From 6adaf3cac4dbc5a5fe212029415fd3607d024207 Mon Sep 17 00:00:00 2001
From: Ian MacLeod <imac@openai.com>
Date: Fri, 18 Sep 2026 16:24:12 +0000
Subject: [PATCH] Pin WinGet publishing dependencies in the release workflow
 (#46527)

## Why

The WinGet Releaser action references `cargo-binstall@main`, violating the requirement for full commit SHA action pins.

## What changed

Replace the action with explicit steps that install SHA-pinned `cargo-binstall` version `1.23.0` and `komac` version `2.16.0`. Discover the published Windows archive URLs and require two matching assets before submitting the `OpenAI.Codex` update.

Use `komac` to sync the publishing fork, submit the WinGet update, and clean up merged branches.

GitOrigin-RevId: da4da51937a372b841f42420b5bf775a9c151e4e
---
 .github/workflows/rust-release.yml | 50 ++++++++++++++++++++++++------
 1 file changed, 40 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index 726795ebe6..25ffd2d734 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -1963,8 +1963,8 @@ jobs:
         needs.release.result == 'success' &&
         !contains(needs.release.outputs.version, '-')
       }}
-    # This job only invokes a GitHub Action to open/update the winget-pkgs PR;
-    # it does not execute Windows-only tooling, so Linux is sufficient.
+    # komac opens the winget-pkgs PR using the published Windows archives;
+    # it runs on Linux and does not execute the Windows binaries.
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -1973,15 +1973,45 @@ jobs:
       deployment: false
 
     steps:
-      - name: Publish to WinGet
-        uses: vedantmgoyal9/winget-releaser@7bd472be23763def6e16bd06cc8b1cdfab0e2fd5
+      # Adapted from the WinGet Releaser version previously used by this job:
+      # https://github.com/vedantmgoyal9/winget-releaser/blob/7bd472be23763def6e16bd06cc8b1cdfab0e2fd5/action.yml
+      # Keep dependencies explicit because its cargo-binstall@main reference
+      # violates the policy requiring full commit SHA action pins.
+      - name: Install cargo-binstall
+        uses: cargo-bins/cargo-binstall@b874e25ea559687bec77e281e9b271aa1367b624 # v1.23.0
         with:
-          identifier: OpenAI.Codex
-          version: ${{ needs.release.outputs.version }}
-          release-tag: ${{ needs.release.outputs.tag }}
-          fork-user: openai-oss-forks
-          installers-regex: '^codex-(?:x86_64|aarch64)-pc-windows-msvc\.exe\.zip$'
-          token: ${{ secrets.WINGET_PUBLISH_PAT }}
+          version: "1.23.0"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Install komac
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: cargo-binstall komac --version 2.16.0 --no-confirm
+
+      - name: Publish to WinGet
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.WINGET_PUBLISH_PAT }}
+          RELEASE_VERSION: ${{ needs.release.outputs.version }}
+          RELEASE_TAG: ${{ needs.release.outputs.tag }}
+          KOMAC_FORK_OWNER: openai-oss-forks
+          KOMAC_CREATED_WITH: Codex release workflow
+          KOMAC_CREATED_WITH_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          installer_urls="$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
+            --json assets \
+            --jq '.assets[] | select(.name | test("^codex-(x86_64|aarch64)-pc-windows-msvc\\.exe\\.zip$")) | .url')"
+          mapfile -t urls <<< "$installer_urls"
+          if [[ ${#urls[@]} -ne 2 ]]; then
+            echo "::error::Expected x86_64 and aarch64 Windows archives for $RELEASE_TAG"
+            exit 1
+          fi
+          komac sync-fork
+          komac update OpenAI.Codex --version "$RELEASE_VERSION" --submit --urls "${urls[@]}"
+          komac cleanup --only-merged
 
   update-branch:
     name: Update latest-alpha-cli branch