tools: update winget manifest on new release

[mdanish-kh]

Description

This PR proposes to add a GitHub action for submitting the latest stable release to WinGet as it gets published. microsoft/winget-create is used as the tool for generating and submitting the new manifests. The implementation assumes that the Installer URLs at https://nodejs.org/dist/ are available as soon as the release is published at GitHub.

---

Steps needed from maintainers

If the maintainers approve of these changes, they will need to do the following before merging this PR:

1. Fork microsoft/winget-pkgs under a personal or bot account. Looking at discussion in PR build: automate winget package creation #34014, I assume this can be done under the bot account @nodejs-github-bot
2. Create a personal access token (classic) with public_repo scope from the user account where the fork exists.
3. Store the created token in a repository secret with the name WINGET_CREATE_GITHUB_TOKEN

For reference, maintainers may see similar implemented actions in the following repos:

• Microsoft PowerToys
• Microsoft Terminal
• Microsoft Copilot CLI
• Microsoft Edit
• WinGet Studio
• Oh-My-Posh

---

Validation

Validated the action works as expected in a test repo. See the run https://github.com/mdanish-kh/test-wingetcreate/actions/runs/12976977036/job/36189859568

[nodejs-github-bot]

Review requested:

• @nodejs/actions

[ovflowd]

cc @nodejs/build @nodejs/releasers

[richardlau]

So I guess the question is, who is volunteering to keep this running on an ongoing basis? Unless there is interest from @nodejs/platform-windows I don't believe that the current Build WG and/or Release WG will be able to commit to this.

We are not able, for example, to commit to maintain packages for popular Linux distributions and/or Homebrew on macOS and this is no different.

[ljharb]

@ovflowd this seems like the same category of change as nodejs/nodejs.org#7296 (review) ?

[aduh95]

FWIW I'm maintaining the Node.js packages for NixOS, and currently the process is rather manual – everytime there's a new release out, I'm opening a PR from my own fork. I would happily volunteer to move that work to a GHA workflow if there's support for it (or at least no objections :P), once we have a working integration it might ease up adding more.

[ovflowd]

@ovflowd this seems like the same category of change as nodejs/nodejs.org#7296 (review) ?

Possibly, but if the question here is who is going to maintain this, quite sure not the Website team.

[ljharb]

I just meant that it's vendor-specific code, which in the linked PR you indicated you don't think should be in the project.

[github-actions]

This pull request has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.

[bnb]

I care about winget quite a bit - npm and JavaScript ecosystem DX was used as a reference, based on feedback that was requested from me by the team that was building it when I was at Microsoft.

I would love to help maintain this actively.

@aduh95 since you last commented, has the NixOS workflow changed at all? Perhaps this is a new team/WG? IMO the project maintaining these distributions in some way is extremely valuable, especially given the current ecosystem supply chain security attacks.

[mdanish-kh]

Since I got some interest above, I updated the workflow to follow the latest wingetcreate recommendations

edit: weird that my comment didn't remove the stale label
edit2: looks like it takes a few hours to do so