Create Github Action to release winget package

[jo-chemla]

Following issue #141 Uses winget-releaser I suggest you ( @Victor-IX) create a Classic Github Token with public_repo scope is created, following this link, then the Token can be added to the Blender-Launcher-V2 repo as a secret named WINGET_ACC_TOKEN. See below, that user also will have to fork the winget-pkgs repository.

Notes:

You will need to create a classic Personal Access Token (PAT) with public_repo scope. New fine-grained PATs aren't supported by the action. Review #172 for information.
Fork microsoft/winget-pkgs under the same account/organization as the project's repository. If you are forking winget-pkgs on a different account (e.g. bot/personal account), you can use the fork-user input to specify the username of the account where the fork is present.

[Victor-IX]

I'm not very familiar with the GitHub token system, so to recap what I did:

• In New personal access token, I've created a new key for public_repo.
• Forked microsoft/winget-pkgs and added the auto-updater.

I'm not sure how I'm supposed to call the secret key from the repo, or where WINGET_ACC_TOKEN is supposed to go.

Also, I have a security question:
If someone forked the repo and does the same setup, can they override the version present in winget-pkgs with theirs?

[jo-chemla]

Thanks for taking these steps, forking the winget-pkgs repo and creating a new classic Private access token.
This token can be put as a repository secret by creating a new repo secret with name WINGET_ACC_TOKEN and value the token.

That token is private to you. I did fork the repo but won't (or anyone else) have access to it. From what I understand, I can however create the same action with my classic token, and the release on both repos would trigger a PR to winget-pkgs, probably the last one merged would be the one retained. Not sure how microsoft team dealt with such cases if it did ever happen.

[Victor-IX]

Everything is set up! I think you should only run this GitHub action only for stable release and not the pre-release one

[jo-chemla]

Thanks for these info! If everything is set-up correctly, every new github release of Blender-Launcher-v2 should therefore automatically create a PR to winget-pkgs - or you can fire a winget-release by executing the action manually and specifying a version tag number (I cannot, only the repo owner and contributor should be able to execute these github actions). At least this is what is happening to triplex for which I did the same PR, see here