chore: move winget submission to local OAuth

Author: xarthurx

.github/workflows/release.yml

@@ -47,60 +47,3 @@ jobs:
           releaseDraft: false
           prerelease: false
           updaterJsonPreferNsis: true
-
-  update-winget:
-    needs: release
-    runs-on: windows-latest
-    permissions:
-      contents: read
-    env:
-      PACKAGE_IDENTIFIER: xarthurx.Whisperi
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
-      RELEASE_TAG: ${{ github.ref_name }}
-    steps:
-      - name: Validate Winget token
-        shell: pwsh
-        run: |
-          if ([string]::IsNullOrWhiteSpace($env:WINGET_CREATE_GITHUB_TOKEN)) {
-            Write-Warning "WINGET_CREATE_GITHUB_TOKEN not configured — skipping Winget submission."
-            exit 0
-          }
-
-      - name: Install .NET 6
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '6.0.x'
-
-      - name: Download wingetcreate
-        shell: pwsh
-        run: Invoke-WebRequest https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
-
-      - name: Submit Winget manifest update
-        shell: pwsh
-        run: |
-          $headers = @{
-            Authorization = "Bearer $env:GITHUB_TOKEN"
-            Accept = "application/vnd.github+json"
-            "X-GitHub-Api-Version" = "2022-11-28"
-          }
-
-          $releaseApiUrl = "https://api.github.com/repos/${{ github.repository }}/releases/tags/$env:RELEASE_TAG"
-          Write-Output "Fetching release from: $releaseApiUrl"
-          $release = Invoke-RestMethod -Headers $headers -Uri $releaseApiUrl
-
-          $tag = $release.tag_name
-          $version = $tag -replace '^v', ''
-          $assets = @($release.assets)
-          $installerAssets = @($assets | Where-Object { $_.name -like '*_x64-setup.exe' })
-
-          if ($installerAssets.Count -ne 1) {
-            throw "Expected exactly one x64 setup asset on release $tag, found $($installerAssets.Count)."
-          }
-
-          .\wingetcreate.exe update `
-            $env:PACKAGE_IDENTIFIER `
-            -u $installerAssets[0].browser_download_url `
-            -v $version `
-            -t $env:WINGET_CREATE_GITHUB_TOKEN `
-            --submit

.github/workflows/update-winget.yml

@@ -43,11 +43,35 @@ Tauri 2.10+, React 19, TypeScript (strict), Tailwind CSS v4, shadcn/ui, i18next
 
 ## Winget Manifests
 
-- `wingetcreate update --submit` in CI handles manifest generation; metadata is **inherited verbatim from the previous version's manifest in `microsoft/winget-pkgs`**. Once a bad field lands, every future submission propagates it — the rules below must be enforced by patching the PR, not by hoping `wingetcreate` will fix it.
+WinGet submission is local because Microsoft's open-source enterprise limits classic PATs to eight days and WinGetCreate does not support fine-grained PATs. Never add a WinGet PAT back to GitHub Actions or pass a token with WinGetCreate's `--token` argument.
+
+### New Windows Machine Setup
+
+Run these commands once from the Whisperi repository:
+
+```powershell
+winget install --id Microsoft.WingetCreate --exact --source winget --accept-source-agreements --accept-package-agreements
+wingetcreate token -s
+```
+
+- `wingetcreate token -s` starts GitHub's OAuth flow and stores the resulting credential in WinGetCreate's local cache for the current Windows user. If a browser, device code, or authorization prompt appears, the agent must pause and ask the user to approve it; never attempt to extract, print, or copy the cached credential.
+- A successful setup prints `Token stored in cache successfully.` Repeat it only on a new machine/user profile, after the cache is cleared, or when GitHub revokes the authorization.
+
+### Per-Release Submission
+
+Only submit after the non-draft GitHub release and its signed x64 NSIS asset are public. Run preview first, then submit exactly once:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts/submit-winget.ps1 vX.Y.Z -Preview
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts/submit-winget.ps1 vX.Y.Z
+```
+
+- If submission reports an authentication problem, refresh the cache with `wingetcreate token -s` and retry. Do not create a classic or fine-grained PAT.
+- `scripts/submit-winget.ps1` handles manifest generation and submission with WinGetCreate's cached OAuth credential; metadata is **inherited verbatim from the previous version's manifest in `microsoft/winget-pkgs`**. Once a bad field lands, every future submission propagates it — the rules below must be enforced by patching the PR, not by hoping `wingetcreate` will fix it.
 - **License**: SPDX identifier `MIT` (not `MIT License`), and include `LicenseUrl: https://github.com/xarthurx/whisperi/blob/main/LICENSE`. Copilot review flags `MIT License` as non-SPDX (precedent: [PR #376335](https://github.com/microsoft/winget-pkgs/pull/376335))
 - **ShortDescription**: single concise phrase only (~one line); longer text goes in `Description`
 - **`ReleaseDate`** in installer manifest is **valid** (schema 1.2.0+, see [installer schema 1.12.0](https://github.com/microsoft/winget-pkgs/blob/master/doc/manifest/schema/1.12.0/manifest.installer.1.12.0.json)) — Copilot has incorrectly flagged this as needing to move to the version manifest; don't move it
-- **After every release tag**, when the CI-submitted winget PR appears under `microsoft/winget-pkgs`: open the generated `*.locale.en-US.yaml` and verify all four rules above before letting it merge. Push fixes onto the PR branch (`xarthurx.Whisperi-<version>-<uuid>` on `xarthurx/winget-pkgs`) — do not wait for the next version, since the next `wingetcreate` run will re-inherit whatever is in the latest accepted manifest.
+- **After every local WinGet submission**, open the generated PR under `microsoft/winget-pkgs` and verify all four rules above before letting it merge. Push fixes onto the PR branch (`xarthurx.Whisperi-<version>-<uuid>` on `xarthurx/winget-pkgs`) — do not wait for the next version, since the next `wingetcreate` run will re-inherit whatever is in the latest accepted manifest.
 - See [docs/PROGRESS.md](docs/PROGRESS.md) for full winget notes
 
 ## Workflow Rules

CLAUDE.md

@@ -297,15 +297,19 @@ Single `check-and-build` job: TypeScript check → Vite build → `cargo test` 
 
 ### Release Pipeline (`.github/workflows/release.yml`)
 
-Triggered on version tags (`v*`). Two jobs:
-1. **`release`** — Builds the NSIS installer via `tauri-apps/tauri-action@v0` and publishes it as a GitHub Release asset. Windows-only.
-2. **`update-winget`** — Runs after `release`. Downloads `wingetcreate`, resolves the released x64 NSIS installer asset, and submits a manifest update PR for `xarthurx.Whisperi` to `microsoft/winget-pkgs`. Requires a `WINGET_CREATE_GITHUB_TOKEN` classic PAT with `public_repo` scope (≤ 90-day lifetime).
+Triggered on version tags (`v*`). Its Windows `release` job builds and signs the NSIS/MSI installers via `tauri-apps/tauri-action@v0`, then publishes them with updater metadata as a GitHub Release.
 
-The Winget step is in the same workflow (not a separate one) because `tauri-action` creates the release using `GITHUB_TOKEN`, and events from `GITHUB_TOKEN` do not trigger other workflows.
+### WinGet Update (Local OAuth)
 
-### Winget Update (Manual) (`.github/workflows/update-winget.yml`)
+WinGet submission is deliberately separate from GitHub Actions. Microsoft's open-source enterprise limits classic PATs to eight days, while WinGetCreate does not support fine-grained PATs for cross-owner public-repository contributions. The release workstation uses WinGetCreate's cached OAuth login instead:
 
-Manual-only (`workflow_dispatch`) backup for retries and backfills against an existing release tag.
+```powershell
+wingetcreate token -s
+powershell -ExecutionPolicy Bypass -File scripts/submit-winget.ps1 vX.Y.Z -Preview
+powershell -ExecutionPolicy Bypass -File scripts/submit-winget.ps1 vX.Y.Z
+```
+
+The submission script resolves the published release through GitHub's public API, verifies there is exactly one x64 NSIS installer, generates the three manifests in a temporary directory, checks the inherited metadata and GitHub asset digest, then invokes `wingetcreate submit` without putting a token on the command line. The temporary directory is removed on success or failure.
 
 ### Key Dependencies
 
@@ -405,13 +409,15 @@ whisperi/
 ├── docs/
 │   ├── ARCHITECTURE.md                # This file
 │   ├── CHANGELOG.md                   # Version history
-│   └── CONTINUE.md                    # Short follow-up notes
+│   ├── PROGRESS.md                    # Operational/release notes
+│   └── TODO.md                        # Follow-up work
+├── scripts/
+│   └── submit-winget.ps1              # Local OAuth WinGet submission
 ├── .github/
 │   ├── README.md                      # GitHub repo readme
 │   └── workflows/
 │       ├── ci.yml                    # CI pipeline (push/PR)
-│       ├── release.yml               # Release pipeline (version tags)
-│       └── update-winget.yml         # Winget submission on published releases
+│       └── release.yml               # Release pipeline (version tags)
 ├── package.json                       # Frontend deps + scripts
 └── CLAUDE.md                         # Claude Code project instructions
 ```

docs/ARCHITECTURE.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [Unreleased]
+
+### Internal
+
+- Moved WinGet publication out of GitHub Actions and into a local, cached-OAuth release script. The script resolves the published installer, generates manifests in temporary storage, validates their inherited metadata and asset hash, and submits without placing a personal access token on the command line. This avoids Microsoft's eight-day classic-PAT lifetime limit and prevents WinGet authentication from marking an otherwise successful app release as failed.
+- Documented the complete new-machine and per-release WinGet procedure for future maintainers and coding agents: install WinGetCreate, authorize its local OAuth cache once, preview every generated manifest, submit once, and pause for the user whenever GitHub requires interactive authorization.
+
 ## [0.8.2] - 2026-07-18
 
 ### Highlights

docs/CHANGELOG.md

@@ -2,27 +2,30 @@
 
 ## Winget Submission
 
-### Token
+### Authentication
 
-- `WINGET_CREATE_GITHUB_TOKEN` must be a **classic PAT** with `public_repo` scope and **≤ 90-day** lifetime (enforced by the `Microsoft Open Source` GitHub enterprise policy — applies to both classic and fine-grained PATs).
+- WinGetCreate is installed locally through `winget install --id Microsoft.WingetCreate --exact`.
+- Authenticate once on the release workstation with `wingetcreate token -s`. WinGetCreate keeps the OAuth credential in its local cache; no token is passed on the command line or stored in the Whisperi repository.
+- Microsoft's open-source GitHub enterprise rejects classic PATs whose lifetime exceeds eight days. Fine-grained PATs are not a replacement because WinGetCreate and cross-owner public-repository contributions do not support them. The former `WINGET_CREATE_GITHUB_TOKEN` workflows were removed after this policy caused the v0.8.2 follow-up job to fail.
 
 ### Workflow
 
-- Winget submission runs as the `update-winget` job in `release.yml`, triggered automatically after the build job on tag push (`v*`).
-- `update-winget.yml` is kept as a manual-only (`workflow_dispatch`) backup for retries/backfills.
-- The release is created by `tauri-action` using `GITHUB_TOKEN`, which does not trigger other workflows (GitHub security policy). That's why the Winget step is in the same workflow instead of a separate one.
+- `.github/workflows/release.yml` only builds, signs, and publishes the GitHub release. A WinGet credential failure can no longer mark the application release as failed.
+- After the release assets are public, preview the generated manifests with `powershell -ExecutionPolicy Bypass -File scripts/submit-winget.ps1 vX.Y.Z -Preview`.
+- Submit with `powershell -ExecutionPolicy Bypass -File scripts/submit-winget.ps1 vX.Y.Z`. The script resolves the exact published release, requires one x64 NSIS asset, generates manifests in a temporary directory, verifies the package/version/URL/hash/release date/license metadata, and submits them using the cached OAuth credential.
+- The script cleans its temporary output, so running it from the repository does not create untracked manifest files.
 
 ### wingetcreate Notes
 
-`wingetcreate` (v1.12.8.0, framework-dependent, requires .NET 6) output is used as-is with `--submit`. Its `ReleaseDate` placement at the top level (outside `Installers`) looks wrong per the schema docs but is the convention winget-pkgs validation expects — do not move it inside the installer entry.
+`wingetcreate` v1.12.8.0 generates the manifests locally, then its `submit` command publishes the validated directory. Its `ReleaseDate` placement at the top level (outside `Installers`) looks wrong per the schema docs but is the convention winget-pkgs validation expects — do not move it inside the installer entry.
 
 **Do NOT use the self-contained wingetcreate** (`aka.ms/wingetcreate/latest/self-contained`) — it bundles v1.0.4.0, which generates schema 1.1.0 manifests instead of 1.10.0.
 
 ### Manifest Metadata Quality (from PR #354548 Copilot review)
 
 `wingetcreate update` inherits metadata from the previous version's manifest in winget-pkgs. Fix these once and they carry forward to all future versions:
 
-- **License** — Use SPDX identifier `MIT` (not `MIT License`). Add `LicenseUrl: https://github.com/xarthurx/whisperi/blob/master/LICENSE`.
+- **License** — Use SPDX identifier `MIT` (not `MIT License`). Add `LicenseUrl: https://github.com/xarthurx/whisperi/blob/main/LICENSE`.
 - **ShortDescription** — Keep to a single concise phrase (e.g. `Lightweight Windows speech-to-text app.`). Move longer text to a separate `Description` field.
 - **Locale metadata** — Include `PublisherUrl`, `PublisherSupportUrl`, and `PackageUrl` for storefront quality.
 - **`ReleaseDate` in installer manifest** — Copilot flagged this as invalid, but it IS a valid field in the installer schema (added in 1.2.0+). `wingetcreate` generates it correctly. The PR was approved by a human reviewer — ignore this Copilot suggestion.

docs/PROGRESS.md

@@ -1,7 +1,5 @@
 # TODO
 
-- **Renew `WINGET_CREATE_GITHUB_TOKEN`** — classic PAT with `public_repo` scope, ≤ 90-day lifetime (Microsoft Open Source enterprise policy). Last set **2026-03-16**; renew by **2026-06-13**.
-
 ## Live mode stabilization
 
 - [ ] Remove "(Beta)" label after 2 consecutive minor releases with zero Live-mode-related issues + multi-provider validation.