Automate dependency maintenance and prepare WinGet submission

[harder]

Changes

• Cover NuGet projects, GitHub Actions, and the pinned .NET SDK with Dependabot, lock files, grouped critical package updates, dependency review, and CodeQL (including Dependabot PRs).
• Monitor Terminal.Gui develop prereleases and WinGet stable/preview releases; create assigned, deduplicated issues with compatibility checks and Copilot review prompts.
• Gate releases on tag/version validation, tests, x64/ARM64 AOT builds, required COM files, signing configuration, checksums, and provenance attestations. Reject reruns of published tags and prevent asset overwrites.
• Publish the portable ZIPs as the initial WinGet package. Download the released ZIP bytes before generating the three-file community manifest set.
• Document the current ZIP signing status, later signed MSIX path, Azure Artifact Signing setup, PATH behavior, and one-command manifest preparation.

Validation

• 311 .NET tests passed in the earlier PR update.
• Node dependency-monitor test, actionlint, PowerShell script parse, and diff checks passed for this update.
• Windows ARM64 and x64 Native AOT publish, COM companion checks, and mock startup passed in CI before this update.
• winget validate accepted a generated manifest set from synthetic ZIP assets in the earlier PR update.

After merge

Cut a new versioned release. Its successful workflow run will provide winget-manifests-<version>; packaging/prepare-winget-submission.ps1 can regenerate the same manifest set from the published ZIPs. Test install, upgrade, and uninstall in Windows Sandbox before submitting the YAML files to microsoft/winget-pkgs.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Copilot review overview

🟡 Changes recommended

CI execution, dependency-version handling, and prerelease manifest generation contain blockers that need correction.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Run ARM64 startup checks only on native ARM64 hosts · New
• Skip WinGet manifests and uploads for prerelease tags · New
• Keep mocked project version current in NuGet feed fixture · New
• Pin SDK versions consistently with locked tool packs · New

What changed in this PR

This PR automates Scout’s dependency maintenance and strengthens release packaging ahead of WinGet community submission.

Changes:

• Adds dependency monitoring, lock files, and security checks.
• Gates releases on validation, native builds, signing configuration, and artifact checks.
• Generates portable-package WinGet manifests and documents submission.

File	Description
tests/​packages.lock.json	Locks test dependencies.
README.md	Clarifies WinGet availability and signed MSIX downloads.
packaging/​WINGET-SUBMISSION.md	Documents community submission and validation.
packaging/​new-winget-manifest.ps1	Generates manifests from checked release ZIPs.
packages.lock.json	Locks application and native-build dependencies.
code-signing.md	Documents signing configuration and limitations.
.github/​workflows/​release.yml	Adds release gates, attestations, and manifest generation.
.github/​workflows/​critical-dependencies.yml	Schedules upstream dependency monitoring.
.github/​workflows/​codeql.yml	Adds C# and Actions security analysis.
.github/​workflows/​ci.yml	Adds dependency review and native compatibility checks.
.github/​scripts/​critical-dependencies.test.js	Tests monitoring and issue deduplication.
.github/​scripts/​critical-dependencies.js	Creates release-specific compatibility issues.
.github/​dependabot.yml	Expands coverage and groups related updates.
.github/​copilot-instructions.md	Adds repository-specific review guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Release integrity and security-scanning issues remain, while signed MSIX publication and portable upgrades need human validation.

Review effort: Balanced
Findings: 1

Open (1)

• Prevent published-tag reruns from changing release ZIP bytes · New

Resolved since last review (4)

• Skip WinGet manifests and uploads for prerelease tags
• Run ARM64 startup checks only on native ARM64 hosts
• Pin SDK versions consistently with locked tool packs
• Keep mocked project version current in NuGet feed fixture

Previously missed (1)

In code that hasn't changed since last review

Run CodeQL analysis on Dependabot pull requests

.github/​workflows/​codeql.yml:19

This guard skips both CodeQL analyses on every Dependabot PR, including Actions updates. GitHub permits SARIF uploads from pull_request runs with Dependabot's read-only token; the push-event restriction does not apply here. Allow pull-request runs through the guard so dependency updates receive security analysis before merging.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Copilot review overview

🟡 Changes recommended

Release publication and draft recovery remain unsafe, and MSIX builds bypass locked dependency restoration.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Reject existing draft releases before reruns · New
• Stage prereleases as drafts before uploading assets · New
• Use locked Identity-mode restore for MSIX builds · New

Resolved since last review (1)

• Prevent published-tag reruns from changing release ZIP bytes

Files excluded by content exclusion policy (1)

• .gitignore

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Copilot review overview

🔵 Needs a closer look

Release publication, signing, and WinGet installation and upgrade behavior need final human validation on Windows.

Review effort: Balanced
Findings: None

Resolved since last review (3)

• Stage prereleases as drafts before uploading assets
• Reject existing draft releases before reruns
• Use locked Identity-mode restore for MSIX builds

Files excluded by content exclusion policy (1)

• .gitignore