update winget-create and remove dependencies on outdated libraries

[hilmarf]

Description of the new feature / enhancement

We have been using winget-create quite a while successfully inside github-actions on windows runners. But for some reason it's now failing, because the windows runners have been updated with latest dotnet versions.

Dear Microsoft please solve this issue internally. You own github-actions + winget-create...

There is another ticket on the GHA runners: actions/runner-images#12158 which was closed because of this outdated dependency.

We do like winget a lot more than Chocolatey, it's really nice and simple to use... But if we can't create our packages anymore...

Proposed technical implementation details

1. Update winget-create and use latest (supported) versions of the dependencies.
2. Add winget-create to the standard GHA windows runners. (Update/Add wingetcreate actions/runner-images#12158)

[mdanish-kh]

We have been using winget-create quite a while successfully inside github-actions on windows runners. But for some reason it's now failing, because the windows runners have been updated with latest dotnet versions.

Is it possible for you to share the workflow file (or atleast the bits how you're using wingetcreate)? I just made a test run on a test repo and it's running fine as expected. See https://github.com/mdanish-kh/test-wingetcreate/actions/runs/15213988907/job/42794890031

Several of MSFT repos use wingetcreate for their publish actions, like PowerToys, Terminal, and none of those has had a problem with using winget-create with their recent releases.

There is another ticket on the GHA runners: actions/runner-images#12158 which was closed because of this outdated dependency.

I added a comment in the ticket where it mentions that winget-create has a dependency on .NET 6. The latest version is actually on .NET 8. Will be updated in the README once #594 is merged

[hilmarf]

Hi @mdanish-kh,

thanks a lot for your investigation!

Is it possible for you to share the workflow file (or atleast the bits how you're using wingetcreate)?

Yes, sure.

Here is the link to the last failed run:
https://github.com/open-component-model/ocm/actions/runs/14838456112/job/41655227774

Failed with:

# Created using wingetcreate 1.9.4.0

Manifest validation succeeded: True

Submitting pull request for manifest...

System.Net.Http.HttpRequestException: Response status code does not indicate success: 422 (Unprocessable Entity).
   at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
   at Microsoft.WingetCreateCore.Common.GitHub.UpdateForkedRepoWithUpstreamCommits(Repository forkedRepo)
   at Microsoft.WingetCreateCore.Common.GitHub.<>c__DisplayClass20_0.<<SubmitPRAsync>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at Polly.AsyncPolicy.<>c__DisplayClass40_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
   at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, CancellationToken cancellationToken, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
   at Polly.AsyncPolicy.ExecuteAsync(Func`3 action, Context context, CancellationToken cancellationToken, Boolean continueOnCapturedContext)
   at Microsoft.WingetCreateCore.Common.GitHub.SubmitPRAsync(String packageId, String version, Dictionary`2 contents, Boolean submitToFork, String prTitle, Boolean shouldReplace, String replaceVersion)
   at Microsoft.WingetCreateCore.Common.GitHub.SubmitPRAsync(String packageId, String version, Dictionary`2 contents, Boolean submitToFork, String prTitle, Boolean shouldReplace, String replaceVersion)
   at Microsoft.WingetCreateCLI.Commands.BaseCommand.GitHubSubmitManifests(Manifests manifests, String prTitle, Boolean shouldReplace, String replaceVersion)
   at Microsoft.WingetCreateCLI.Commands.UpdateCommand.ExecuteManifestUpdate(List`1 latestManifestContent, CommandExecutedEvent commandEvent)
   at Microsoft.WingetCreateCLI.Commands.UpdateCommand.Execute()
   at Microsoft.WingetCreateCLI.Program.Main(String[] args)

Here is the action:
https://github.com/open-component-model/ocm/actions/runs/14838456112/workflow#L125

# relevant snipped:
    runs-on: windows-latest
    steps:
    - name: Install wingetcreate
      run: iwr https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
    - name: Update Winget package
      run: |
        .\wingetcreate.exe update --submit --token ${{ secrets.TOKEN }} --urls `
          https://github.com/open-component-model/ocm/releases/download/v${{ env.RELEASE_VERSION }}/ocm-${{ env.RELEASE_VERSION }}-windows-amd64.zip `
          https://github.com/open-component-model/ocm/releases/download/v${{ env.RELEASE_VERSION }}/ocm-${{ env.RELEASE_VERSION }}-windows-arm64.zip `
          --version ${{ env.RELEASE_VERSION }} `
          Open-Component-Model.ocm-cli

We've tried to identify the reason for the failure and realized the only difference in the used runner image.

This is the one, where the job started to fail.

Microsoft Windows Server 2022
  10.0.20348
Runner Image
  Image: windows-2022
  Version: 20250427.1.0
  Included Software: https://github.com/actions/runner-images/blob/win22/20250427.1/images/windows/Windows2022-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/win22%2F20250427.1
Since the winget-create version didn't change

The last successful runs, were with:

Microsoft Windows Server 2022
  10.0.20348
  Datacenter
Runner Image
  Image: windows-2022
  Version: 20250224.5.0
  Included Software: https://github.com/actions/runner-images/blob/win22/20250224.5/images/windows/Windows2022-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/win22%2F20250224.5

Hence the ticket at actions/runner-images.

[mdanish-kh]

System.Net.Http.HttpRequestException: Response status code does not indicate success: 422 (Unprocessable Entity).

@hilmarf To create a pull request at winget-pkgs, winget-create first needs to sync your fork with upstream commits, because PR creation through the GitHub API can fail if the fork is behind way too many commits. This is a known issue where winget-create tries to sync your winget-pkgs fork with upstream commits but fails to do so. I agree the error message is totally unhelpful (for which I had created #591, and the changes should be available in the next release).

This is the same issue as #590. I don't think this has anything to do with a new version of the actions runner

Since you're running this in a CI, it may help to add another step before invoking wingetcreate, something like

    runs-on: windows-latest
    steps:
    - name: Install wingetcreate
      run: iwr https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
    - name: Sync winget-pkgs fork
      run: gh repo sync <username>/winget-pkgs -b master
      env:
        GH_TOKEN: ${{ secrets.TOKEN }}
    - name: Update Winget package
      run: |
        .\wingetcreate.exe update --submit --token ${{ secrets.TOKEN }} --urls `
          https://github.com/open-component-model/ocm/releases/download/v${{ env.RELEASE_VERSION }}/ocm-${{ env.RELEASE_VERSION }}-windows-amd64.zip `
          https://github.com/open-component-model/ocm/releases/download/v${{ env.RELEASE_VERSION }}/ocm-${{ env.RELEASE_VERSION }}-windows-arm64.zip `
          --version ${{ env.RELEASE_VERSION }} `
          Open-Component-Model.ocm-cli

Or sync your fork manually from the GitHub Web UI & then try running the action again.

The fork relevant for syncing here would be under the user account from where ${{ secrets.TOKEN }} i.e., the GitHub Personal Access token was created from.

P.S.: This behavior may also be improved once PR #597 gets merged

[hilmarf]

@mdanish-kh thanks for your help and suggestion.

Unfortunately it's (run: gh repo sync <username>/winget-pkgs) not going to work as we're using an app/bot to automatically create those PRs, whenever we're releasing a new version. And those apps/bots don't have a personal account, where they can sync forks or something...

Do you have maybe a sample, which also uses an app/bot?

[mdanish-kh]

Do you have maybe a sample, which also uses an app/bot?

@hilmarf - The most relevant example for you where PRs are made from bot account and they have a sync fork step would be:

• coder/coder: PRs made by bot account https://github.com/cdrci/

---

Other examples:

• A bunch of MSFT repos i.e., microsoft/PowerToys, microsoft/terminal, microsoft/edit use the bot account https://github.com/consvc

• httptoolkit/httptoolkit-desktop: PRs made by bot account https://github.com/Httptoolkit-bot

I'm sure they're are many other examples as well where folks use bot accounts to submit PRs to winget-pkgs, but these are the ones I know off the top of my head.

P.S. - I believe these accounts at the end of the day are just "personal" accounts which are made to be used as bots. They aren't a GitHub app so to say...