Add WinGet auto-publish workflow

[jschick04]

Adds a GitHub Actions workflow that publishes new releases to the Windows Package Manager (winget) using Microsoft's wingetcreate tool.

• Triggers on release: [released] (fires when a draft is published as a full stable release) plus workflow_dispatch for manual runs.
• Submits the single multi-architecture .msixbundle; wingetcreate reads both the x64 and arm64 packages from the one file.
• Reads the WINGET_TOKEN repo secret via WINGET_CREATE_GITHUB_TOKEN.

Mirrors the pattern in microsoft/terminal's .github/workflows/winget.yml.

[Copilot]

Pull request overview

Adds an automated GitHub Actions workflow to publish new stable releases of EventLogExpert to the Windows Package Manager (WinGet) using Microsoft’s wingetcreate tool, aligning with the intended release-to-distribution flow.

Changes:

• Introduces a new release: [released]-triggered workflow (plus workflow_dispatch) for WinGet publishing.
• Resolves the version to submit (manual input, release tag, or latest release) and submits a .msixbundle URL via wingetcreate.
• Uses a repository secret (WINGET_TOKEN) mapped to WINGET_CREATE_GITHUB_TOKEN for creating the PR in microsoft/winget-pkgs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jschick04]

Addressed all three review comments in e48b94c:

1. Manual input v-stripping — the workflow_dispatch version input is now normalized with -replace '^v', '', same as the release-tag path, so v26.7.10.1209 and 26.7.10.1209 both work.
2. Conditional auth header — the releases/latest fallback only attaches Authorization when WINGET_CREATE_GITHUB_TOKEN is non-empty; otherwise it makes an anonymous request (the repo is public).
3. Signature verification — wingetcreate.exe is downloaded to a fixed filename and its Authenticode signature is validated (Status = Valid and signer CN=Microsoft Corporation) before execution.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

[jschick04]

Second review pass addressed in d75bb89:

1. inputs context on release triggers — switched to ${{ github.event.inputs.version }}, which safely resolves to empty when the workflow runs from a release event.
2. Hard-coded repo — the releases/latest API call and the .msixbundle download URL now use ${{ github.repository }}.
3. Version validation — the resolved version must match ^\d+(\.\d+){1,3}$ (dotted-numeric, v already stripped) before the download URL is built or wingetcreate is invoked.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

[jschick04]

Third review pass — two addressed in f78c29f, one intentionally kept:

1. Native exit codes (L62) — added -f to the wingetcreate.exe download and explicit $LASTEXITCODE checks after both the download and the wingetcreate update call, so native-command failures fail the step immediately with a clear message.
2. Pre-release guard (L30) — added a job-level guard: if: ${{ github.event_name != 'release' || github.event.release.prerelease == false }}. This makes the stable-only intent explicit and future-proofs it if the trigger is ever broadened.
3. released vs published (L9) — keeping released deliberately. microsoft/terminal uses published because it also ships pre-releases to a separate .Preview package; EventLogExpert has no preview package. released fires precisely when a draft is published as a stable release and never for pre-releases, which is exactly the intended behavior — so published would add pre-release noise that we'd then have to filter back out.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[jschick04]

Fourth review pass addressed in 40f2ed5:

1. Fail fast on missing token (L56) — added an early check that throws a clear, actionable error when WINGET_TOKEN (via WINGET_CREATE_GITHUB_TOKEN) is empty, before any version resolution or submission.
2. Comment/behavior alignment (L7) — reworded the release-trigger comment so it no longer contradicts the pre-release guard: released doesn't fire for pre-releases, and the job-level guard enforces stable-only as belt-and-suspenders.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[jschick04]

Fifth pass addressed in f56a51b: switched the releases/latest fallback Authorization header from Bearer to the token scheme, which is the conventional form for classic PATs.

For the record, both schemes are accepted by the GitHub REST API for classic PATs (only JWTs require Bearer), so this was a convention/clarity change rather than a functional bug — the fallback would have worked either way.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[jschick04]

Sixth pass addressed in 9071ca7:

1. Script-injection hardening (L48) — github.event.inputs.version and github.event.release.tag_name are now passed via step-level env: vars (INPUT_VERSION / RELEASE_TAG) and read as $env: values, so no event data is interpolated into the script body.
2. Pinned runner (L32) — runs-on is now windows-2022, matching PullRequest.yml.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 5 comments.

[jschick04]

Seventh pass — four applied in d46708c, one intentionally declined:

1. Least-privilege token (L38/L56) — the releases/latest lookup now uses the ephemeral job GITHUB_TOKEN (contents: read) via GH_API_TOKEN; the WINGET_TOKEN PAT is now used only by wingetcreate for the submission.
2. Guard robustness (L31) — switched to github.event.release.prerelease != true.
3. Comment accuracy (L48) — clarified that only the event-supplied version values are env-passed, and that github.repository is a trusted, non-user-controlled context value.
4. Pin wingetcreate (L72) — declined, by design. This mirrors microsoft/terminal's own winget workflow, which also pulls https://aka.ms/wingetcreate/latest. Using latest is deliberate: it guarantees the tool emits the current manifest schema (pinning an old version risks winget-pkgs rejecting a stale schema). The supply-chain concern is already mitigated by the Authenticode signature check (must be Valid and signed by CN=Microsoft Corporation) before the binary runs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[jschick04]

Eighth pass:

1. Four-component version (L66) — tightened the validation regex to ^\d+(\.\d+){3}$ and updated the error message. EventLogExpert releases are always four-part (e.g. 26.7.10.1209), so shorter inputs now fail fast instead of constructing a bundle URL that cannot exist.
2. Pin wingetcreate (L76) — this repeats pass 7's L72; declining for the same reasons: it mirrors microsoft/terminal's own winget workflow, latest guarantees the current manifest schema (pinning risks winget-pkgs rejecting a stale schema), and the binary is Authenticode-verified as Microsoft-signed before it runs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[ryanriesMSFT]

👍