build.yml

name: Build

on:
  push:
    tags: ["v*"]
  pull_request:
    branches: [main, master]
  workflow_dispatch:
    inputs:
      submit_winget_only:
        description: "Skip build/sign/release and only submit winget manifest from existing GitHub Release MSI assets"
        required: false
        default: false
        type: boolean
      target_version:
        description: "Version to submit in submit-winget-only mode (example: 3.2.0)"
        required: false
        type: string

permissions:
  contents: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.sha }}
  cancel-in-progress: true

jobs:
  dotnet:
    runs-on: windows-latest
    env:
      PUBLISH_ROOT: ${{ github.workspace }}\artifacts
      INSTALLER_DIR: ${{ github.workspace }}\artifacts\installer
      RELEASE_ASSET_DIR: ${{ github.workspace }}\prime-dictate-release-assets
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          global-json-file: global.json
      - name: Compute version metadata
        id: version
        shell: pwsh
        run: |
          [xml]$props = Get-Content ".\Directory.Build.props"
          $baseVersion = @($props.Project.PropertyGroup | Where-Object { $_.Version } | Select-Object -First 1).Version.Trim()
          if ([string]::IsNullOrWhiteSpace($baseVersion)) {
            throw "Directory.Build.props is missing a Version value."
          }

          $releaseTag = ""
          $isSemverTag = "false"

          if ("${{ github.event_name }}" -eq "workflow_dispatch" -and "${{ inputs.submit_winget_only }}" -eq "true") {
            $manualVersion = "${{ inputs.target_version }}".Trim()
            if ([string]::IsNullOrWhiteSpace($manualVersion)) {
              throw "workflow_dispatch submit_winget_only=true requires target_version (for example 3.2.0)."
            }

            if ($manualVersion -notmatch '^\d+\.\d+\.\d+(-[0-9A-Za-z][0-9A-Za-z\.-]*)?$') {
              throw "target_version '$manualVersion' is not a valid package version."
            }

            $packageVersion = $manualVersion
            $informationalVersion = $manualVersion
            $releaseTag = "v$manualVersion"
            $isSemverTag = "true"
          }
          elseif ($env:GITHUB_REF -match '^refs/tags/(v\d+\.\d+\.\d+)$') {
            $releaseTag = $Matches[1]
            $packageVersion = $releaseTag.Substring(1)
            $informationalVersion = $packageVersion
            $isSemverTag = "true"
          }
          elseif ($env:GITHUB_REF -like "refs/tags/v*") {
            $packageVersion = $env:GITHUB_REF.Substring("refs/tags/v".Length)
            $informationalVersion = $packageVersion
          }
          else {
            $packageVersion = "$baseVersion-ci.$env:GITHUB_RUN_NUMBER"
            $informationalVersion = "$packageVersion+$($env:GITHUB_SHA.Substring(0,7))"
          }

          $baseParts = $baseVersion.Split(".")
          if ($baseParts.Length -lt 3) {
            throw "Base Version must be semver (e.g. 0.1.0). Found: $baseVersion"
          }

          $assemblyVersion = "$($baseParts[0]).$($baseParts[1]).$($baseParts[2]).0"
          $fileVersion = "$($baseParts[0]).$($baseParts[1]).$($baseParts[2]).$env:GITHUB_RUN_NUMBER"

          "base_version=$baseVersion" >> $env:GITHUB_OUTPUT
          "package_version=$packageVersion" >> $env:GITHUB_OUTPUT
          "assembly_version=$assemblyVersion" >> $env:GITHUB_OUTPUT
          "file_version=$fileVersion" >> $env:GITHUB_OUTPUT
          "informational_version=$informationalVersion" >> $env:GITHUB_OUTPUT
          "release_tag=$releaseTag" >> $env:GITHUB_OUTPUT
          "is_semver_tag=$isSemverTag" >> $env:GITHUB_OUTPUT

      - name: Resolve signing mode
        id: signing
        if: github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only)
        shell: pwsh
        env:
          AZURESIGNTOOL_KEYVAULT_URL: ${{ secrets.AZURESIGNTOOL_KEYVAULT_URL }}
          AZURESIGNTOOL_CLIENT_ID: ${{ secrets.AZURESIGNTOOL_CLIENT_ID }}
          AZURESIGNTOOL_TENANT_ID: ${{ secrets.AZURESIGNTOOL_TENANT_ID }}
          AZURESIGNTOOL_CLIENT_SECRET: ${{ secrets.AZURESIGNTOOL_CLIENT_SECRET }}
          AZURESIGNTOOL_CERT_NAME: ${{ secrets.AZURESIGNTOOL_CERT_NAME }}
        run: |
          $signingEnabled = -not (
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_KEYVAULT_URL) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CLIENT_ID) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_TENANT_ID) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CLIENT_SECRET) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CERT_NAME)
          )

          "enabled=$($signingEnabled.ToString().ToLowerInvariant())" >> $env:GITHUB_OUTPUT

          if ($signingEnabled) {
            Write-Host "Code signing is enabled for this run."
          }
          else {
            Write-Host "Code signing secrets are not fully configured; continuing with unsigned release assets."
          }

      - name: Restore + build
        if: github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only
        run: >
          dotnet build -c Release
          -p:Version=${{ steps.version.outputs.package_version }}
          -p:AssemblyVersion=${{ steps.version.outputs.assembly_version }}
          -p:FileVersion=${{ steps.version.outputs.file_version }}
          -p:InformationalVersion=${{ steps.version.outputs.informational_version }}

      - name: Test
        if: github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only
        run: dotnet test tests/PrimeDictate.Core.Tests -c Release

      - name: Publish Windows payloads
        if: github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only
        shell: pwsh
        run: |
          foreach ($rid in @("win-x64", "win-arm64")) {
            .\scripts\Publish-Windows.ps1 `
              -RuntimeIdentifier $rid `
              -PackageVersion "${{ steps.version.outputs.package_version }}" `
              -AssemblyVersion "${{ steps.version.outputs.assembly_version }}" `
              -FileVersion "${{ steps.version.outputs.file_version }}" `
              -InformationalVersion "${{ steps.version.outputs.informational_version }}"

            if ($LASTEXITCODE -ne 0) {
              throw "Publish failed for $rid with exit code $LASTEXITCODE"
            }
          }

      - name: Install AzureSignTool
        if: github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only) && steps.signing.outputs.enabled == 'true'
        shell: pwsh
        run: dotnet tool install --global AzureSignTool

      - name: Sign publish payload binaries (Azure Key Vault)
        if: github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only) && steps.signing.outputs.enabled == 'true'
        shell: pwsh
        env:
          AZURESIGNTOOL_KEYVAULT_URL: ${{ secrets.AZURESIGNTOOL_KEYVAULT_URL }}
          AZURESIGNTOOL_CLIENT_ID: ${{ secrets.AZURESIGNTOOL_CLIENT_ID }}
          AZURESIGNTOOL_TENANT_ID: ${{ secrets.AZURESIGNTOOL_TENANT_ID }}
          AZURESIGNTOOL_CLIENT_SECRET: ${{ secrets.AZURESIGNTOOL_CLIENT_SECRET }}
          AZURESIGNTOOL_CERT_NAME: ${{ secrets.AZURESIGNTOOL_CERT_NAME }}
          AZURESIGNTOOL_TIMESTAMP_URL: ${{ secrets.AZURESIGNTOOL_TIMESTAMP_URL }}
        run: |
          if (
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_KEYVAULT_URL) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CLIENT_ID) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_TENANT_ID) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CLIENT_SECRET) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CERT_NAME)
          ) {
            throw "Signing secrets are missing. Configure AZURESIGNTOOL_* repository secrets."
          }

          $timestampUrl = if ([string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_TIMESTAMP_URL)) { "http://timestamp.globalsign.com/tsa/advanced" } else { $env:AZURESIGNTOOL_TIMESTAMP_URL }

          $publishDirs = Get-ChildItem -Path $env:PUBLISH_ROOT -Directory -Filter "win-*" -ErrorAction SilentlyContinue |
            ForEach-Object { Join-Path $_.FullName "publish" } |
            Where-Object { Test-Path $_ }
          $filesToSign = foreach ($publishDir in $publishDirs) {
            Get-ChildItem -Path $publishDir -Filter "PrimeDictate.exe" -File -Recurse | Select-Object -ExpandProperty FullName
          }
          if (-not $filesToSign -or $filesToSign.Count -eq 0) {
            throw "No PrimeDictate publish executables found to sign under $env:PUBLISH_ROOT"
          }

          foreach ($path in $filesToSign) {
            if (-not (Test-Path $path)) {
              throw "Expected file not found for signing: $path"
            }

            azuresigntool sign `
              -kvu $env:AZURESIGNTOOL_KEYVAULT_URL `
              -kvi $env:AZURESIGNTOOL_CLIENT_ID `
              -kvt $env:AZURESIGNTOOL_TENANT_ID `
              -kvs $env:AZURESIGNTOOL_CLIENT_SECRET `
              -kvc $env:AZURESIGNTOOL_CERT_NAME `
              -tr $timestampUrl `
              -td sha256 `
              -fd sha256 `
              "$path"
          }

      - name: Build online installers
        if: github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only
        shell: pwsh
        run: >
          .\scripts\Build-Installers.ps1 -Installer Online -RuntimeIdentifier all -SkipPublish
          -PackageVersion "${{ steps.version.outputs.package_version }}"
          -AssemblyVersion "${{ steps.version.outputs.assembly_version }}"
          -FileVersion "${{ steps.version.outputs.file_version }}"
          -InformationalVersion "${{ steps.version.outputs.informational_version }}"

      - name: Sign installer MSI (Azure Key Vault)
        if: github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only) && steps.signing.outputs.enabled == 'true'
        shell: pwsh
        env:
          AZURESIGNTOOL_KEYVAULT_URL: ${{ secrets.AZURESIGNTOOL_KEYVAULT_URL }}
          AZURESIGNTOOL_CLIENT_ID: ${{ secrets.AZURESIGNTOOL_CLIENT_ID }}
          AZURESIGNTOOL_TENANT_ID: ${{ secrets.AZURESIGNTOOL_TENANT_ID }}
          AZURESIGNTOOL_CLIENT_SECRET: ${{ secrets.AZURESIGNTOOL_CLIENT_SECRET }}
          AZURESIGNTOOL_CERT_NAME: ${{ secrets.AZURESIGNTOOL_CERT_NAME }}
          AZURESIGNTOOL_TIMESTAMP_URL: ${{ secrets.AZURESIGNTOOL_TIMESTAMP_URL }}
        run: |
          if (
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_KEYVAULT_URL) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CLIENT_ID) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_TENANT_ID) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CLIENT_SECRET) -or
            [string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_CERT_NAME)
          ) {
            throw "Signing secrets are missing. Configure AZURESIGNTOOL_* repository secrets."
          }

          $timestampUrl = if ([string]::IsNullOrWhiteSpace($env:AZURESIGNTOOL_TIMESTAMP_URL)) { "http://timestamp.globalsign.com/tsa/advanced" } else { $env:AZURESIGNTOOL_TIMESTAMP_URL }
          $msis = Get-ChildItem -Path $env:INSTALLER_DIR -Filter *.msi -File -ErrorAction SilentlyContinue
          if (-not $msis -or $msis.Count -eq 0) {
            throw "No MSI files found to sign under $env:INSTALLER_DIR"
          }

          foreach ($msi in $msis) {
            azuresigntool sign `
              -kvu $env:AZURESIGNTOOL_KEYVAULT_URL `
              -kvi $env:AZURESIGNTOOL_CLIENT_ID `
              -kvt $env:AZURESIGNTOOL_TENANT_ID `
              -kvs $env:AZURESIGNTOOL_CLIENT_SECRET `
              -kvc $env:AZURESIGNTOOL_CERT_NAME `
              -tr $timestampUrl `
              -td sha256 `
              -fd sha256 `
              "$($msi.FullName)"
          }

      - name: Upload build artifacts
        if: always() && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only)
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: prime-dictate-windows-${{ steps.version.outputs.package_version }}
          path: artifacts/installer/*.msi
          retention-days: 7

      - name: Prepare GitHub release assets
        if: github.event_name == 'push' && steps.version.outputs.is_semver_tag == 'true' && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only)
        id: release_assets
        shell: pwsh
        run: |
          $tag = "${{ steps.version.outputs.release_tag }}"
          $assetDir = $env:RELEASE_ASSET_DIR
          $expectedX64Msi = Join-Path $env:INSTALLER_DIR "PrimeDictate-${{ steps.version.outputs.package_version }}-Windows-x64-Online.msi"
          $expectedArm64Msi = Join-Path $env:INSTALLER_DIR "PrimeDictate-${{ steps.version.outputs.package_version }}-Windows-arm64-Online.msi"

          Remove-Item -Path $assetDir -Recurse -Force -ErrorAction SilentlyContinue
          New-Item -ItemType Directory -Force -Path $assetDir | Out-Null

          if (-not (Test-Path $expectedX64Msi)) {
            throw "Expected x64 online MSI not found for release upload: $expectedX64Msi"
          }
          if (-not (Test-Path $expectedArm64Msi)) {
            throw "Expected ARM64 online MSI not found for release upload: $expectedArm64Msi"
          }

          $releaseX64MsiPath = Join-Path $assetDir "PrimeDictate-Setup-$tag-x64.msi"
          $releaseArm64MsiPath = Join-Path $assetDir "PrimeDictate-Setup-$tag-arm64.msi"

          Copy-Item -Path $expectedX64Msi -Destination $releaseX64MsiPath -Force
          Copy-Item -Path $expectedArm64Msi -Destination $releaseArm64MsiPath -Force

          $x64MsiHash = (Get-FileHash -Path $releaseX64MsiPath -Algorithm SHA256).Hash.ToLowerInvariant()
          $arm64MsiHash = (Get-FileHash -Path $releaseArm64MsiPath -Algorithm SHA256).Hash.ToLowerInvariant()
          Set-Content -Path (Join-Path $assetDir "PrimeDictate-Setup-$tag-x64.msi.sha256") -Value "$x64MsiHash  PrimeDictate-Setup-$tag-x64.msi" -NoNewline
          Set-Content -Path (Join-Path $assetDir "PrimeDictate-Setup-$tag-arm64.msi.sha256") -Value "$arm64MsiHash  PrimeDictate-Setup-$tag-arm64.msi" -NoNewline

          "asset_dir=$assetDir" >> $env:GITHUB_OUTPUT

      - name: Publish installers to GitHub Release
        if: github.event_name == 'push' && steps.version.outputs.is_semver_tag == 'true' && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only)
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $tag = "${{ steps.version.outputs.release_tag }}"
          $repo = "${{ github.repository }}"
          $assetDir = "${{ steps.release_assets.outputs.asset_dir }}"
          $assets = Get-ChildItem -Path $assetDir -File | Sort-Object Name | Select-Object -ExpandProperty FullName

          if (-not $assets -or $assets.Count -eq 0) {
            throw "No prepared release assets found under $assetDir"
          }

          & gh release view $tag --repo $repo *> $null
          if ($LASTEXITCODE -ne 0) {
            & gh release create $tag --repo $repo --title $tag --generate-notes
            if ($LASTEXITCODE -ne 0) {
              throw "Failed to create GitHub release for tag $tag"
            }
          }

          & gh release upload $tag $assets --repo $repo --clobber
          if ($LASTEXITCODE -ne 0) {
            throw "Failed to upload release assets for tag $tag"
          }

      - name: Build Chocolatey package
        if: github.event_name == 'push' && steps.version.outputs.is_semver_tag == 'true' && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only)
        id: chocolatey_pack
        shell: pwsh
        run: |
          $packagePath = (.\scripts\Build-ChocolateyPackage.ps1 `
            -PackageVersion "${{ steps.version.outputs.package_version }}" `
            -ReleaseAssetDirectory "${{ steps.release_assets.outputs.asset_dir }}" `
            -Repository "${{ github.repository }}" `
            -OutputDirectory (Join-Path $env:GITHUB_WORKSPACE "artifacts\chocolatey") | Select-Object -Last 1).Trim()

          if ([string]::IsNullOrWhiteSpace($packagePath)) {
            throw "Build-ChocolateyPackage.ps1 did not return a package path."
          }

          if (-not (Test-Path $packagePath)) {
            throw "Generated Chocolatey package does not exist: $packagePath"
          }

          "package_path=$packagePath" >> $env:GITHUB_OUTPUT

      - name: Push Chocolatey package (optional)
        if: github.event_name == 'push' && steps.version.outputs.is_semver_tag == 'true' && (github.event_name != 'workflow_dispatch' || !inputs.submit_winget_only)
        shell: pwsh
        env:
          CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }}
          CHOCO_SOURCE_URL: ${{ secrets.CHOCO_SOURCE_URL }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:CHOCO_API_KEY)) {
            Write-Host "CHOCO_API_KEY is not configured; skipping Chocolatey push."
            exit 0
          }

          $packagePath = "${{ steps.chocolatey_pack.outputs.package_path }}"
          if ([string]::IsNullOrWhiteSpace($packagePath) -or -not (Test-Path $packagePath)) {
            throw "Chocolatey package path is missing: $packagePath"
          }

          $chocoSource = if ([string]::IsNullOrWhiteSpace($env:CHOCO_SOURCE_URL)) { "https://push.chocolatey.org/" } else { $env:CHOCO_SOURCE_URL }
          $normalizedSource = $chocoSource.Trim().ToLowerInvariant()
          $isChocolateyCommunitySource = ($normalizedSource -like '*chocolatey.org*')
          Write-Host "Chocolatey source classified as community: $isChocolateyCommunitySource"

          $pushLines = @()
          choco push $packagePath --source $chocoSource --api-key $env:CHOCO_API_KEY --debug --verbose 2>&1 | Tee-Object -Variable pushLines
          if ($LASTEXITCODE -ne 0) {
            $pushOutput = ($pushLines | Out-String)
            $is422 = ($pushOutput -match '\[NuGet\]\s+422\b' -or $pushOutput -match '422 \(Unprocessable Entity\)')
            if ($pushOutput -match 'already exists' -or
                $pushOutput -match 'already contains' -or
                $pushOutput -match '409 \(Conflict\)') {
              Write-Warning "Chocolatey package version already exists on source; skipping duplicate push."
              exit 0
            }

            if ($isChocolateyCommunitySource -and $is422) {
              Write-Warning "Chocolatey push returned 422 on community source. This commonly indicates the version was already uploaded or is pending moderation. Continuing release pipeline."
              exit 0
            }

            throw "Chocolatey push failed with exit code $LASTEXITCODE`n$pushOutput"
          }

      - name: Resolve release MSI assets for submit-winget-only mode
        if: github.event_name == 'workflow_dispatch' && inputs.submit_winget_only
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $version = "${{ steps.version.outputs.package_version }}"
          $tag = "${{ steps.version.outputs.release_tag }}"
          $outDir = $env:INSTALLER_DIR
          New-Item -ItemType Directory -Force -Path $outDir | Out-Null

          $assetToInstallerMap = @{
            "PrimeDictate-Setup-$tag-x64.msi" = "PrimeDictate-$version-Windows-x64-Online.msi"
            "PrimeDictate-Setup-$tag-arm64.msi" = "PrimeDictate-$version-Windows-arm64-Online.msi"
          }

          foreach ($asset in $assetToInstallerMap.Keys) {
            & gh release download $tag --repo "${{ github.repository }}" --pattern $asset --dir $outDir --clobber
            if ($LASTEXITCODE -ne 0) {
              throw "Failed to download $asset from release $tag."
            }

            $downloadedAssetPath = Join-Path $outDir $asset
            if (-not (Test-Path $downloadedAssetPath)) {
              throw "Downloaded release asset not found at $downloadedAssetPath"
            }

            $normalizedInstallerName = $assetToInstallerMap[$asset]
            $normalizedInstallerPath = Join-Path $outDir $normalizedInstallerName
            Copy-Item -Path $downloadedAssetPath -Destination $normalizedInstallerPath -Force
          }

      - name: Generate winget manifests
        if: (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.submit_winget_only)) && steps.version.outputs.is_semver_tag == 'true'
        id: winget_manifest
        shell: pwsh
        run: |
          $manifestDir = .\scripts\Build-WingetManifest.ps1 `
            -PackageIdentifier "FlowDevs.PrimeDictate" `
            -PackageVersion "${{ steps.version.outputs.package_version }}" `
            -Repository "${{ github.repository }}" `
            -InstallerDirectory "$env:INSTALLER_DIR" `
            -OutputRoot (Join-Path $env:GITHUB_WORKSPACE "artifacts\winget")

          if ([string]::IsNullOrWhiteSpace($manifestDir)) {
            throw "Build-WingetManifest.ps1 did not return a manifest directory."
          }

          if (-not (Test-Path $manifestDir)) {
            throw "Generated manifest directory does not exist: $manifestDir"
          }

          "manifest_dir=$manifestDir" >> $env:GITHUB_OUTPUT

      - name: Validate winget manifests
        if: (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.submit_winget_only)) && steps.version.outputs.is_semver_tag == 'true'
        shell: pwsh
        run: |
          $manifestDir = "${{ steps.winget_manifest.outputs.manifest_dir }}"
          if ([string]::IsNullOrWhiteSpace($manifestDir)) {
            throw "Winget manifest directory output is empty."
          }
          if (-not (Test-Path $manifestDir)) {
            throw "Winget manifest directory does not exist: $manifestDir"
          }
          winget validate --manifest $manifestDir

      - name: Submit winget manifest PR (optional)
        if: (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.submit_winget_only)) && steps.version.outputs.is_semver_tag == 'true'
        shell: pwsh
        env:
          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:WINGET_CREATE_GITHUB_TOKEN)) {
            Write-Host "WINGET_CREATE_GITHUB_TOKEN is not configured; skipping winget submission."
            exit 0
          }

          $manifestDir = "${{ steps.winget_manifest.outputs.manifest_dir }}"
          if ([string]::IsNullOrWhiteSpace($manifestDir) -or -not (Test-Path $manifestDir)) {
            throw "Winget manifest directory is missing: $manifestDir"
          }

          $wingetCreateDir = Join-Path $env:RUNNER_TEMP "wingetcreate"
          New-Item -ItemType Directory -Force -Path $wingetCreateDir | Out-Null
          $wingetCreateExe = Join-Path $wingetCreateDir "wingetcreate.exe"
          Invoke-WebRequest -Uri "https://aka.ms/wingetcreate/latest" -OutFile $wingetCreateExe

          $prTitle = "Add FlowDevs.PrimeDictate version ${{ steps.version.outputs.package_version }}"
          & $wingetCreateExe submit --prtitle $prTitle --no-open $manifestDir
          if ($LASTEXITCODE -ne 0) {
            Write-Warning "winget submission failed with exit code $LASTEXITCODE. GitHub release assets were already published, so this optional winget step will not fail the release build."
            exit 0
          }