Good catch from the security bot! Fixed — added permissions: {} to the workflow since it only uses the custom PAT (WINGET_TOKEN) and does not need the default GITHUB_TOKEN at all. This follows the principle of least privilege.

Hey! I tried to reduce the setup work as much as possible on your end, but the PAT creation and adding the secret to the repo are things that only you as the repo owner can do — there is no way around that unfortunately. I hope the step-by-step instructions in the PR description are clear enough, but let me know if anything is confusing and I will be happy to help!

Also, the initial winget manifest PR is already submitted (linked above), so once that gets merged and you set up the token, future releases will be automatically published to winget with zero effort.

Really looking forward to being able to just winget install polrivero.GitHubDesktopPlus — would be super convenient! Thanks for maintaining this awesome project btw :)

Just a heads up: the Lint check is failing, but it's a pre-existing issue on main (Prettier complaining about app/src/lib/stores/app-store.ts). This PR only touches README.md and adds the workflow YAML — unrelated to the lint failure.

This sounds great! I've been thinking about adding my fork to winget, but I never got around to it because it seemed like a lot of work.
Looking at your changes it seems too easy. I suspect there will be a long submit+review process before we can just start shipping releases. At least that was the case when submitting the Linux build to Flathub.

• Edit: Never mind, I now see that you already submitted the manifest, maybe it really is that easy.

the Lint check is failing, but it's a pre-existing issue on main

Sorry about that, it should now be fixed.

@guplem You probably know quite a lot more about Winget than I do. Do you know if it supports automatic updates like all other package managers?
It seems like it doesn't (but maybe that information is outdated). If that's the case, we should add a mention of Winget-AutoUpdate or a similar tool in the README.

Yeah, you're right, winget doesn't have built-in automatic updates. Honestly, to me it's not something that bothers me much, it works like any other package manager where nothing updates until you explicitly ask for it (winget upgrade --all). I think that's a reasonable default tbh.

That said, if you do want automatic updates, Winget-AutoUpdate is definitely the go-to tool for that. What it does under the hood is basically set up a Windows scheduled task that runs winget upgrade every X hours/days, so your packages stay up to date in the background. It would be similar to just creating a scheduled task yourself in Task Scheduler that runs winget upgrade --all --silent on a schedule, but WAU wraps it up nicely with extra features like notifications, blacklists, etc.

Up to you if you want to mention it in the README

I somehow completely missed winget upgrade --all 🤦 I thought you had to manually upgrade each package independently.
In that case, we probably don't need to mention WAU in the readme, but we should add a note about making sure to run winget upgrade --all periodically to keep the app up to date.

The package has already been approved, and it is available in winget:

You can find it by searching it with winget search polrivero.GitHubDesktopPlus or winget search GitHubDesktopPlus.
Installing it is now as simple as running winget install polrivero.GitHubDesktopPlus.

Hey @pol-rivero! Here's a summary of what's still needed and the next steps to get winget updates automatically deployed:

What's already done

• The workflow file (.github/workflows/winget-publish.yml) is ready in this PR
• The initial winget manifest has been approved and merged — winget install polrivero.GitHubDesktopPlus already works
• Add a winget upgrade note to the README

What you (pol-rivero) need to do after merging

1. Create a GitHub PAT (classic) with the public_repo scope — go here to generate one
2. Add it as a repository secret named WINGET_TOKEN in this repo's Settings > Secrets and variables > Actions

Once those two steps are done, every future release will automatically trigger a PR to microsoft/winget-pkgs with the updated manifest — zero manual effort from that point on.

Once this is merged and the token is set up, it would be amazing if we could do a quick test release to make sure the whole pipeline works end-to-end. (I'm definitely not saying this just because #76 has some features I'm very eager to get my hands on)

That's great! Thank you for your great work :)

I'll try and do a release tonight if I have some time. First, I'd like to test some changes that will probably fix #82.