Skip to content

ci(release): sync the winget fork before submitting the manifest - #188

Merged
yeroo merged 1 commit into
mainfrom
ci/winget-sync-fork-before-submit
Aug 17, 2026
Merged

ci(release): sync the winget fork before submitting the manifest#188
yeroo merged 1 commit into
mainfrom
ci/winget-sync-fork-before-submit

Conversation

@yeroo

@yeroo yeroo commented Aug 14, 2026

Copy link
Copy Markdown
Owner

wingetcreate refuses to open a PR from a fork that has drifted from upstream:

The forked repository could not be synced with the upstream commits. Sync your fork manually and try again.

That blocked winget for 0.17.3 — the manifest built and validated, then failed at submission — and it recurs whenever microsoft/winget-pkgs touches .github/workflows, because syncing a fork that carries workflow files needs the workflow scope a plain OAuth token lacks:

refusing to allow an OAuth App to create or update workflow
`.github/workflows/manifest-validation-diagnosis.lock.yml` without `workflow` scope

Clearing it by hand costs a manual round trip plus a job re-run each time.

Change

The release job calls the server-side merge-upstream endpoint before wingetcreate, using WINGET_TOKEN (a PAT, which has the scope). No checkout needed — the sync happens entirely on GitHub's side.

Best-effort and wrapped in try/catch: a fresh fork, or none at all, must not fail the release. The submit step keeps its own continue-on-error for the moderation cases it already tolerated.

Owner comes from github.repository_owner rather than being hardcoded, matching how the rest of the workflow addresses the repo.

Verified by hand today

After gh auth refresh -s workflow, syncing the fork moved it to upstream's head (91fdec2e1 on both) and the re-run submitted microsoft/winget-pkgs#417355 — "New version: yeroo.agwinterm version 0.17.3". This change makes that automatic.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

🤖 Generated with Claude Code

wingetcreate refuses to open a PR from a fork that has drifted from upstream:

  "The forked repository could not be synced with the upstream commits.
   Sync your fork manually and try again."

That blocked winget for 0.17.3 — the manifest built and validated, then failed at submission
— and it recurs whenever microsoft/winget-pkgs touches .github/workflows, because syncing a
fork carrying workflow files needs the `workflow` scope that a plain OAuth token lacks.
Clearing it by hand costs a manual round trip and a job re-run each time.

The release job now calls the server-side merge-upstream endpoint first, with WINGET_TOKEN
(a PAT, which has the scope). No checkout needed. Best-effort and wrapped in try/catch: a
fresh fork, or none yet, must not fail the release — the submit step keeps its own
continue-on-error for the moderation cases.

Owner comes from github.repository_owner rather than being hardcoded, matching how the rest
of the workflow addresses the repo.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@yeroo
yeroo merged commit 0c07425 into main Aug 17, 2026
1 check passed
@yeroo
yeroo deleted the ci/winget-sync-fork-before-submit branch August 17, 2026 14:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant