sigit-code 1.6.7__tar.gz → 1.6.8__tar.gz

sigit_code-1.6.8/.github/workflows/release-winget.yml

@@ -0,0 +1,320 @@
+name: winget Release
+
+# Dispatched by release-github.yml once the release and its checksums exist.
+#
+# winget manifests live in microsoft/winget-pkgs, and `wingetcreate update`
+# only works on a package that is already there. So this workflow branches:
+#
+#   - package already in winget-pkgs -> `wingetcreate update`, which rewrites
+#     the URLs and re-hashes the installers for us.
+#   - package not there yet -> render the manifests in packaging/winget/ and
+#     `wingetcreate submit` them as a new package.
+#
+# The second path only runs once, but keeping it here means a first release
+# does not need someone to sit at a Windows box running `wingetcreate new`
+# interactively.
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v1.5.2)"
+        required: true
+
+concurrency:
+  # A re-pushed or re-dispatched tag fires this a second time. Queue the
+  # duplicate behind the original instead of cancelling it: cancelling a run
+  # mid-publish can leave a channel half-uploaded, whereas a queued duplicate
+  # just hits the "already published" check and exits clean.
+  group: ${{ github.workflow }}-${{ github.event.inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  REPO: getsigit/sigit
+  PACKAGE_IDENTIFIER: getSigit.siGitCode
+
+jobs:
+  submit-winget-manifest:
+    name: Submit winget manifest
+    # wingetcreate is a Windows-only tool.
+    runs-on: windows-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Resolve tag, version and release date
+        id: release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          VERSION="${TAG#v}"
+          # wingetcreate wants ReleaseDate as YYYY-MM-DD.
+          DATE=$(gh release view "$TAG" --repo "$REPO" --json publishedAt --jq '.publishedAt[0:10]')
+
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "date=${DATE}" >> "$GITHUB_OUTPUT"
+
+      - name: Check whether the package is already in winget-pkgs
+        id: exists
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # manifests are filed under the lowercased first letter of the
+          # publisher, e.g. manifests/g/getSigit/siGitCode.
+          PUBLISHER="${PACKAGE_IDENTIFIER%%.*}"
+          NAME="${PACKAGE_IDENTIFIER#*.}"
+          FIRST=$(echo "${PUBLISHER:0:1}" | tr '[:upper:]' '[:lower:]')
+          PATH_IN_REPO="manifests/${FIRST}/${PUBLISHER}/${NAME}"
+
+          if gh api "repos/microsoft/winget-pkgs/contents/${PATH_IN_REPO}" >/dev/null 2>&1; then
+            echo "Found ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting an update."
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting it as a new package."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Render manifests for a first submission
+        if: steps.exists.outputs.found == 'false'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ steps.release.outputs.tag }}"
+          VERSION="${{ steps.release.outputs.version }}"
+
+          mkdir -p artifacts manifests
+
+          gh release download "$TAG" \
+            --repo "$REPO" \
+            --pattern "sigit-win-*.exe.sha256" \
+            --dir artifacts/
+
+          # The schema wants 64 hex characters; the community validation
+          # pipeline writes them uppercase, so match that.
+          SHA_AMD64=$(tr -d '[:space:]' < artifacts/sigit-win-amd64.exe.sha256 | tr '[:lower:]' '[:upper:]')
+          SHA_ARM64=$(tr -d '[:space:]' < artifacts/sigit-win-arm64.exe.sha256 | tr '[:lower:]' '[:upper:]')
+
+          RELEASE_DATE="${{ steps.release.outputs.date }}"
+
+          for template in packaging/winget/*.yaml.in; do
+            out="manifests/$(basename "$template" .in)"
+            sed \
+              -e "s|@VERSION@|${VERSION}|g" \
+              -e "s|@TAG@|${TAG}|g" \
+              -e "s|@REPO@|${REPO}|g" \
+              -e "s|@SHA_AMD64@|${SHA_AMD64}|g" \
+              -e "s|@SHA_ARM64@|${SHA_ARM64}|g" \
+              -e "s|@RELEASE_DATE@|${RELEASE_DATE}|g" \
+              "$template" > "$out"
+
+            echo "--- ${out} ---"
+            cat "$out"
+          done
+
+      - name: Download wingetcreate
+        shell: pwsh
+        run: Invoke-WebRequest -Uri "https://aka.ms/wingetcreate/latest" -OutFile wingetcreate.exe
+
+      # winget-pkgs convention: file the "please add/update this package"
+      # Package Request issue *first*, then open the manifest PR that fulfils
+      # it with "Resolves #N". Doing it the other way round (PR first, issue
+      # after) reads as "here's a request, and here's the PR that already did
+      # it", posted seconds apart.
+      #
+      # The issue and the PR are authored by two separate PATs, configured as
+      # the repo secrets WINGET_ISSUE_TOKEN (the Package Request issue) and
+      # WINGET_PR_TOKEN (the manifest PR). Both need public_repo scope on
+      # microsoft/winget-pkgs (fork + open issues/PRs). WINGET_PR_TOKEN
+      # replaces the old single WINGET_TOKEN.
+      - name: File the winget Package Request issue
+        id: issue
+        shell: bash
+        env:
+          # Authored by the issue account for this repo.
+          GH_TOKEN: ${{ secrets.WINGET_ISSUE_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "WINGET_ISSUE_TOKEN is not set. It needs a PAT (public_repo) for the account that should author the Package Request issue." >&2
+            exit 1
+          fi
+
+          VERSION="${{ steps.release.outputs.version }}"
+          TAG="${{ steps.release.outputs.tag }}"
+
+          # The release assets, same URLs the update step feeds wingetcreate.
+          BASE="https://github.com/${REPO}/releases/download/${TAG}"
+          INSTALLER_AMD64="${BASE}/sigit-win-amd64.exe"
+          INSTALLER_ARM64="${BASE}/sigit-win-arm64.exe"
+
+          # winget-pkgs' Package Request is an issue *form*
+          # (.github/ISSUE_TEMPLATE/package_request.yml): the title must be
+          # "[Package Request]: ..." and the body has to carry the labelled
+          # fields below (Installer Url especially — without it a maintainer
+          # just replies "please provide the installer link"). A free-text
+          # body lands as Needs-Triage and can't be acted on.
+          ISSUE_BODY=$(cat <<EOF
+          Download Page Url: https://github.com/${REPO}/releases/tag/${TAG}
+          Publisher: getSigit
+          Package Name: siGit Code
+          Description: siGit Code, an AI coding agent that runs on your machine.
+          Package Version: ${VERSION}
+          Installer Url: ${INSTALLER_AMD64}
+          Installer Url: ${INSTALLER_ARM64}
+          EOF
+          )
+
+          ISSUE_URL=$(gh issue create \
+            --repo microsoft/winget-pkgs \
+            --title "[Package Request]: ${PACKAGE_IDENTIFIER} ${VERSION}" \
+            --body "$ISSUE_BODY")
+
+          echo "Opened issue ${ISSUE_URL}"
+          echo "issue_url=${ISSUE_URL}" >> "$GITHUB_OUTPUT"
+          echo "issue_number=${ISSUE_URL##*/}" >> "$GITHUB_OUTPUT"
+
+      - name: Submit new package
+        id: submit_new
+        if: steps.exists.outputs.found == 'false'
+        shell: pwsh
+        env:
+          # wingetcreate reads the token from this variable. Passing it as
+          # --token instead makes the tool warn that the token can end up in
+          # logs, which on a shared runner is not a warning worth ignoring.
+          # This is the PR-author account for this repo (see mapping above).
+          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_PR_TOKEN }}
+        run: |
+          if (-not $env:WINGET_CREATE_GITHUB_TOKEN) {
+            Write-Error "WINGET_PR_TOKEN is not set. It needs a PAT with public_repo scope so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR."
+          }
+
+          $version = "${{ steps.release.outputs.version }}"
+
+          # Tee stdout so we can scrape the PR URL afterwards. wingetcreate
+          # prints "Pull request can be found here: <url>" on success, and
+          # that line is the only handle we get on the PR it just opened.
+          # --no-open because the runner has no browser to open the PR in.
+          .\wingetcreate.exe submit manifests `
+            --prtitle "New package: $env:PACKAGE_IDENTIFIER version $version" `
+            --no-open 2>&1 | Tee-Object -Variable output
+
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "wingetcreate submit failed with exit code $LASTEXITCODE"
+          }
+
+          $match = [regex]::Match(($output -join "`n"), 'https://github\.com/microsoft/winget-pkgs/pull/(\d+)')
+          if ($match.Success) {
+            "pr_url=$($match.Value)"   | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+            "pr_number=$($match.Groups[1].Value)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+          } else {
+            Write-Warning "Could not find the PR URL in wingetcreate output; skipping issue linking."
+          }
+
+      - name: Submit manifest update
+        id: submit_update
+        if: steps.exists.outputs.found == 'true'
+        shell: pwsh
+        env:
+          # PR-author account for this repo (see mapping above).
+          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_PR_TOKEN }}
+        run: |
+          if (-not $env:WINGET_CREATE_GITHUB_TOKEN) {
+            Write-Error "WINGET_PR_TOKEN is not set. It needs a PAT with public_repo scope so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR."
+          }
+
+          $tag = "${{ steps.release.outputs.tag }}"
+          $version = "${{ steps.release.outputs.version }}"
+          $base = "https://github.com/${env:REPO}/releases/download/$tag"
+
+          # The trailing |x64 and |arm64 tell wingetcreate which installer
+          # entry each URL replaces. Without them it guesses from the file
+          # name, and "sigit-win-amd64.exe" is not a spelling it recognises.
+          .\wingetcreate.exe update $env:PACKAGE_IDENTIFIER `
+            --version $version `
+            --urls "$base/sigit-win-amd64.exe|x64" "$base/sigit-win-arm64.exe|arm64" `
+            --release-notes-url "https://github.com/${env:REPO}/releases/tag/$tag" `
+            --release-date "${{ steps.release.outputs.date }}" `
+            --prtitle "Update $env:PACKAGE_IDENTIFIER to version $version" `
+            --submit `
+            --no-open 2>&1 | Tee-Object -Variable output
+
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "wingetcreate failed with exit code $LASTEXITCODE"
+          }
+
+          $match = [regex]::Match(($output -join "`n"), 'https://github\.com/microsoft/winget-pkgs/pull/(\d+)')
+          if ($match.Success) {
+            "pr_url=$($match.Value)"   | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+            "pr_number=$($match.Groups[1].Value)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+          } else {
+            Write-Warning "Could not find the PR URL in wingetcreate output; skipping issue linking."
+          }
+
+      # wingetcreate has no --prbody flag (only --prtitle), so it always opens
+      # the PR with the winget-pkgs template: an empty Description and an
+      # unticked "Linked to an issue" box next to a "Resolves #[Issue Number]"
+      # placeholder. The issue already exists (filed first, above), so this
+      # step just rewrites the body to point the PR at it with "Resolves #N".
+      #
+      # This must run as the PR author (WINGET_PR_TOKEN) — the account that
+      # opened the PR via wingetcreate — since only the author (or a repo
+      # maintainer) can edit it.
+      - name: Set the winget PR body and link the issue
+        id: link
+        if: >-
+          (steps.submit_new.outputs.pr_number != '') ||
+          (steps.submit_update.outputs.pr_number != '')
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.WINGET_PR_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          PR_URL="${{ steps.submit_new.outputs.pr_url || steps.submit_update.outputs.pr_url }}"
+          ISSUE_NUMBER="${{ steps.issue.outputs.issue_number }}"
+          VERSION="${{ steps.release.outputs.version }}"
+          TAG="${{ steps.release.outputs.tag }}"
+
+          if [ -n "$ISSUE_NUMBER" ]; then
+            CHECKBOX="- [x] Linked to an issue (if applicable)"
+            RESOLVES="- Resolves #${ISSUE_NUMBER}"
+          else
+            CHECKBOX="- [ ] Linked to an issue (if applicable)"
+            RESOLVES=""
+          fi
+
+          if [ "${{ steps.exists.outputs.found }}" = "false" ]; then
+            DESC="Adds ${PACKAGE_IDENTIFIER} version ${VERSION} from ${TAG}."
+          else
+            DESC="Updates ${PACKAGE_IDENTIFIER} to version ${VERSION} from ${TAG}."
+          fi
+
+          # Mirrors the current .github/PULL_REQUEST_TEMPLATE.md; keep the
+          # checklist items in sync with it (e.g. the 1.12 schema line).
+          BODY=$(cat <<EOF
+          ## 📖 Description
+          ${DESC}
+          ## ✅ Checklist
+          - [x] Signed the [Contributor License Agreement](https://cla.opensource.microsoft.com)
+          ${CHECKBOX}
+          ${RESOLVES}
+          ## 📦 Manifest Checklist
+          - [x] Checked that there aren't other open [pull requests](https://github.com/microsoft/winget-pkgs/pulls) for the same manifest update/change
+          - [x] This PR only modifies one (1) manifest
+          - [x] Validated manifest locally with \`winget validate --manifest <directory>\`
+          - [x] Tested manifest locally with \`winget install --manifest <directory>\`
+          - [x] Manifest conforms to the [1.12 schema](https://github.com/microsoft/winget-pkgs/tree/master/doc/manifest/schema/1.12.0)
+          EOF
+          )
+
+          gh pr edit "$PR_URL" --body "$BODY"
+          echo "Linked ${PR_URL} to issue #${ISSUE_NUMBER:-<none>}"

{sigit_code-1.6.7 → sigit_code-1.6.8}/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 1.6.8
+
+### Fixed
+
+- **A bare launch of `sigit.exe` on Windows exits 0 instead of bailing.** A
+  no-argument launch with a TTY stdin falls through to the non-Unix branch,
+  which has no TUI to start (the interactive client needs Unix-only fd
+  redirection). It now prints a short usage message pointing at ACP and
+  headless modes and exits 0, so winget's installer validator no longer reports
+  a `Validation-Executable-Error`.
+
+### Changed
+
+- **winget submissions link back to their Package Request issue.** The release
+  workflow scrapes the winget-pkgs PR URL from wingetcreate, opens a Package
+  Request issue on first submission, and rewrites the PR body to fill the
+  Description, tick the issue checkbox, and add `Resolves #NNN` — replacing the
+  manual per-PR edit that used to follow each release.
+- **The winget release workflow files its Package Request issue first and uses
+  two scoped tokens.** The Package Request issue is opened before the
+  winget-pkgs PR so the PR can reference it immediately, and issue creation and
+  PR submission now use separate tokens (`WINGET_ISSUE_TOKEN` and
+  `WINGET_PR_TOKEN`) rather than one shared token.
+
 ## 1.6.7
 
 ### Fixed

{sigit_code-1.6.7 → sigit_code-1.6.8}/Cargo.lock

@@ -5901,7 +5901,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.6.7"
+version = "1.6.8"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.6.7 → sigit_code-1.6.8}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.6.7"
+version = "1.6.8"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"

{sigit_code-1.6.7 → sigit_code-1.6.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.6.7
+Version: 1.6.8
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{sigit_code-1.6.7 → sigit_code-1.6.8}/src/main.rs

@@ -6245,7 +6245,26 @@ async fn main() -> anyhow::Result<()> {
         }
         #[cfg(not(unix))]
         {
-            anyhow::bail!("interactive mode requires Unix (macOS / Linux)");
+            // No TUI on non-Unix: the interactive full-screen client relies on
+            // fd redirection that only exists on Unix. A bare launch in a
+            // terminal (the common case, and exactly what the winget installer
+            // validator does — run `sigit.exe` with no arguments) therefore has
+            // nothing to do, so print how to use the binary and exit cleanly.
+            // Bailing here instead would return a non-zero exit code, which the
+            // validator reads as a failure (Validation-Executable-Error).
+            println!(
+                "siGit Code v{}\n\n\
+                 Interactive terminal mode is Unix-only (macOS / Linux). On this \
+                 platform sigit runs as an ACP agent for editor integration, or \
+                 non-interactively from a script:\n\n\
+                 \x20 sigit run \"<prompt>\"   run one prompt and exit\n\
+                 \x20 sigit --version        print the version\n\
+                 \x20 sigit login            sign in to siGit Code Cloud\n\n\
+                 Point your editor's ACP client at this binary to use it \
+                 interactively.",
+                env!("CARGO_PKG_VERSION")
+            );
+            Ok(())
         }
     } else {
         // ACP mode: keep stdout untouched for protocol JSON only.

sigit_code-1.6.7/.github/workflows/release-winget.yml

@@ -1,178 +0,0 @@
-name: winget Release
-
-# Dispatched by release-github.yml once the release and its checksums exist.
-#
-# winget manifests live in microsoft/winget-pkgs, and `wingetcreate update`
-# only works on a package that is already there. So this workflow branches:
-#
-#   - package already in winget-pkgs -> `wingetcreate update`, which rewrites
-#     the URLs and re-hashes the installers for us.
-#   - package not there yet -> render the manifests in packaging/winget/ and
-#     `wingetcreate submit` them as a new package.
-#
-# The second path only runs once, but keeping it here means a first release
-# does not need someone to sit at a Windows box running `wingetcreate new`
-# interactively.
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Release tag (e.g. v1.5.2)"
-        required: true
-
-concurrency:
-  # A re-pushed or re-dispatched tag fires this a second time. Queue the
-  # duplicate behind the original instead of cancelling it: cancelling a run
-  # mid-publish can leave a channel half-uploaded, whereas a queued duplicate
-  # just hits the "already published" check and exits clean.
-  group: ${{ github.workflow }}-${{ github.event.inputs.tag || github.ref_name }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-env:
-  REPO: getsigit/sigit
-  PACKAGE_IDENTIFIER: getSigit.siGitCode
-
-jobs:
-  submit-winget-manifest:
-    name: Submit winget manifest
-    # wingetcreate is a Windows-only tool.
-    runs-on: windows-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
-
-      - name: Resolve tag, version and release date
-        id: release
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          TAG="${{ github.event.inputs.tag }}"
-          VERSION="${TAG#v}"
-          # wingetcreate wants ReleaseDate as YYYY-MM-DD.
-          DATE=$(gh release view "$TAG" --repo "$REPO" --json publishedAt --jq '.publishedAt[0:10]')
-
-          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "date=${DATE}" >> "$GITHUB_OUTPUT"
-
-      - name: Check whether the package is already in winget-pkgs
-        id: exists
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          # manifests are filed under the lowercased first letter of the
-          # publisher, e.g. manifests/g/getSigit/siGitCode.
-          PUBLISHER="${PACKAGE_IDENTIFIER%%.*}"
-          NAME="${PACKAGE_IDENTIFIER#*.}"
-          FIRST=$(echo "${PUBLISHER:0:1}" | tr '[:upper:]' '[:lower:]')
-          PATH_IN_REPO="manifests/${FIRST}/${PUBLISHER}/${NAME}"
-
-          if gh api "repos/microsoft/winget-pkgs/contents/${PATH_IN_REPO}" >/dev/null 2>&1; then
-            echo "Found ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting an update."
-            echo "found=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "No ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting it as a new package."
-            echo "found=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Render manifests for a first submission
-        if: steps.exists.outputs.found == 'false'
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          TAG="${{ steps.release.outputs.tag }}"
-          VERSION="${{ steps.release.outputs.version }}"
-
-          mkdir -p artifacts manifests
-
-          gh release download "$TAG" \
-            --repo "$REPO" \
-            --pattern "sigit-win-*.exe.sha256" \
-            --dir artifacts/
-
-          # The schema wants 64 hex characters; the community validation
-          # pipeline writes them uppercase, so match that.
-          SHA_AMD64=$(tr -d '[:space:]' < artifacts/sigit-win-amd64.exe.sha256 | tr '[:lower:]' '[:upper:]')
-          SHA_ARM64=$(tr -d '[:space:]' < artifacts/sigit-win-arm64.exe.sha256 | tr '[:lower:]' '[:upper:]')
-
-          RELEASE_DATE="${{ steps.release.outputs.date }}"
-
-          for template in packaging/winget/*.yaml.in; do
-            out="manifests/$(basename "$template" .in)"
-            sed \
-              -e "s|@VERSION@|${VERSION}|g" \
-              -e "s|@TAG@|${TAG}|g" \
-              -e "s|@REPO@|${REPO}|g" \
-              -e "s|@SHA_AMD64@|${SHA_AMD64}|g" \
-              -e "s|@SHA_ARM64@|${SHA_ARM64}|g" \
-              -e "s|@RELEASE_DATE@|${RELEASE_DATE}|g" \
-              "$template" > "$out"
-
-            echo "--- ${out} ---"
-            cat "$out"
-          done
-
-      - name: Download wingetcreate
-        shell: pwsh
-        run: Invoke-WebRequest -Uri "https://aka.ms/wingetcreate/latest" -OutFile wingetcreate.exe
-
-      - name: Submit new package
-        if: steps.exists.outputs.found == 'false'
-        shell: pwsh
-        env:
-          # wingetcreate reads the token from this variable. Passing it as
-          # --token instead makes the tool warn that the token can end up in
-          # logs, which on a shared runner is not a warning worth ignoring.
-          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
-        run: |
-          if (-not $env:WINGET_CREATE_GITHUB_TOKEN) {
-            Write-Error "WINGET_TOKEN is not set. It needs a PAT with public_repo scope so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR."
-          }
-
-          $version = "${{ steps.release.outputs.version }}"
-
-          # --no-open because the runner has no browser to open the PR in.
-          .\wingetcreate.exe submit manifests `
-            --prtitle "New package: $env:PACKAGE_IDENTIFIER version $version" `
-            --no-open
-
-          if ($LASTEXITCODE -ne 0) {
-            Write-Error "wingetcreate submit failed with exit code $LASTEXITCODE"
-          }
-
-      - name: Submit manifest update
-        if: steps.exists.outputs.found == 'true'
-        shell: pwsh
-        env:
-          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
-        run: |
-          if (-not $env:WINGET_CREATE_GITHUB_TOKEN) {
-            Write-Error "WINGET_TOKEN is not set. It needs a PAT with public_repo scope so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR."
-          }
-
-          $tag = "${{ steps.release.outputs.tag }}"
-          $version = "${{ steps.release.outputs.version }}"
-          $base = "https://github.com/${env:REPO}/releases/download/$tag"
-
-          # The trailing |x64 and |arm64 tell wingetcreate which installer
-          # entry each URL replaces. Without them it guesses from the file
-          # name, and "sigit-win-amd64.exe" is not a spelling it recognises.
-          .\wingetcreate.exe update $env:PACKAGE_IDENTIFIER `
-            --version $version `
-            --urls "$base/sigit-win-amd64.exe|x64" "$base/sigit-win-arm64.exe|arm64" `
-            --release-notes-url "https://github.com/${env:REPO}/releases/tag/$tag" `
-            --release-date "${{ steps.release.outputs.date }}" `
-            --prtitle "Update $env:PACKAGE_IDENTIFIER to version $version" `
-            --submit `
-            --no-open
-
-          if ($LASTEXITCODE -ne 0) {
-            Write-Error "wingetcreate failed with exit code $LASTEXITCODE"
-          }