Automate Winget manifest submission on release#1263
Conversation
Add winget-publish.yml workflow that triggers on release: published (same event as PyPI publish) and uses vedantmgoyal9/winget-releaser to submit an updated manifest PR to microsoft/winget-pkgs automatically. The workflow skips the rolling 'latest' tag, uses harden-runner with egress blocking, and pins all actions to commit SHAs following the project's existing security pattern. Requires a WINGET_TOKEN secret (GitHub PAT with public_repo scope) to be set in repository settings. https://claude.ai/code/session_01Sf3iaNmGSZ7UAhFrXZRYzi
Add Winget Community Repository (A-09) and WINGET_TOKEN PAT (A-10) as new assets, with three new dataflows: DF-27 (CI manifest PR submission), DF-28 (consumer winget install), and DF-29 (MSI download via winget). New threats: - DFT-34: Long-lived stored PAT enables persistent publish rights after exfiltration (unlike OIDC's short-lived tokens used for PyPI) - DFT-35: Compromised PAT enables malicious installer URL injection via manifest PR (Winget distributes references to binaries, not binaries directly, so an attacker can craft a valid-hash PR for a trojanised MSI) New controls: - C-041: Winget manifest PRs reviewed by microsoft/winget-pkgs maintainers - C-042: WINGET_TOKEN scoped to dedicated 'winget' GitHub environment Regenerated doc/explanation/threat_model_supply_chain.rst from source. https://claude.ai/code/session_01Sf3iaNmGSZ7UAhFrXZRYzi
|
Warning Review limit reached
More reviews will be available in 49 minutes and 15 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughAdds a GitHub Actions workflow ( ChangesWinget Publishing and Threat Model
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/winget-publish.yml:
- Around line 10-16: The publish job in the winget-publish.yml workflow lacks a
concurrency setting, which allows overlapping executions (from re-runs or
concurrent release.published events) to create competing Winget manifest PR
submissions. Add a concurrency configuration to the publish job that uses a
unique identifier based on the release tag (such as
github.event.release.tag_name) to group concurrent executions and automatically
cancel in-progress runs when a new execution is triggered, ensuring only one
submission attempt proceeds at a time.
In `@CHANGELOG.rst`:
- Line 4: In the CHANGELOG.rst file, locate the entry about "Winget manifest is
now submitted automatically to the Windows Package Manager Community Repository"
and replace the `(`#TODO`)` placeholder with the actual GitHub issue or pull
request number reference (e.g., `#123`). This ensures the changelog contains a
valid reference for users to track the related change in your repository
history.
In `@doc/howto/contributing.rst`:
- Around line 380-381: The documentation at lines 380-381 incorrectly describes
WINGET_TOKEN as a repository secret, but it should be scoped as an environment
secret to the winget environment to limit exposure. Update the text to clarify
that WINGET_TOKEN must be configured as an environment secret in the winget
environment settings, not at the repository level, to properly restrict its
access to only the workflows that require it.
In `@security/tm_supply_chain.py`:
- Around line 196-203: The file has formatting drift detected by the black
formatter during pre-commit checks. Run the local code formatter (black) on the
file to resolve the formatting issues and bring the code into compliance with
the project's style guidelines. After running the formatter, commit the updated
file to unblock the merge.
- Around line 613-617: The DF-27 data flow definition currently has network flow
and access control enabled but lacks integrity verification, which
unintentionally satisfies DFT-21's threat condition (VCS-tag threat) and creates
a mismatched threat mapping. Add integrity control verification to the df27
object (specifically set isIntegrity to True or add appropriate integrity
validation) alongside the existing protocol, encryption, hardening, access
control, and network flow settings to prevent the unintended match with DFT-21's
conditions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 445d0ac9-617c-4cd3-9d5b-e25f32e3bc42
📒 Files selected for processing (6)
.github/workflows/winget-publish.ymlCHANGELOG.rstdoc/explanation/threat_model_supply_chain.rstdoc/howto/contributing.rstsecurity/threats.jsonsecurity/tm_supply_chain.py
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
♻️ Duplicate comments (1)
security/tm_supply_chain.py (1)
232-236:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAlign A-10 secret storage scope with the actual workflow configuration.
Line 235 states
WINGET_TOKENis a repository secret, but the workflow and contributor docs scope it to thewingetenvironment secret. This inconsistency weakens the threat model’s control traceability for C-042 and misstates blast radius.Suggested patch
- "stored as a GitHub Actions repository secret. " + "stored as a GitHub Actions environment secret in the " + "``winget`` deployment environment. "🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@security/tm_supply_chain.py` around lines 232 - 236, The A-10 secret documentation for WINGET_TOKEN incorrectly describes the storage scope. The description currently states the secret is stored as a "GitHub Actions repository secret," but according to the actual workflow configuration and contributor docs, it is stored as an environment secret in the winget environment. Update the description parameter in the A-10 section to accurately reflect that WINGET_TOKEN is scoped to the winget environment secret rather than a repository secret, ensuring the threat model accurately documents the control scope and blast radius for C-042.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@security/tm_supply_chain.py`:
- Around line 232-236: The A-10 secret documentation for WINGET_TOKEN
incorrectly describes the storage scope. The description currently states the
secret is stored as a "GitHub Actions repository secret," but according to the
actual workflow configuration and contributor docs, it is stored as an
environment secret in the winget environment. Update the description parameter
in the A-10 section to accurately reflect that WINGET_TOKEN is scoped to the
winget environment secret rather than a repository secret, ensuring the threat
model accurately documents the control scope and blast radius for C-042.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: ccdc4724-b889-4c7b-922d-b80e65f2209f
📒 Files selected for processing (4)
.github/workflows/winget-publish.ymlCHANGELOG.rstdoc/howto/contributing.rstsecurity/tm_supply_chain.py
2 participants
Add winget-publish.yml workflow that triggers on release: published
(same event as PyPI publish) and uses vedantmgoyal9/winget-releaser
to submit an updated manifest PR to microsoft/winget-pkgs automatically.
The workflow skips the rolling 'latest' tag, uses harden-runner with
egress blocking, and pins all actions to commit SHAs following the
project's existing security pattern. Requires a WINGET_TOKEN secret
(GitHub PAT with public_repo scope) to be set in repository settings.
https://claude.ai/code/session_01Sf3iaNmGSZ7UAhFrXZRYzi
Summary by CodeRabbit
New Features
latesttag).Documentation
Chores