mirror of
https://github.com/microsoft/WSL.git
synced 2026-06-01 01:49:36 -05:00
946f2809f9
distributions.yml and modern-distributions.yml only check out the repo and run
python validators, so they get contents: read.
winget.yml runs on release: published and forwards a precomputed artifact URL
to wingetcreate using the WINGET_TOKEN secret (an external token). It does not
checkout the repo and does not call any GitHub API endpoint, so it gets
permissions: {} (no scopes needed).
This brings the three workflows in line with the other workflows in this repo
that already declare explicit permissions.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
33 lines
1.1 KiB
YAML
33 lines
1.1 KiB
YAML
name: Publish to WinGet
|
|
|
|
on:
|
|
release:
|
|
types: [released]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
publish:
|
|
if: github.event.release.prerelease == false
|
|
runs-on: windows-latest # Action can only run on Windows
|
|
steps:
|
|
- name: Publish WSL
|
|
run: |
|
|
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$assets = '${{ toJSON(github.event.release.assets) }}' | ConvertFrom-Json
|
|
$wingetRelevantAssetx64 = $assets | Where-Object { $_.name -like '*x64.msi' } | Select-Object -First 1
|
|
$wingetRelevantAssetARM64 = $assets | Where-Object { $_.name -like '*arm64.msi' } | Select-Object -First 1
|
|
|
|
$version = "${{ github.event.release.tag_name }}"
|
|
|
|
$wingetx64URL = $wingetRelevantAssetx64.browser_download_url
|
|
$wingetARM64URL = $wingetRelevantAssetARM64.browser_download_url
|
|
|
|
$wingetPackageId = "Microsoft.WSL"
|
|
|
|
& curl.exe -JLO https://aka.ms/wingetcreate/latest
|
|
& .\wingetcreate.exe update $wingetPackageId -s -v $version -u "$wingetx64URL|x64" "$wingetARM64URL|arm64" -t "${{ secrets.WINGET_TOKEN }}"
|