👷 Move winget release to slsa

.github/workflows/go-ossf-slsa3-publish.yml

@@ -31,6 +31,16 @@ jobs:
         with:
           go-version-file: './go.mod'
       - run: go test -v ./...
+  get-bot-token:
+    runs-on: ubuntu-latest
+    steps:
+        - name: Get Token
+          id: get_workflow_token
+          uses: peter-murray/workflow-application-token-action@v3
+          with:
+            application_id: ${{ secrets.BOT_APP_ID }}
+            application_private_key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+            organization: eat-pray-ai
   # Generate ldflags dynamically.
   # Optional: only needed for ldflags.
   args:
@@ -91,6 +101,8 @@ jobs:
           - darwin-arm64
           - windows-amd64.exe
           - windows-arm64.exe
+    env:
+      a: "b"
     steps:
       - name: Download artifact
         uses: actions/download-artifact@v4
@@ -100,3 +112,15 @@ jobs:
         uses: actions/attest-build-provenance@v1
         with:
           subject-path: '${{ github.workspace }}/yutu-${{ matrix.artifact }}'
+
+  winget-release:
+    needs: [build]
+    runs-on: windows-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - uses: vedantmgoyal2009/winget-releaser@v2
+        with:
+          identifier: eat-pray-ai.yutu
+          installers-regex: '\.exe$' # Only .exe files
+          version: ${{ github.event.release.tag_name }}
+          token: ${{ secrets.RELEASE_PAT }}