From 049c32ed34eab77dab4dd791f592d7ae238fbbee Mon Sep 17 00:00:00 2001 From: foodandtravel <217430421+foodandtravel@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:09:25 +0100 Subject: [PATCH 1/2] Fail the winget check on an unexpected status instead of guessing The v1.7.7 run hit a GitHub outage while checking whether getSigit.siGitCode is in winget-pkgs. The check counted any failed `gh api` call as "not there", so it took the new-package path and opened a bogus Package Request (microsoft/winget-pkgs#465415) for a package that has been there since 1.7.4. It now branches on the status code the way the NuGet and PyPI checks do: 200 means update, 404 means new package, and anything else fails the job before an issue or PR is opened, so a rerun is safe. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-winget.yml | 34 ++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release-winget.yml b/.github/workflows/release-winget.yml index 8495a9d..6e0572c 100644 --- a/.github/workflows/release-winget.yml +++ b/.github/workflows/release-winget.yml @@ -73,13 +73,33 @@ jobs: FIRST=$(echo "${PUBLISHER:0:1}" | tr '[:upper:]' '[:lower:]') PATH_IN_REPO="manifests/${FIRST}/${PUBLISHER}/${NAME}" - if gh api "repos/microsoft/winget-pkgs/contents/${PATH_IN_REPO}" >/dev/null 2>&1; then - echo "Found ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting an update." - echo "found=true" >> "$GITHUB_OUTPUT" - else - echo "No ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting it as a new package." - echo "found=false" >> "$GITHUB_OUTPUT" - fi + # Branch on the status code, not on whether the request worked. + # This used to treat any failure as "not there", so a GitHub outage + # during the v1.7.7 run sent an existing package down the + # new-package path and filed a bogus Package Request + # (microsoft/winget-pkgs#465415). Only a 404 means "not there"; + # anything else fails the job before an issue or PR is opened, so a + # rerun is safe. + STATUS=$(curl -sS -o /dev/null -w '%{http_code}' \ + --retry 5 --retry-delay 10 --retry-all-errors \ + -H "Authorization: Bearer ${GH_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/microsoft/winget-pkgs/contents/${PATH_IN_REPO}") || true + + case "$STATUS" in + 200) + echo "Found ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting an update." + echo "found=true" >> "$GITHUB_OUTPUT" + ;; + 404) + echo "No ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting it as a new package." + echo "found=false" >> "$GITHUB_OUTPUT" + ;; + *) + echo "Unexpected ${STATUS:-no response} from GitHub checking ${PATH_IN_REPO}; refusing to guess" >&2 + exit 1 + ;; + esac - name: Render manifests for a first submission if: steps.exists.outputs.found == 'false' From de3abffe5b4a144b6aa1735487a55cccaedaf16c Mon Sep 17 00:00:00 2001 From: foodandtravel <217430421+foodandtravel@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:09:30 +0100 Subject: [PATCH 2/2] Group the workflow names Every release workflow is now named "Release ", so the Actions sidebar lists them together after CI. Only the display names change. The filenames stay, so release-github's dispatches, the CI badge and the trusted publishers, which all key on the file, still work. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-assurance-image.yml | 2 +- .github/workflows/release-aur.yml | 2 +- .github/workflows/release-crates.yml | 2 +- .github/workflows/release-github.yml | 2 +- .github/workflows/release-homebrew.yml | 2 +- .github/workflows/release-npm.yml | 2 +- .github/workflows/release-nuget.yml | 2 +- .github/workflows/release-pypi.yml | 2 +- .github/workflows/release-scoop.yml | 2 +- .github/workflows/release-winget.yml | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release-assurance-image.yml b/.github/workflows/release-assurance-image.yml index 19affe0..52620fe 100644 --- a/.github/workflows/release-assurance-image.yml +++ b/.github/workflows/release-assurance-image.yml @@ -1,4 +1,4 @@ -name: Assurance runner image +name: Release Assurance runner image # Builds ghcr.io/getsigit/sigit-code-assurance-runner, the guest image of the # siGit Code Assurance Fireactions pool, with the released `sigit` baked in. diff --git a/.github/workflows/release-aur.yml b/.github/workflows/release-aur.yml index 5aa8592..e0e09f6 100644 --- a/.github/workflows/release-aur.yml +++ b/.github/workflows/release-aur.yml @@ -1,4 +1,4 @@ -name: AUR Release +name: Release AUR # Dispatched by release-github.yml once the release and its checksums exist. # diff --git a/.github/workflows/release-crates.yml b/.github/workflows/release-crates.yml index 966453a..8dee82d 100644 --- a/.github/workflows/release-crates.yml +++ b/.github/workflows/release-crates.yml @@ -1,4 +1,4 @@ -name: Crates.io Release +name: Release crates.io on: push: diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml index fae69f8..95dff53 100644 --- a/.github/workflows/release-github.yml +++ b/.github/workflows/release-github.yml @@ -1,4 +1,4 @@ -name: GitHub Release +name: Release GitHub on: push: diff --git a/.github/workflows/release-homebrew.yml b/.github/workflows/release-homebrew.yml index 5338148..21fe05d 100644 --- a/.github/workflows/release-homebrew.yml +++ b/.github/workflows/release-homebrew.yml @@ -1,4 +1,4 @@ -name: Homebrew CLI Release +name: Release Homebrew on: workflow_dispatch: diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml index 9d600b8..7f87430 100644 --- a/.github/workflows/release-npm.yml +++ b/.github/workflows/release-npm.yml @@ -1,4 +1,4 @@ -name: NPM Release +name: Release npm on: push: diff --git a/.github/workflows/release-nuget.yml b/.github/workflows/release-nuget.yml index 690e746..55f2836 100644 --- a/.github/workflows/release-nuget.yml +++ b/.github/workflows/release-nuget.yml @@ -1,4 +1,4 @@ -name: NuGet Release +name: Release NuGet on: push: diff --git a/.github/workflows/release-pypi.yml b/.github/workflows/release-pypi.yml index f373f90..b8b8bcb 100644 --- a/.github/workflows/release-pypi.yml +++ b/.github/workflows/release-pypi.yml @@ -1,4 +1,4 @@ -name: PyPI Release +name: Release PyPI on: push: diff --git a/.github/workflows/release-scoop.yml b/.github/workflows/release-scoop.yml index 046b849..b16a233 100644 --- a/.github/workflows/release-scoop.yml +++ b/.github/workflows/release-scoop.yml @@ -1,4 +1,4 @@ -name: Scoop Release +name: Release Scoop # Dispatched by release-github.yml once the release and its checksums exist. on: diff --git a/.github/workflows/release-winget.yml b/.github/workflows/release-winget.yml index 6e0572c..c508ccf 100644 --- a/.github/workflows/release-winget.yml +++ b/.github/workflows/release-winget.yml @@ -1,4 +1,4 @@ -name: winget Release +name: Release winget # Dispatched by release-github.yml once the release and its checksums exist. #