Node / meshtastic / Meshtastic-Android / files / .github / workflows / msstore-publish.yml

Displaying Raw • Download

Tff7b72nameTb4b4b4: Ta5d6ffPublishTa5d6ff Ta5d6fftoTa5d6ff Ta5d6ffMicrosoftTa5d6ff Ta5d6ffStore

T8b949e# The `released` type fires when a release is published as a full release OR

T8b949e# when an existing pre-release is flipped to a full release — the latter is

T8b949e# what promote.yml's production promotion does (`gh release edit

T8b949e# --prerelease=false` on the already-published release object). It never fires

T8b949e# for drafts or pre-releases, so internal/closed/open promotions are ignored.

T8b949e#

T8b949e# CAVEAT: promote.yml performs that edit with the workflow's own GITHUB_TOKEN,

T8b949e# and events caused by GITHUB_TOKEN never start workflow runs — so promote.yml

T8b949e# also dispatches this workflow explicitly (workflow_dispatch is exempt from

T8b949e# that suppression). The release trigger stays for manually-published releases;

T8b949e# workflow_dispatch doubles as the manual retry path.

Tff7b72onTb4b4b4:

Tff7b72releaseTb4b4b4:

Tff7b72typesTb4b4b4: Tb4b4b4[Te6edf3releasedTb4b4b4]

Tff7b72workflow_dispatchTb4b4b4:

Tff7b72inputsTb4b4b4:

Tff7b72tagTb4b4b4:

Tff7b72descriptionTb4b4b4: Ta5d6ff'Ta5d6ffProductionTe6edf3 Ta5d6ffreleaseTe6edf3 Ta5d6fftagTe6edf3 Ta5d6fftoTe6edf3 Ta5d6ffpublishTe6edf3 Ta5d6ff(e.g.,Te6edf3 Ta5d6ffv2.8.0)Ta5d6ff'

Tff7b72requiredTb4b4b4: Ta5d6fftrue

Tff7b72typeTb4b4b4: Ta5d6ffstring

T8b949e# The submission happens entirely through the Partner Center API using the

T8b949e# MSSTORE_* secrets; this repo is only read (public release assets).

Tff7b72permissionsTb4b4b4:

Tff7b72contentsTb4b4b4: Ta5d6ffread

T8b949e# Partner Center submissions must never race (a release event overlapping a

T8b949e# manual retry would collide on the same in-progress submission). Serialize.

Tff7b72concurrencyTb4b4b4:

Tff7b72groupTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.workflowTa5d6ff Ta5d6ff}}

Tff7b72cancel-in-progressTb4b4b4: Ta5d6fffalse

Tff7b72jobsTb4b4b4:

Tff7b72msstoreTb4b4b4:

T8b949e# Belt and braces for release events — `released` should already exclude

T8b949e# these. workflow_dispatch has no release payload and passes through.

Tff7b72ifTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ff!github.event.release.prereleaseTa5d6ff Ta5d6ff&&Ta5d6ff Ta5d6ff!github.event.release.draftTa5d6ff Ta5d6ff}}

Tff7b72runs-onTb4b4b4: Ta5d6ffubuntu-latest

Tff7b72timeout-minutesTb4b4b4: Ta5d6ff60

Tff7b72envTb4b4b4:

T8b949e# Secrets aren't readable in step `if:` expressions; skip cleanly until

T8b949e# Partner Center is configured. Presence is gated on PRODUCT_ID alone so

T8b949e# a half-configured secret set fails loudly in the configure step rather

T8b949e# than silently skipping.

Tff7b72HAS_MSSTORE_CREDSTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.MSSTORE_PRODUCT_IDTa5d6ff Ta5d6ff!=Ta5d6ff Ta5d6ff''Ta5d6ff Ta5d6ff&&Ta5d6ff Ta5d6ff'true'Ta5d6ff Ta5d6ff||Ta5d6ff Ta5d6ff'false'Ta5d6ff Ta5d6ff}}

Tff7b72stepsTb4b4b4:

T8b949e# The Store requires a versioned, immutable installer URL — per-tag

T8b949e# GitHub release asset URLs are exactly that. Fails loudly if the

T8b949e# release carries no MSI (e.g. the Windows build leg failed) rather

T8b949e# than submitting nothing.

Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffResolveTa5d6ff Ta5d6ffMSITa5d6ff Ta5d6ffreleaseTa5d6ff Ta5d6ffassetTa5d6ff Ta5d6ffURL

Tff7b72idTb4b4b4: Ta5d6ffmsi

Tff7b72ifTb4b4b4: Ta5d6ffenv.HAS_MSSTORE_CREDSTa5d6ff Ta5d6ff==Ta5d6ff Ta5d6ff'true'

Tff7b72envTb4b4b4:

Tff7b72GH_TOKENTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.tokenTa5d6ff Ta5d6ff}}

Tff7b72TAGTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffinputs.tagTa5d6ff Ta5d6ff||Ta5d6ff Ta5d6ffgithub.event.release.tag_nameTa5d6ff Ta5d6ff}}

Tff7b72runTb4b4b4: Tb4b4b4|

Tff7b72URL=$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \

Tff7b72--jq '[.assets[] | select(.name | endswith(".msi"))][0].browser_download_url // empty')

Tff7b72if [ -z "$URL" ]; then

Tff7b72echo "::error::No .msi asset found on release ${TAG}"

Tff7b72exit 1

Tff7b72fi

Tff7b72echo "url=$URL" >> "$GITHUB_OUTPUT"

T8b949e# Prerequisites (all manual, one-time):

T8b949e# 1. A Partner Center account with the app already created and its

T8b949e# first submission live — the submission API can only UPDATE

T8b949e# existing Store products. The initial submission (listing copy,

T8b949e# screenshots, first MSI URL) must be made by hand in Partner

T8b949e# Center, and only with a Trusted-Signing-signed MSI: Partner

T8b949e# Center rejects Win32 installers whose binaries don't chain to a

T8b949e# Microsoft-trusted CA, so Windows signing is a hard prerequisite.

T8b949e# 2. An Entra app registration added under Partner Center → Account

T8b949e# settings → User management → Microsoft Entra applications, with

T8b949e# the Manager role.

T8b949e# 3. Repository secrets:

T8b949e# MSSTORE_TENANT_ID – Entra tenant ID (linked to Partner Center)

T8b949e# MSSTORE_SELLER_ID – Partner Center → Account settings → Seller ID

T8b949e# MSSTORE_PRODUCT_ID – Partner Center app overview → Store Product ID

T8b949e# MSSTORE_CLIENT_ID – app registration client ID

T8b949e# MSSTORE_CLIENT_SECRET – client secret for that app registration

T8b949e# microsoft/store-submission is a thin wrapper over the stable Store

T8b949e# submission API v1; it declares node16 and the runner transparently

T8b949e# executes it on a current Node with a deprecation warning.

Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffConfigureTa5d6ff Ta5d6ffStoreTa5d6ff Ta5d6ffcredentials

Tff7b72ifTb4b4b4: Ta5d6ffenv.HAS_MSSTORE_CREDSTa5d6ff Ta5d6ff==Ta5d6ff Ta5d6ff'true'

Tff7b72usesTb4b4b4: Ta5d6ffmicrosoft/store-submission@v1

Tff7b72withTb4b4b4:

Tff7b72commandTb4b4b4: Ta5d6ffconfigure

Tff7b72typeTb4b4b4: Ta5d6ffwin32

Tff7b72seller-idTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.MSSTORE_SELLER_IDTa5d6ff Ta5d6ff}}

Tff7b72product-idTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.MSSTORE_PRODUCT_IDTa5d6ff Ta5d6ff}}

Tff7b72tenant-idTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.MSSTORE_TENANT_IDTa5d6ff Ta5d6ff}}

Tff7b72client-idTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.MSSTORE_CLIENT_IDTa5d6ff Ta5d6ff}}

Tff7b72client-secretTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.MSSTORE_CLIENT_SECRETTa5d6ff Ta5d6ff}}

T8b949e# Full replace of the draft submission's package set (PUT semantics):

T8b949e# the listing always points at exactly the current production MSI.

T8b949e# Field values follow Microsoft's documented MSI example — silent

T8b949e# install via msiexec flags; genericDocUrl/errorDetails are EXE-only.

Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffUpdateTa5d6ff Ta5d6ffdraftTa5d6ff Ta5d6ffsubmissionTa5d6ff Ta5d6ffwithTa5d6ff Ta5d6ffnewTa5d6ff Ta5d6ffMSI

Tff7b72ifTb4b4b4: Ta5d6ffenv.HAS_MSSTORE_CREDSTa5d6ff Ta5d6ff==Ta5d6ff Ta5d6ff'true'

Tff7b72usesTb4b4b4: Ta5d6ffmicrosoft/store-submission@v1

Tff7b72withTb4b4b4:

Tff7b72commandTb4b4b4: Ta5d6ffupdate

Tff7b72product-updateTb4b4b4: Tb4b4b4>Tb4b4b4-

Tff7b72{"packages":[{

Tff7b72"packageUrl":"${{ steps.msi.outputs.url }}",

Tff7b72"languages":["en-us"],

Tff7b72"architectures":["X64"],

Tff7b72"isSilentInstall":true,

Tff7b72"installerParameters":"/quiet /norestart",

Tff7b72"packageType":"msi"

Tff7b72}]}

T8b949e# Fire-and-forget: this starts Store certification, which takes 1–3

T8b949e# business days. Track progress in Partner Center; a rejection there

T8b949e# does not surface here.

Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffPublishTa5d6ff Ta5d6ffsubmission

Tff7b72ifTb4b4b4: Ta5d6ffenv.HAS_MSSTORE_CREDSTa5d6ff Ta5d6ff==Ta5d6ff Ta5d6ff'true'

Tff7b72usesTb4b4b4: Ta5d6ffmicrosoft/store-submission@v1

Tff7b72withTb4b4b4:

Tff7b72commandTb4b4b4: Ta5d6ffpublish