Fail the winget existence check on an unexpected status, and group the workflow names

.github/workflows/release-assurance-image.yml

@@ -1,4 +1,4 @@
-name: Assurance runner image
+name: Release Assurance runner image
 
 # Builds ghcr.io/getsigit/sigit-code-assurance-runner, the guest image of the
 # siGit Code Assurance Fireactions pool, with the released `sigit` baked in.

.github/workflows/release-aur.yml

@@ -1,4 +1,4 @@
-name: AUR Release
+name: Release AUR
 
 # Dispatched by release-github.yml once the release and its checksums exist.
 #

.github/workflows/release-crates.yml

@@ -1,4 +1,4 @@
-name: Crates.io Release
+name: Release crates.io
 
 on:
   push:

.github/workflows/release-github.yml

@@ -1,4 +1,4 @@
-name: GitHub Release
+name: Release GitHub
 
 on:
   push:

.github/workflows/release-homebrew.yml

@@ -1,4 +1,4 @@
-name: Homebrew CLI Release
+name: Release Homebrew
 
 on:
   workflow_dispatch:

.github/workflows/release-npm.yml

@@ -1,4 +1,4 @@
-name: NPM Release
+name: Release npm
 
 on:
   push:

.github/workflows/release-nuget.yml

@@ -1,4 +1,4 @@
-name: NuGet Release
+name: Release NuGet
 
 on:
   push:

.github/workflows/release-pypi.yml

@@ -1,4 +1,4 @@
-name: PyPI Release
+name: Release PyPI
 
 on:
   push:

.github/workflows/release-scoop.yml

@@ -1,4 +1,4 @@
-name: Scoop Release
+name: Release Scoop
 
 # Dispatched by release-github.yml once the release and its checksums exist.
 on:

.github/workflows/release-winget.yml

@@ -1,4 +1,4 @@
-name: winget Release
+name: Release winget
 
 # Dispatched by release-github.yml once the release and its checksums exist.
 #
@@ -73,13 +73,33 @@ jobs:
           FIRST=$(echo "${PUBLISHER:0:1}" | tr '[:upper:]' '[:lower:]')
           PATH_IN_REPO="manifests/${FIRST}/${PUBLISHER}/${NAME}"
 
-          if gh api "repos/microsoft/winget-pkgs/contents/${PATH_IN_REPO}" >/dev/null 2>&1; then
-            echo "Found ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting an update."
-            echo "found=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "No ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting it as a new package."
-            echo "found=false" >> "$GITHUB_OUTPUT"
-          fi
+          # Branch on the status code, not on whether the request worked.
+          # This used to treat any failure as "not there", so a GitHub outage
+          # during the v1.7.7 run sent an existing package down the
+          # new-package path and filed a bogus Package Request
+          # (microsoft/winget-pkgs#465415). Only a 404 means "not there";
+          # anything else fails the job before an issue or PR is opened, so a
+          # rerun is safe.
+          STATUS=$(curl -sS -o /dev/null -w '%{http_code}' \
+            --retry 5 --retry-delay 10 --retry-all-errors \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/microsoft/winget-pkgs/contents/${PATH_IN_REPO}") || true
+
+          case "$STATUS" in
+            200)
+              echo "Found ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting an update."
+              echo "found=true" >> "$GITHUB_OUTPUT"
+              ;;
+            404)
+              echo "No ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting it as a new package."
+              echo "found=false" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "Unexpected ${STATUS:-no response} from GitHub checking ${PATH_IN_REPO}; refusing to guess" >&2
+              exit 1
+              ;;
+          esac
 
       - name: Render manifests for a first submission
         if: steps.exists.outputs.found == 'false'