KofTwentyTwo/gclo
2
0 Fork 0
Code Issues 28 Pull Requests 1 Actions Packages Projects Releases 22 Wiki Activity

Owner setup checklist: publishing secrets + dev mode #7

New Issue
Open
opened 2026-07-03 13:59:24 +00:00 by KofTwentyTwo · 7 comments
KofTwentyTwo commented 2026-07-03 13:59:24 +00:00 (Migrated from github.com)
Copy link
Copy source

Things only the repo owner can do:

  • Add NUGET_API_KEY repo secret → enables NuGet publishing of gclo.Engine on stable tags.
  • Add WINGET_TOKEN repo secret (PAT with public repo scope for winget-pkgs fork PRs) → enables automated winget updates.
  • Add CHOCO_API_KEY repo secret (API key from a chocolatey.org account) → the release workflow pushes the gclo Chocolatey package on stable tags (#9); without it the package is packed but not pushed. The first push goes through Chocolatey moderation.
  • After each stable release, merge the generated "Packaging: Scoop and Chocolatey manifests" PR against main (then main back into dev) so scoop install gclo sees the release (#9).
  • One-time manual first winget submission (wingetcreate new after the first stable release) — CI automates subsequent versions.
  • (Optional) Add DEPS_PAT repo secret (fine-grained PAT: contents + pull-requests write) → the weekly NuGet updates PR (#52) gets its own CI checks; without it the gates run inside the workflow only.
  • (Optional, dev machine) Enable Windows Developer Mode for packaged F5/MSIX debugging — unpackaged runs and installed Velopack builds do not need it.
Things only the repo owner can do: - [ ] Add `NUGET_API_KEY` repo secret → enables NuGet publishing of gclo.Engine on stable tags. - [ ] Add `WINGET_TOKEN` repo secret (PAT with public repo scope for winget-pkgs fork PRs) → enables automated winget updates. - [ ] Add `CHOCO_API_KEY` repo secret (API key from a chocolatey.org account) → the release workflow pushes the `gclo` Chocolatey package on stable tags (#9); without it the package is packed but not pushed. The first push goes through Chocolatey moderation. - [ ] After each stable release, merge the generated "Packaging: Scoop and Chocolatey manifests" PR against `main` (then `main` back into `dev`) so `scoop install gclo` sees the release (#9). - [ ] One-time manual first winget submission (`wingetcreate new` after the first stable release) — CI automates subsequent versions. - [ ] (Optional) Add `DEPS_PAT` repo secret (fine-grained PAT: contents + pull-requests write) → the weekly NuGet updates PR (#52) gets its own CI checks; without it the gates run inside the workflow only. - [ ] (Optional, dev machine) Enable Windows Developer Mode for packaged F5/MSIX debugging — unpackaged runs and installed Velopack builds do not need it.
KofTwentyTwo commented 2026-07-05 22:13:59 +00:00 (Migrated from github.com)
Copy link
Copy source

Now that v1.0.0 stable is published, these owner-only steps enable the remaining publish channels:

The v1.0.0 release itself is complete without these; they just add the winget/NuGet distribution channels.

Now that **v1.0.0 stable** is published, these owner-only steps enable the remaining publish channels: - **`WINGET_TOKEN`** secret + a one-time manual first submission: \`winget install wingetcreate\` then \`wingetcreate new https://github.com/KofTwentyTwo/gclo/releases/download/v1.0.0/gclo-stable-Setup.exe\` → submit the PR to microsoft/winget-pkgs. After that, the release workflow auto-updates winget on every stable tag. - **`NUGET_API_KEY`** secret (optional): enables pushing \`gclo.Engine\` to nuget.org on stable tags. The v1.0.0 release itself is complete without these; they just add the winget/NuGet distribution channels.
KofTwentyTwo commented 2026-10-09 22:42:49 +00:00 (Migrated from github.com)
Copy link
Copy source

Updated requirements with #76 (release through the shared Velopack workflow; publishers fail instead of skip). Everything goes in the release environment (exists now; deployment rule: tags v*), not repository secrets:

Item Where Needed for
DEPS_PAT environment secret: fine-grained token, this repository, contents + pull requests write, ≤ 90 days the packaging PR (bucket/gclo.json + Chocolatey) must trigger required checks
CHOCO_API_KEY environment secret (chocolatey.org account → API key) choco push on every stable release
WINGET_TOKEN environment secret: fine-grained token that can fork + open PRs on public repos, ≤ 90 days wingetcreate update on every stable release
WINGET_PACKAGE_ID = KofTwentyTwo.gclo repository variable, set after the one-time manual wingetcreate new (docs/RELEASING.md) same
NUGET_PUBLISH = true + NUGET_API_KEY variable + environment secret, only if gclo.Engine should go to nuget.org optional

Until these exist, the stable-only publishing jobs fail by design (and can be re-run alone once the values are added). Prerelease tags need none of them.

Updated requirements with #76 (release through the shared Velopack workflow; publishers fail instead of skip). Everything goes in the **`release` environment** (exists now; deployment rule: tags `v*`), not repository secrets: | Item | Where | Needed for | | --- | --- | --- | | `DEPS_PAT` | environment secret: fine-grained token, this repository, contents + pull requests write, ≤ 90 days | the packaging PR (`bucket/gclo.json` + Chocolatey) must trigger required checks | | `CHOCO_API_KEY` | environment secret (chocolatey.org account → API key) | `choco push` on every stable release | | `WINGET_TOKEN` | environment secret: fine-grained token that can fork + open PRs on public repos, ≤ 90 days | `wingetcreate update` on every stable release | | `WINGET_PACKAGE_ID` = `KofTwentyTwo.gclo` | repository **variable**, set after the one-time manual `wingetcreate new` (docs/RELEASING.md) | same | | `NUGET_PUBLISH` = `true` + `NUGET_API_KEY` | variable + environment secret, only if gclo.Engine should go to nuget.org | optional | Until these exist, the stable-only publishing jobs fail by design (and can be re-run alone once the values are added). Prerelease tags need none of them.
KofTwentyTwo commented 2026-10-09 23:03:03 +00:00 (Migrated from github.com)
Copy link
Copy source

Correction to the table above after the winget discussion: winget is the one channel switched on explicitly. The job runs only once the repository variable WINGET_PACKAGE_ID is set (after the manual wingetcreate new with the first stable installer); from then on a missing WINGET_TOKEN fails it. So the first stable release (v1.0.1) is fully green with just DEPS_PAT and CHOCO_API_KEY in the release environment; bootstrap winget from its gclo-stable-Setup.exe afterwards.

Correction to the table above after the winget discussion: `winget` is the one channel switched on explicitly. The job runs only once the repository variable `WINGET_PACKAGE_ID` is set (after the manual `wingetcreate new` with the first stable installer); from then on a missing `WINGET_TOKEN` fails it. So the first stable release (v1.0.1) is fully green with just `DEPS_PAT` and `CHOCO_API_KEY` in the `release` environment; bootstrap winget from its `gclo-stable-Setup.exe` afterwards.
KofTwentyTwo commented 2026-10-10 12:45:52 +00:00 (Migrated from github.com)
Copy link
Copy source

DEPS_PAT is now set in the release environment (fine-grained token, verified against the repository API). Still needed before the first stable tag: CHOCO_API_KEY. The v1.0.1-beta.2 rehearsal needs nothing further.

`DEPS_PAT` is now set in the `release` environment (fine-grained token, verified against the repository API). Still needed before the first stable tag: `CHOCO_API_KEY`. The `v1.0.1-beta.2` rehearsal needs nothing further.
KofTwentyTwo commented 2026-10-10 12:51:34 +00:00 (Migrated from github.com)
Copy link
Copy source

CHOCO_API_KEY is now in the release environment as well. The stable path has every token it needs; winget stays off until WINGET_PACKAGE_ID is set after the manual first submission.

`CHOCO_API_KEY` is now in the `release` environment as well. The stable path has every token it needs; winget stays off until `WINGET_PACKAGE_ID` is set after the manual first submission.
KofTwentyTwo commented 2026-10-10 17:17:49 +00:00 (Migrated from github.com)
Copy link
Copy source

Token changes after v1.0.1 (#85 / PR #86): the release workflow no longer uses DEPS_PAT (only
uget-updates.yml still does, optionally). The packages job now needs a release GitHub App: repository variable RELEASE_APP_CLIENT_ID and
elease-environment secret RELEASE_APP_PRIVATE_KEY (App installed only on this repo, Contents + Pull requests write, no bypass). CHOCO_API_KEY is set and worked for 1.0.1. Still open: winget (WINGET_TOKEN + WINGET_PACKAGE_ID after the manual wingetcreate new), NUGET_API_KEY if NuGet publishing is switched on.

Token changes after v1.0.1 (#85 / PR #86): the release workflow no longer uses DEPS_PAT (only uget-updates.yml still does, optionally). The packages job now needs a release GitHub App: repository variable RELEASE_APP_CLIENT_ID and elease-environment secret RELEASE_APP_PRIVATE_KEY (App installed only on this repo, Contents + Pull requests write, no bypass). CHOCO_API_KEY is set and worked for 1.0.1. Still open: winget (WINGET_TOKEN + WINGET_PACKAGE_ID after the manual wingetcreate new), NUGET_API_KEY if NuGet publishing is switched on.
KofTwentyTwo commented 2026-10-11 12:45:29 +00:00 (Migrated from github.com)
Copy link
Copy source

Chocolatey: gclo 1.0.1 passed automated validation and verification on 2026-10-10 and is waiting for a human moderator. Until it is approved or rejected, chocolatey.org returns HTTP 403 for any further push of this package (one version in the queue while there is no approved version), which is why the v1.1.0 packages job failed at the push. Once 1.0.1 is reviewed: re-run the failed 'Scoop and Chocolatey' job of run 38138151291 (https://github.com/KofTwentyTwo/gclo/actions/runs/38138151291) to push 1.1.0; the Scoop manifest is already at 1.1.0 on main (#123).

Chocolatey: gclo 1.0.1 passed automated validation and verification on 2026-10-10 and is waiting for a human moderator. Until it is approved or rejected, chocolatey.org returns HTTP 403 for any further push of this package (one version in the queue while there is no approved version), which is why the v1.1.0 packages job failed at the push. Once 1.0.1 is reviewed: re-run the failed 'Scoop and Chocolatey' job of run 38138151291 (https://github.com/KofTwentyTwo/gclo/actions/runs/38138151291) to push 1.1.0; the Scoop manifest is already at 1.1.0 on main (#123).
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
.NET
Pull requests that update .NET code
 bug
Something isn't working
 deferred
Agreed follow-up, not scheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on an action only the owner can take
 priority
Owner-flagged: work this first
 quality
Standards, simplicity, enforcement
 question
Further information is requested
 refactor
Restructuring without behavior change
 release
Release pipeline / distribution
 wontfix
This will not be worked on
No labels needs-owner
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#7