Reapply "templates and build step for validating/submitting winget package" (#6696)

This reverts commit b560c5cef1.

.github/workflows/rust-release.yml

@@ -318,6 +318,8 @@ jobs:
       tag: ${{ github.ref_name }}
       should_publish_npm: ${{ steps.npm_publish_settings.outputs.should_publish }}
       npm_tag: ${{ steps.npm_publish_settings.outputs.npm_tag }}
+      windows_x64_sha256: ${{ steps.win_hash.outputs.windows_x64_sha256 }}
+      windows_arm64_sha256: ${{ steps.win_hash.outputs.windows_arm64_sha256 }}
 
     steps:
       - name: Checkout repository
@@ -357,6 +359,15 @@ jobs:
           rm -rf dist/shell-tool-mcp*
 
           ls -R dist/
+      - name: Compute SHA256 for Windows EXEs
+        id: win_hash
+        shell: bash
+        run: |
+          set -euo pipefail
+          x64_sha=$(sha256sum "dist/x86_64-pc-windows-msvc/codex-rs/dist/x86_64-pc-windows-msvc/codex-x86_64-pc-windows-msvc.exe" | awk '{print $1}')
+          arm_sha=$(sha256sum "dist/aarch64-pc-windows-msvc/codex-rs/dist/aarch64-pc-windows-msvc/codex-aarch64-pc-windows-msvc.exe" | awk '{print $1}')
+          echo "windows_x64_sha256=${x64_sha}" >> "$GITHUB_OUTPUT"
+          echo "windows_arm64_sha256=${arm_sha}" >> "$GITHUB_OUTPUT"
 
       - name: Define release name
         id: release_name
@@ -513,4 +524,16 @@ jobs:
             repos/${GITHUB_REPOSITORY}/git/refs/heads/latest-alpha-cli \
             -X PATCH \
             -f sha="${GITHUB_SHA}" \
-            -F force=true
+          -F force=true
+
+  winget:
+    needs: release
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Validate WinGet manifests
+        uses: ./.github/actions/winget-submit
+        with:
+          version: ${{ needs.release.outputs.version }}
+          windows_x64_sha256: ${{ needs.release.outputs.windows_x64_sha256 }}
+          windows_arm64_sha256: ${{ needs.release.outputs.windows_arm64_sha256 }}