Skip to content

Conversation

@mdanish-kh
Copy link
Contributor

With the latest winget-create release, the preferred method for providing the GitHub token in CI/CD environment is via the environment variable WINGET_CREATE_GITHUB_TOKEN. Removed use of --token and switched to environment variable. See https://aka.ms/winget-create-token for details.

Copy link
Member

@DHowett DHowett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

after reviewing three of these, I am somewhat suspect that all callers need to always be updated to the latest whiz-bang thing immediately. But also, I don't mind

@mdanish-kh
Copy link
Contributor Author

after reviewing three of these, I am somewhat suspect that all callers need to always be updated to the latest whiz-bang thing immediately. But also, I don't mind

Not immediately as --token isn't being fully removed per se (the team was aware of the blast radius that would've caused), but being asked as a security consideration. One may also just opt to use a versioned URL of winget-create in their CIs.

@DHowett DHowett merged commit 1f8fe1c into microsoft:main Jun 11, 2025
3 checks passed
@mdanish-kh mdanish-kh deleted the winget-create-env branch June 11, 2025 21:27
Lou32Verbose pushed a commit to Lou32Verbose/edit that referenced this pull request Jan 11, 2026
…icrosoft#467)

With the latest winget-create release, the preferred method for
providing the GitHub token in CI/CD environment is via the environment
variable `WINGET_CREATE_GITHUB_TOKEN`. Removed use of `--token` and
switched to environment variable. See https://aka.ms/winget-create-token
for details.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants