Add Windows winget packaging and signing workflow#323
Merged
Conversation
Publish a Windows release bundle with optional manual signing and release-enforced signing, upload release assets, and pass Windows artifact metadata to Glue for downstream winget publication. Co-authored-by: Cursor <cursoragent@cursor.com>
Rely on the action default host to reduce redundant workflow configuration while preserving signing behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
cmmarslender
requested changes
Feb 24, 2026
Use the signer action default host consistently by removing SM_HOST from the workflow secret gate and required list. Co-authored-by: Cursor <cursoragent@cursor.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Build json_data with both release_version and windows_amd64 in brew_metadata and pass that output into the glue trigger step to avoid metadata drift. Co-authored-by: Cursor <cursoragent@cursor.com>
The variable was scoped to the assemble step but never read there, while packaging keeps its own IS_RELEASE value for release-only winget asset output. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Define one shared executable list for Windows packaging/signing and consume it in both steps, with a fail-fast guard when the list is empty. Co-authored-by: Cursor <cursoragent@cursor.com>
cmmarslender
approved these changes
Feb 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
workflow_dispatch.windows_sign) and enforce signing for release builds using DigiCert toolingwindows_amd64metadata in Glue trigger payload so downstream automation can publish winget assetsTest plan
workflow_dispatchwithwindows_sign=falseand verify unsigned Windows bundle artifacts are createdworkflow_dispatchwithwindows_sign=trueand signing secrets present; verify signed executables and zipped artifact outputchiavdf-win64.zipand.sha256are uploaded to GitHub releaserelease_versionandwindows_amd64Made with Cursor
Note
Medium Risk
Changes release/CI packaging behavior for Windows, including optional/enforced code signing and new artifact upload paths, which could break releases if secrets/paths or signing tooling are misconfigured.
Overview
Adds Windows distribution packaging to the
build-packages.ymlworkflow: assembles adist/windowszip bundle (with bundled DLL dependencies), writes.sha256files, and uploads the bundle as a CI artifact and as GitHub release assets.Introduces optional Windows code-signing via
workflow_dispatch.windows_sign(and enforced on releases), including a preflight check for required DigiCertSM_*secrets, signer tooling setup, andsigntoolsigning/verification of bundled executables.Updates the release metadata/Glue trigger payload to include a
windows_amd64asset name (chiavdf-win64.zip) for downstream automation.Written by Cursor Bugbot for commit 95f792c. This will update automatically on new commits. Configure here.