fix(release): preserve PR notes and validate WinGet access

.github/workflows/pr-build.yml

@@ -184,4 +184,4 @@ jobs:
 
       - name: Test Tauri crate on Windows
         working-directory: packages/tauri-app/src-tauri
-        run: cargo test --locked
+        run: cargo test --locked -- --test-threads=1

.github/workflows/reusable-release.yml

@@ -80,11 +80,19 @@ jobs:
           if gh release view "$TAG" >/dev/null 2>&1; then
             echo "Release $TAG already exists"
           else
+            args=(--title "$TAG" --generate-notes)
+
             if [ "${IS_PRERELEASE}" = "true" ]; then
-              gh release create "$TAG" --title "$TAG" --generate-notes --prerelease
+              args+=(--prerelease)
             else
-              gh release create "$TAG" --title "$TAG" --generate-notes
+              pr_body="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls" \
+                --jq 'map(select(.merged_at != null and .base.ref == "main")) | sort_by(.merged_at) | last | .body // ""')"
+              if [ -n "$pr_body" ]; then
+                args+=(--notes "$pr_body")
+              fi
             fi
+
+            gh release create "$TAG" "${args[@]}"
           fi
 
   build-and-upload:

.github/workflows/update-winget.yml

@@ -117,7 +117,7 @@ jobs:
           echo "Resolved version: ${{ steps.release_asset.outputs.version }}"
           echo "Resolved SHA-256: ${{ steps.release_asset.outputs.asset_sha256 }}"
 
-      - name: Validate fork configuration
+      - name: Validate fork write access
         env:
           GH_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
           EXPECTED_OWNER: ${{ env.WINGET_FORK_OWNER }}
@@ -138,6 +138,14 @@ jobs:
             exit 1
           fi
 
+          default_branch="$(gh api "repos/$fork_name" --jq '.default_branch')"
+          default_sha="$(gh api "repos/$fork_name/git/ref/heads/$default_branch" --jq '.object.sha')"
+          test_branch="codenomad-winget-token-check-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          gh api --method POST "repos/$fork_name/git/refs" \
+            -f ref="refs/heads/$test_branch" \
+            -f sha="$default_sha" >/dev/null
+          gh api --method DELETE "repos/$fork_name/git/refs/heads/$test_branch" >/dev/null
+
           echo "Validated fork: $fork_name"
 
       - name: Submit update to Winget

docs/guides/winget-release-automation.md

@@ -14,7 +14,7 @@ CodeNomad publishes Winget updates from the stable GitHub release pipeline. `.gi
 
 ### Repository secret
 
-- `WINGET_GITHUB_TOKEN`: Classic GitHub PAT with `public_repo` scope.
+- `WINGET_GITHUB_TOKEN`: GitHub token with write access to the configured fork (for example, a classic PAT with `public_repo` scope or a GitHub CLI OAuth token with `repo` scope).
   - The token owner must own the fork that submits to `microsoft/winget-pkgs`.
   - Komac-based submission cannot open the PR with a fine-grained token today.
 
@@ -33,7 +33,7 @@ CodeNomad publishes Winget updates from the stable GitHub release pipeline. `.gi
 1. Resolve the target release by tag through the GitHub API, then derive the package version from the resolved release tag.
 2. Poll the release API until exactly one uploaded asset matches the configured Windows Tauri asset template.
 3. Download the matched asset once and compute a SHA-256 for logging and verification.
-4. Verify the PAT owner matches `WINGET_FORK_OWNER` and that `${WINGET_FORK_OWNER}/winget-pkgs` is a fork of `microsoft/winget-pkgs`.
+4. Verify the token owner matches `WINGET_FORK_OWNER`, that `${WINGET_FORK_OWNER}/winget-pkgs` is a fork of `microsoft/winget-pkgs`, and that the token can create and delete a temporary branch.
 5. Invoke `vedantmgoyal9/winget-releaser@v2`, which uses Komac under the hood to update the existing `NeuralNomadsAI.CodeNomad` manifest and open the PR.
 
 ## Notes