Skip to content

docs: step-by-step manual for creating WINGET_TOKEN #710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Matovidlo wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

docs: step-by-step manual for creating WINGET_TOKEN #710

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions docs/adr/0003-release-distribution-cicd.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,43 @@ retiring the git-HEAD risk.
Set with `gh secret set <NAME> --env release --repo keboola/cli` piping the value via
**stdin** (never argv); shred the temp file after.

#### Creating `WINGET_TOKEN` (step-by-step)

The `winget` release job (`.github/workflows/release-kbagent.yml`) needs a classic PAT
belonging to an **org-owned bot account** — never a personal token — because
`wingetcreate` forks `microsoft/winget-pkgs` and opens the PR as whoever owns the
token.

1. Get (or create) an org-owned GitHub bot account for this purpose — not a personal
account. It only needs to be a regular GitHub user; it does **not** need to be a
member of the `keboola` org or have any repo permissions here, since the token is
only ever used against the external `microsoft/winget-pkgs` repo.
Comment on lines +113 to +116
2. Sign in to GitHub as that bot account.
3. Go to **Settings → Developer settings → Personal access tokens → Tokens
(classic)** (`https://github.com/settings/tokens`).
4. Click **Generate new token (classic)**.
5. Name it something identifiable, e.g. `wingetcreate-keboola-cli2`.
6. Set an expiration per org security policy (rotate before it lapses — an expired
token fails the release job with an auth error, not a build error).
7. Under scopes, check **only** `public_repo`. Nothing else is needed.
8. Click **Generate token** and copy the value — GitHub shows it exactly once.
9. Store it as the repo secret, scoped to the `release` environment, piping the value
via stdin so it never lands in shell history:
```
gh secret set WINGET_TOKEN --env release --repo keboola/cli
```
Comment on lines +126 to +130
(paste the token, then Ctrl-D / Enter depending on your shell — see the `Set with`
line above for the general pattern).
10. Shred any temp file or clipboard copy of the token once it's set.

This alone does not turn the `winget` job green: as of this writing that job is
disabled (`if: false`) because `Keboola.KeboolaCLI2` has never had its **first**
submission to `microsoft/winget-pkgs` — `wingetcreate update` only bumps an existing
manifest, it can't create one. Someone with the token above still needs to run
`wingetcreate submit` once by hand (see the NOTE in the `winget:` job for what that
first manifest must set, e.g. `License: Apache-2.0`) before the automated per-release
`update` job can be re-enabled.

### Rollout

1. **P0** — npm-hook prebuilt wheel + PyPI (OIDC). Instant `uv`/`uvx`/`pipx` parity.
Expand Down