ci: add WinGet publish workflow for release-based MSI submissions

[maximilian-schwaerzler]

Description

This PR adds automated WinGet publishing for AltSendme Windows releases.

What’s included

• Adds a new workflow: .github/workflows/publish-winget.yml.
• Triggers on release.published and skips draft/prerelease releases.
• Derives the package version from the release tag by stripping a leading v.
• Uses vedantmgoyal2009/winget-releaser@v2 to submit/update TonyAntony.AltSendme.
• Targets the MSI installer asset pattern (AltSendme_*_x64_*.msi) and sets installer-type: wix.
• Uses WINGET_TOKEN for authentication.
• Documents the release automation in CONTRIBUTING.md (workflow trigger, required secret, MSI preference rationale).

Why MSI instead of NSIS?

MSI/WiX is preferred for WinGet reliability and enterprise/silent deployment compatibility.

Checklist

• I have run npm run lint before raising this PR
• I have run npm run format before raising this PR

[coderabbitai]

📝 Walkthrough

Walkthrough

A GitHub Actions workflow was added to publish a Windows package to WinGet on release publish; it derives the package version from the release tag (strips leading v) and runs a winget-releaser action. Documentation about this release automation was added to CONTRIBUTING.md.

Changes

Cohort / File(s)	Summary
Winget Publishing Workflow .github/workflows/publish-winget.yml	Adds a new workflow triggered on release.published that derives version from the release tag (strips leading v) and runs vedantmgoyal2009/winget-releaser on ubuntu-latest with configured identifier, installer regex, metadata, and WINGET\_TOKEN for authentication.
Documentation CONTRIBUTING.md	Adds a Release Automation section documenting the WinGet publishing workflow, trigger (release.published), required secret (WINGET\_TOKEN), WinGet package id TonyAntony.AltSendme, and MSI asset selection criteria (AltSendme_*_x64_*.msi, prefer MSI over NSIS).

🚥 Pre-merge checks | ✅ 1

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between da41438 and 07fcc6a.

📒 Files selected for processing (2)

• .github/workflows/publish-winget.yml
• CONTRIBUTING.md

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

.github/workflows/publish-winget.yml (1)

29-29: ⚠️ Potential issue | 🟠 Major

Fix MSI asset regex escaping to actually match filenames.

At Line 29, 'AltSendme_.*_x64_.*\\.msi' is over-escaped in a YAML single-quoted string and can miss valid .msi assets. This can block publishing.

Proposed fix

-          installers-regex: 'AltSendme_.*_x64_.*\\.msi'
+          installers-regex: '^AltSendme_.*_x64_.*\.msi$'

#!/bin/bash
# Verify current vs fixed regex behavior against a representative MSI filename.
python - <<'PY'
import re
sample = "AltSendme_1.2.3_x64_en-US.msi"
current = r"AltSendme_.*_x64_.*\\.msi"
fixed = r"^AltSendme_.*_x64_.*\.msi$"
print("sample:", sample)
print("current fullmatch:", bool(re.fullmatch(current, sample)))  # expected False
print("fixed fullmatch:", bool(re.fullmatch(fixed, sample)))      # expected True
PY

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 07fcc6a and d17b227.

📒 Files selected for processing (1)

• .github/workflows/publish-winget.yml

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/publish-winget.yml (1)

21-23: 🧹 Nitpick | 🔵 Trivial

Consider explicit tag-format validation before stripping v.

At Line 23, ${TAG#v} assumes the tag shape implicitly. A quick validation makes failures faster to diagnose if someone publishes with an unexpected tag.

Suggested hardening

       run: |
         TAG="${{ github.event.release.tag_name }}"
+        if [[ ! "$TAG" =~ ^v[0-9]+(\.[0-9]+){1,3}$ ]]; then
+          echo "Unexpected tag format: $TAG (expected vX.Y or vX.Y.Z or vX.Y.Z.W)"
+          exit 1
+        fi
         echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
         echo "value=${TAG#v}" >> "$GITHUB_OUTPUT"

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d17b227 and 7518dea.

📒 Files selected for processing (1)

• .github/workflows/publish-winget.yml

[tonyantony300]

Hi @maximilian-schwaerzler ,

Thank you for this contribution, will review very soon.

[tonyantony300]

Added correction PR #135
Same changes closing this