[junegunn]

Based on @meop's branch from #4943, with fixes on top.

Problem

winget installs fzf as a portable package, so it runs fzf.exe through a symlink in %LOCALAPPDATA%\Microsoft\WinGet\Links. A non-admin user created that link, and an administrator's SSH session refuses to follow it (error 448, "The path cannot be traversed because it contains an untrusted mount point").

Changes

• Build .msi installers for amd64 and arm64 with WiX 5 on a Windows runner (@meop)
  • The MSI installs fzf.exe under Program Files and adds it to the system PATH
• Add the MSIs to the winget manifest (@meop)
• goreleaser creates a draft release. The msi job uploads the MSIs and then publishes it.
  • Previously, winget.yml could start before the MSIs existed and leave them out of the manifest
  • If the msi job fails, the release stays a draft
  • replace_existing_draft keeps a retried release job from creating a second draft
  • The msi job fails if the release is already published, so a re-run cannot replace published MSIs
• Only one approval per release, as before
  • The msi job publishes with GITHUB_TOKEN, so it does not need the release environment
  • A release published with GITHUB_TOKEN does not trigger other workflows, so release.yml calls winget.yml directly through workflow_call
  • winget.yml runs with a read-only token
• Add the MSIs to fzf_<ver>_checksums.txt
• Skip the MSI build for versions with a suffix such as -rc1, which MSI does not support
• Remove make release. It would push master while the release was still a draft.
• Update RELEASE.md for the draft flow

Testing

• Validation runs on this repo build both MSIs
• @meop tested the amd64 MSI from a validation run in an admin SSH session (Offer an MSI installer on winget so fzf works in admin SSH sessions on Windows #4943)
• @meop ran the real flow from tag pushes on a fork (see the review comment): draft and publish, checksums, the winget job, an -rc1 prerelease, and install, upgrade, and uninstall of both MSIs

Not tested:

• Retrying the release job over an existing draft
• The actual winget submission with the MSIs
• The guard against re-running the msi job after publishing

Close #4943

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Approval should be deferred because the release path’s draft publication, Windows MSI and checksum uploads, and post-publish WinGet workflow remain unverified in an end-to-end real-tag run.

No open issues 🎉

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

Release retries can create duplicate drafts and publish an incomplete one, while the winget job exposes a write-capable repository token to an unpinned dependency.

2 open issues

• Limit the Winget job token to read-only contents access · New
• Replace existing draft when retrying a release · New

_{Review effort: Max}

[Copilot]

🔵 Needs a closer look

An unpublished, optional concern about the WiX usage command’s working-directory assumptions needs human judgment on its relevance to approval.

No open issues 🎉

2 resolved since last review

• Replace existing draft when retrying a release
• Limit the Winget job token to read-only contents access

_{Review effort: Max}

[meop]

I reviewed the diff and it looks good to me. Nothing blocking.

I also ran the real flow from tag pushes on my fork, since the PR lists it as untested, with Claude Code doing the runs: v0.99.11, v0.99.12, v0.99.13-rc1.

• Draft and publish: goreleaser's draft ends up published and becomes latest over the older releases.
• Checksums: both MSIs are in the file and the downloads match. Re-running the msi job doesn't duplicate the lines.
• winget job: called through workflow_call, it finds both zips and both MSIs. Its token is read-only (a write attempt got a 403).
• -rc1: published as a prerelease with no MSIs, winget skipped, latest unchanged.
• MSIs, x64 and arm64: installing over the previous version leaves one Installed apps entry and one PATH entry. fzf.exe is the right architecture and runs from PATH. Uninstall removes the entry and folder, and restores PATH exactly.

How that differs from your release:

• goreleaser ran on Ubuntu with fewer targets and no notarization, using GITHUB_TOKEN instead of RELEASE_PAT.
• A stub replaced winget-releaser. It does the same release lookup and regex, but nothing was submitted, and Komac wasn't run.
• I didn't test retrying the release job over an existing draft (replace_existing_draft).
• The installs ran elevated on the runner, so no UAC. My earlier test on #4943 covered UAC on x64 only.

Small things, your call:

1. wix/main.wxs: the usage comment says wix build main.wxs, but Source="LICENSE" looks like it only resolves from the repo root, which is where CI runs it. wix build wix/main.wxs would match.
2. winget.yml: the regex still lists armv7, which has no Windows build now.
3. CHANGELOG.md: existing portable installs stay portable on winget upgrade, so those users need to uninstall and reinstall once to get the fix. That may be worth a line.
4. Re-running the msi job also re-runs the winget job, since it depends on msi. After a successful release, that would try to submit to winget again.

[junegunn]

Thanks, @meop. I've addressed your comments in the following commits.

[meop]

Thanks, the changes look good to me.

[junegunn]

Thanks for the review. I'll release a new version this weekend and see how it goes.

[meop]

Thank you for working on this so quickly.

[junegunn]

Please take a look: https://github.com/junegunn/fzf/releases/tag/v0.75.0