fix(release): re-enable the winget release job

[Matovidlo]

Summary

• Re-enables the winget job in .github/workflows/release-kbagent.yml, restoring its original trigger condition (needs.version.outputs.IS_PRERELEASE == 'false' && startsWith(github.ref, 'refs/tags/')) in place of the hardcoded if: false.
• Updates the job's comments, which had gone stale: they claimed Keboola.KeboolaCLI2 had "never had its first submission" to microsoft/winget-pkgs, blocking wingetcreate update from having anything to bump.
• That's no longer true — the one-time bootstrap wingetcreate submit was already done by hand on 2026-09-07 (microsoft/winget-pkgs PR #409446), creating the Keboola.KeboolaCLI2 manifest starting at version 0.79.0. Nobody flipped the job back on afterward, so every release since (up through the current 0.93.2) has silently skipped winget publishing even though the blocker was gone.
• WINGET_TOKEN is already present as a release-environment secret (set 2026-06-15), so no secret changes are needed here.

Test plan

• Workflow-only change; no application code paths affected.
• Verified via the GitHub API that the Keboola.KeboolaCLI2 manifest exists on microsoft/winget-pkgs@master (manifests/k/Keboola/KeboolaCLI2/0.79.0) and that WINGET_TOKEN is set in this repo's release environment.
• Can't fully dry-run the winget job locally (it publishes to an external repo and only runs on a real version tag); the real verification is watching the job on the next tagged release and confirming a new microsoft/winget-pkgs PR opens with the correct version/URL/hash.

Related

• Follow-up to docs: step-by-step manual for creating WINGET_TOKEN #710 (docs-only PR adding a manual for creating WINGET_TOKEN), whose text about the bootstrap submission being outstanding is now stale — this PR is the actual fix that makes the job run again.
• No Linear issue.

[keboola-pr-reviewer-bot]

Verdict: needs_human (risk 4/5) · profile _default

Head commit has failing checks (check, test (3.12)); no required-check rules discovered on the base branch, falling back to block-on-any-failure.

[Copilot]

🔵 Needs a closer look

Remove the Chocolatey gating risk and update the now-stale README guidance.

Pull request overview

Re-enables automated WinGet publishing for stable tagged releases now that the package manifest exists.

Changes:

• Restores the stable-tag condition for the winget job.
• Updates comments documenting the completed bootstrap manifest.
• Uses the existing WINGET_TOKEN secret.

File summaries

File	Summary	Findings
.github/workflows/release-kbagent.yml	Re-enables and documents WinGet release publishing.	Moderate (1 vote): Chocolatey remains a transitive dependency and can prevent WinGet publishing. Nit (1 vote): Update README.md package-manager guidance.

Review details

Suppressed comments (2)

.github/workflows/release-kbagent.yml:625

• Once this job is re-enabled, README.md:53 still tells users that no WinGet package exists or has been submitted. That will become incorrect after the next tagged release, so please update the current package-manager guidance alongside this workflow (historical changelog notes can remain historical).

  # The one-time bootstrap `wingetcreate submit` this job used to be blocked on
  # has already happened by hand: `Keboola.KeboolaCLI2` has a manifest on
  # microsoft/winget-pkgs starting at 0.79.0 (winget-pkgs PR #409446). That
  # manifest is what `wingetcreate update` below now bumps on every release.

.github/workflows/release-kbagent.yml:628

• Now that this condition activates the job, it is still transitively gated by chocolatey through needs; a Chocolatey publish failure (or duplicate-version rerun) makes GitHub skip WinGet even though WinGet only consumes the S3 ZIP produced by publish-s3. That can silently miss the WinGet PR, so remove chocolatey from this dependency (or explicitly handle its failure with always()).

    needs: [version, chocolatey, publish-s3]
    if: needs.version.outputs.IS_PRERELEASE == 'false' && startsWith(github.ref, 'refs/tags/')

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[soustruh]

Approved. Minimal, scoped fix that re-enables the winget release job. CI is green.