From 82e88431c94f5ac2ebd9ef9a04ab0b15f1facc08 Mon Sep 17 00:00:00 2001
From: Andrey Markelov <andreymarkelov@dropbox.com>
Date: Mon, 13 Jul 2026 12:10:00 -0700
Subject: [PATCH] Scope WinGet token to the submit step only

Move WINGET_CREATE_GITHUB_TOKEN from the winget job's env down to the
Submit WinGet manifest step. The secret is only needed when WingetCreate
opens the pull request, so the Download WingetCreate step no longer has
the token in its environment while fetching and checksumming the tool.
---
 .github/workflows/release.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8092882..14f74b5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,7 +60,6 @@ jobs:
     env:
       VERSION: ${{ needs.release.outputs.asset_version }}
       INSTALLER_URL: https://github.com/dropbox/dbxcli/releases/download/v${{ needs.release.outputs.asset_version }}/${{ needs.release.outputs.windows_archive }}
-      WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
     steps:
       - uses: actions/setup-dotnet@v5
         with:
@@ -78,6 +77,8 @@ jobs:
           }
       - name: Submit WinGet manifest
         shell: pwsh
+        env:
+          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
         run: |
           if ([string]::IsNullOrWhiteSpace($env:WINGET_CREATE_GITHUB_TOKEN)) {
             throw "The WINGET_CREATE_GITHUB_TOKEN repository secret is not configured"