build: automate winget package creation

[bzoz]

Add GitHub action that will automatically create a PR adding new Node installers to the winget-pckg repository.

The action is triggered when a new GitHub release is made. At this point, the new installer should already be published. The script will:

• check if the new installer isn't already present in winget-pckg Node.js installers list
• create a new YAML file for Node.js like this
• make a PR in the winget-pckg repo like this one.

The action requires some outside setup. A machine user needs to be created and have a fork of the microsft/winget-pckg repository. The machine user PAT, email, etc. need to be added as repository secrets.

One thing we might want to customize more is the license and description fields. For now I went with:

License: Copyright Node.js contributors. All rights reserved.
LicenseUrl: https://raw.githubusercontent.com/nodejs/node/master/LICENSE
...
Description: Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Ref: nodejs/Release#587

Checklist

• commit message follows commit guidelines

[bzoz]

/cc @nodejs/releasers @nodejs/build

[richardlau]

The action requires some outside setup. A machine user needs to be created and have a fork of the microsft/winget-pckg repository. The machine user PAT, email, etc. need to be added as repository secrets.

Neither the Build WG nor releasers have authority to create repository secrets for this repository -- that would fall under @nodejs/tsc.

[Trott]

The action requires some outside setup. A machine user needs to be created and have a fork of the microsft/winget-pckg repository. The machine user PAT, email, etc. need to be added as repository secrets.

Neither the Build WG nor releasers have authority to create repository secrets for this repository -- that would fall under @nodejs/tsc.

Perhaps @mhdawson?

[mmarchini]

I opened a request on nodejs/admin, once the request is approved as per our policy I can help setup the secrets in this repository.

[mmarchini]

@bzoz the request to add secrets to the repo was approved, feel free to ping me once this is ready to land to help setup secrets in the repo.

@nodejs/build this need reviewers.

[mmarchini]

Just a quick note on expectations: I'm pretty sure this will only land if the published tag includes this file, which means once it lands we should backport it to every active major.

[bzoz]

This file only needs to be in master, it will work for all published tags. The script also works if it is called from other repos (like this PR made from this release in my fork)

[mmarchini]

Interesting, that's quite inconsistent with how other Actions events work, but if it works it works :)

(just a note, on the release in your fork the file exists in the release, so that's not a valid test to see if it works with the file only on master)

[bzoz]

You've got a point there, I'll check it out. I've written the script some time ago, might as well check if it still works.

[mmarchini]

I'm checking on a personal repository, will share the results soon

[mmarchini]

It only runs if the action exists in the release, I pushed a simple action that runs on publish, then I published 0.0.2 from master, which triggered the run, and then I published 0.0.1 from the commit right before the action was added, which didn't trigger the run.

Actions have weird semantics sometimes.

[bzoz]

Huh, good to know. Thanks for investigating this.

[mmarchini]

No problem. Also, this doesn't block or affect this PR, it's just a heads up of what we need to do once we land it.

[bzoz]

Verified, the script still works. It creates PRs: microsoft/winget-pkgs#3157 and stops if package with the given version is already there: https://github.com/bzoz/node/runs/1007269352?check_suite_focus=true

[aduh95]

Is this ready to land?

[PoojaDurgad]

I would like to ping @nodejs/build to review.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/35109/

[mmarchini]

@bzoz what's your preferred channel to share the secrets so I can add it to the repo?

[bzoz]

@mmarchini shouldn't the build team create that machine account?

[mmarchini]

When you say a "machine account", do you mean a GitHub bot account like @nodejs-github-bot? Reading the description I assumed it was a Microsoft publisher account on Azure or smth (no idea if that even exists, I'm not familiar with Windows ecosystem).

[bzoz]

Yeah, sorry I didn't make that more clear. A GitHub user with a fork of the winget packages repo is needed.

[mmarchini]

Ok, we'll just use the @nodejs-github-bot then. I assume it's fine for the fork to live on the nodejs/ org with the bot having write access to it, right? From experience with a similar setup on nodejs/docker-node, keeping the fork on a bot account makes permission management quite complicated.

[bzoz]

The script assumes that the repo is forked by the user (here, here and here). Those lines would have to be changed.

[mmarchini]

humm, ok, let's create the fork on @nodejs-github-bot for now and if it becomes a pain to manage we can move it to the foundation and make the necessary changes to the Action.

[github-actions]

This issue/PR was marked as stalled, it will be automatically closed in 30 days. If it should remain open, please leave a comment explaining why it should remain open.

[github-actions]

Closing this because it has stalled. Feel free to reopen if this issue/PR is still relevant, or to ping the collaborator who labelled it stalled if you have any questions.