use env variable instead of inline token + update URLs

Author: mdanish-kh

.github/workflows/update-winget.yml

@@ -9,6 +9,12 @@ jobs:
     name: Submit to WinGet repository
     # wingetcreate is only supported on Windows
     runs-on: windows-latest
+    permissions:
+      contents: read
+    env:
+      # wingetcreate will read the following environment variable to access the GitHub token needed for submitting a PR
+      # Reference: https://aka.ms/winget-create-token
+      WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
     # Only submit stable releases
     if: ${{ !github.event.release.prerelease }}
     steps:
@@ -19,21 +25,22 @@ jobs:
           # Get installer info from release event
           $packageVersion = (${{ toJSON(github.event.release.tag_name) }}).Trim('v')
           $releaseDate = (Get-Date ${{ toJSON(github.event.release.published_at) }}).ToString("yyyy-MM-dd")
-          $x64InstallerUrl = "https://nodejs.org/dist/v$packageVersion/node-v$packageVersion-x64.msi"
-          $arm64InstallerUrl = "https://nodejs.org/dist/v$packageVersion/node-v$packageVersion-arm64.msi"
+          $x64MSIUrl = "https://nodejs.org/dist/v$packageVersion/node-v$packageVersion-x64.msi"
+          $x64PortableUrl = "https://nodejs.org/dist/v$packageVersion/node-v$packageVersion-win-x64.zip"
+          $arm64MSIUrl = "https://nodejs.org/dist/v$packageVersion/node-v$packageVersion-arm64.msi"
+          $arm64PortableUrl = "https://nodejs.org/dist/v$packageVersion/node-v$packageVersion-win-arm64.zip"
           $releaseNotesUrl = "https://github.com/nodejs/node/releases/tag/v$packageVersion"
 
           # Download wingetcreate portable executable
-          Invoke-WebRequest https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
+          curl.exe -JLO https://aka.ms/wingetcreate/latest
 
           # Update manifest with new version & URLs
           # Not using --submit flag with update as we want to make manual changes to manifests & then submit
           .\wingetcreate.exe update $wingetPackageID `
             --version $packageVersion `
-            --urls $x64InstallerUrl $arm64InstallerUrl `
+            --urls $x64MSIUrl $x64PortableUrl $arm64MSIUrl $arm64PortableUrl `
             --release-date $releaseDate `
-            --release-notes-url $releaseNotesUrl `
-            --token "${{ secrets.WINGET_GITHUB_TOKEN }}"
+            --release-notes-url $releaseNotesUrl
 
           # The update command will output the manifests in the following path
           $outputRelativePath = "manifests/o/OpenJS/NodeJS/$packageVersion/"
@@ -62,5 +69,4 @@ jobs:
 
           # Submit the updated manifests to winget-pkgs repository
           .\wingetcreate.exe submit $outputRelativePath `
-            --token "${{ secrets.WINGET_GITHUB_TOKEN }}" `
             --prtitle "New version: $wingetPackageID version $packageVersion"