gh repo
|
||||
fork microsoft/winget-pkgs --clone=false`), wait for it to populate, then
|
||||
re-run. **Alias:** for a **direct single-exe portable**, winget derives the
|
||||
on-PATH command from **`Commands[0]`** (the interactive "Commands" prompt →
|
||||
`rdbms-playground`) — **not** `PortableCommandAlias`, which is
|
||||
**archive/nested-portable-only** and must NOT be added to our manifest
|
||||
(verified against winget-cli's portable-install logic + the 1.6.0 installer
|
||||
schema; komac correctly omits it). So komac's generated manifest needs no
|
||||
hand-editing. First PR: **#391335**.
|
||||
|
||||
Reference in New Issue
Block a user