From 84937b786330dbfa8b3d8a6d21d0f3a9b0a758f2 Mon Sep 17 00:00:00 2001
From: Petr <petr@keboola.com>
Date: Thu, 16 Jul 2026 07:10:19 +0200
Subject: [PATCH] ci(release): make winget job bootstrap-aware for un-submitted
 manifest (#484)

wingetcreate update only patches an existing manifest in microsoft/winget-pkgs.
Until Keboola.KeboolaCLI2 is bootstrapped there via a one-time interactive
wingetcreate new submission, every run 404s with "was not found" and fails the
job, making a first-run-after-a-gap look like a silent regression.

Distinguish that known, expected not-found state (skip with a loud pointer to
issue #484 in the step summary) from a genuine winget failure (still hard-fails).
---
 .github/workflows/release-kbagent.yml | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-kbagent.yml b/.github/workflows/release-kbagent.yml
index 8f0f5c08..5c95ddf9 100644
--- a/.github/workflows/release-kbagent.yml
+++ b/.github/workflows/release-kbagent.yml
@@ -442,7 +442,32 @@ jobs:
           curl -fLSs https://aka.ms/wingetcreate/latest -o wingetcreate.exe
           # Verify it's validly Authenticode-signed by Microsoft before executing.
           powershell -Command '$s = Get-AuthenticodeSignature wingetcreate.exe; if ($s.Status -ne "Valid" -or $s.SignerCertificate.Subject -notmatch "Microsoft") { Write-Error "wingetcreate.exe signature not valid/Microsoft: $($s.Status)"; exit 1 }'
-          ./wingetcreate.exe update -v "$VERSION" -u "$url" -t "$WINGET_TOKEN" Keboola.KeboolaCLI2 -s
+          # `wingetcreate update` only works against an EXISTING manifest in
+          # microsoft/winget-pkgs. Until Keboola.KeboolaCLI2 is bootstrapped there
+          # with a one-time interactive `wingetcreate new` submission (see issue #484),
+          # every run 404s with "was not found". Treat that known, expected state as a
+          # skip with a loud pointer instead of a hard failure, so a first-run-after-a-gap
+          # doesn't masquerade as a silent regression — while any genuine winget error
+          # still fails the job.
+          set +e
+          output=$(./wingetcreate.exe update -v "$VERSION" -u "$url" -t "$WINGET_TOKEN" Keboola.KeboolaCLI2 -s 2>&1)
+          status=$?
+          set -e
+          echo "$output"
+          if [ "$status" -ne 0 ]; then
+            if echo "$output" | grep -qi "was not found"; then
+              msg="WinGet package Keboola.KeboolaCLI2 is not yet bootstrapped in microsoft/winget-pkgs; skipping. A one-time interactive \`wingetcreate new\` submission is required first — see https://github.com/keboola/cli/issues/484."
+              echo "::warning::${msg}"
+              {
+                echo "### WinGet skipped — package not bootstrapped"
+                echo ""
+                echo "${msg}"
+              } >> "$GITHUB_STEP_SUMMARY"
+              exit 0
+            fi
+            echo "::error::wingetcreate update failed (exit ${status})"
+            exit "$status"
+          fi
 
   # ── Smoke-test the real install paths end to end. Runs on every tag (incl. dev tags,
   #    against PUBLISH_PREFIX); the Homebrew leg is prod-only since the tap isn't pushed