ci: add winget releaser workflow

[sitiom]

This action automatically generates manifests for Winget Community Repository (microsoft/winget-pkgs) and submits them.

The Zen Browser package is being added to Winget (microsoft/winget-pkgs#168940, microsoft/winget-pkgs#168942), and this workflow will be used to update it.

Before merging this:

1. Ensure the ${{ secrets.DEPLOY_KEY }} token has the public_repo permission:

2. Fork https://github.com/microsoft/winget-pkgs under @zen-browser. The action will use that fork for making a branch and creating a PR with the upstream winget-pkgs repository on every release.
3. Install Pull on the winget-pkgs fork to ensure that it is constantly updated.

If you want to see an example of a PR created using this action, see microsoft/winget-pkgs/pulls (Pull request has been created with WinGet Releaser).

[Zykkl]

1. Ensure the ${{ secrets.DEPLOY_KEY }} token has the public_repo permission

Could we get that done in the CI by using the PAT from GH actions and specifying it's permissions?

[Zykkl]

Sidenote, ZenBrowser.Zen also exists, I don't know if we can do something about there now being 2 IDs for the browser.

[sitiom]

Could we get that done in the CI by using the PAT from GH actions and specifying it's permissions?

No, you can't. The PAT is used to make a commit and create a PR from an external repo.

Sidenote, ZenBrowser.Zen also exists, I don't know if we can do something about there now being 2 IDs for the browser.

• Remove version: ZenBrowser.Zen version 1.0.0-a.26 microsoft/winget-pkgs#169157

[sitiom]

Issue: #37 (comment):

In a couple of days, I'll receive a mail with a physical key and I'll need to figure out how to use it

@mauro-balades How can you automate signing builds with a physical key?

I can't, I'll have to sign it and reupload

The workflow will pick up on the "unsigned" binary before you reupload it. Physical keys are incompatible with CI's. Perhaps you should have gone with the "Cloud" solution with Certum or Azure Trusted Signing from Microsoft.

As a workaround, maybe the workflow should create a draft release first and then publish it altogether once you've signed the binaries?

[Zykkl]

Would using on: release avoid/fix the issue? So rather than it running with the main pipeline, it would run by itself whenever a new release is out. (Example https://github.com/microsoft/devhome/blob/94fde2349d7666575f28daf54451668f0acdbf4c/.github/workflows/winget-submission.yml#L3C1-L6C23).

[mauro-balades]

How would we sign it though? My license key is physical

[Zykkl]

The action would only run when you publish a release, so you'd still be able to sign your stuff

[mauro-balades]

I just want to get everything signed and working before expanding to more windows sites... But this will be merged