Publish on WinGet and Chocolatey - #7
Open
Kenshin9977 wants to merge 6 commits into
Open
Conversation
added 6 commits
July 28, 2026 22:38
WinGet gets Setup.exe with user scope declared, because that is where Velopack actually installs. Chocolatey gets the portable zip: it runs elevated, so Setup.exe there would install into the administrator's profile and be invisible to whoever typed the command. Both jobs no-op with a warning when their secret is missing, so releases keep working before the accounts exist. The first submission to each is manual and documented in docs/packaging.md. Neither channel will accept this repository as it stands: there is no LICENSE file, and both require one. The manifests assume MIT; confirm or change it.
Without one, redistribution is not permitted by default, which is exactly what WinGet and Chocolatey do. Both require the field the manifests here already set.
It takes a plain signed EXE hosted by us, so no repackaging is needed. The field that catches people is the silent switch: the Store runs the installer unattended and a setup that opens a window fails certification.
The Microsoft Store runs the installer unattended and fails certification if it opens a window. WinGet needs the same. Both were documented as a manual field to fill in; this checks the claim on every release by installing and uninstalling for real. Testing this on usbscope turned up a Velopack trap worth catching here too: the installer runs the app once at install and once at uninstall with a --veloapp-* argument, so an app that ignores them starts its tray icon in the middle of a silent install.
The Store certifies one binary and distributes it. An app that replaces itself afterwards is running code the Store never reviewed, and leaves the listing describing a version nobody is running. So the store build asks the Store to be the update channel and stays out of it. Same code, one flag. The ordinary build is untouched and still self-updates, which is what WinGet, Chocolatey and the download link keep getting. CI installs both channels for real on every release, so neither can quietly stop being silent, and the store one fails the build if its marker is absent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds WinGet and Chocolatey publishing, mirroring what usbscope now does.
The two channels get different artifacts
Velopack installs per user and updates itself. Chocolatey runs elevated, so
Setup.exethere would install into the administrator's profile and be invisible to whoever typed the command.Setup.exechoco upgradeAdds the MIT licence
This repository had none. Without a licence, redistribution is not permitted by default, which is exactly what both channels do: WinGet requires the
Licensefield and Chocolatey checkslicenseUrl. MIT, matching the other public projects here.Safe before the accounts exist
Both jobs warn and exit clean when their secret is missing, so releases keep working. The Chocolatey job still packs, so a broken package fails the run rather than a user's install.
The first submission to each channel is manual and documented in
docs/packaging.md.Verified
actionlintclean. The diff torelease.ymlis additions only, no lines removed.