Add the 4th publish.yaml sibling job: opens a PR to microsoft/winget-pkgs
with komac (pinned 2.16.0 prebuilt) for LazyEvaluation.RdbmsPlayground
(portable, x64 + arm64). Unlike scoop/homebrew it's a PR into Microsoft's
central, human-gated catalog - async and validated on their side.
- Auth: a classic public_repo GitHub PAT on a dedicated bot account
(lazyeval-ci; fine-grained tokens can't open the cross-fork PR - komac
#310), as the WINGET_GITHUB_TOKEN secret, job-scoped and passed to the API
guards via a 0600 curl config file (never argv).
- Idempotent via two guards before submitting (already-merged version +
already-open PR) so a repeated publish dispatch can't open a duplicate.
- No actions/checkout (komac works off URLs + the GitHub API).
Docs: ADR-0056 Amendment 4 - the model, the one-time manual `komac new`
bootstrap recipe (flags verified vs komac 2.16.0), and first-run learnings:
the fork must pre-exist, and a direct single-exe portable takes its PATH
alias from Commands[0] (not PortableCommandAlias, which is nested-only).
Plus README index + requirements D3.
Wiring only; going live needs the bootstrap PR (#391335, submitted) to merge.
claude@clouddev1
0208c67e59