ci: migrate from the deprecated microsoft/store-submission action to the MSStore CLI

[azchohfi]

Why

microsoft/store-submission is deprecated and the repository is being archived (see microsoft/store-submission#27). Archiving does not break anything — uses: microsoft/store-submission@v1 will keep resolving — but there will be no further fixes, features, or security updates, and it has open issues that will never be addressed (notably #20: no certificate or federated/managed-identity auth).

The supported replacement is the MSStore CLI, put on the runner by microsoft/microsoft-store-apppublisher (the action formerly named microsoft/setup-msstore-cli). It handles both packaged (MSIX) and unpackaged (MSI/EXE) apps and is actively maintained. microsoft/PowerToys already runs on it.

I'm doing a sweep of the repos still referencing the old action so nobody is caught out by the archive.

What changed

.github/workflows/deploy-microsoft-store.yml now sets up the MSStore CLI and submits the locally built MSIX with a single msstore publish call.

Why it's not a 1:1 step swap

The old Update Submission with local MSIX step passed

product-update: |
  { "packages": [ { "filePath": "${{ env.msix_path }}", … } ] }

filePath was never a field the action understood — its product-update payload only supports packageUrl (a public HTTPS URL), so a local path could not have worked. The workflow has 0 recorded runs, which is consistent with that.

msstore publish <path-to-.msix> is the supported route for a local package: it uploads the package, updates the draft submission and commits it in one call — so it replaces both the update and publish steps. The configure step becomes msstore reconfigure with the same four secrets.

Please double-check that secrets.PRODUCT_ID is the Store app ID for a packaged (MSIX) product — msstore publish --appId expects that rather than the GUID used for EXE/MSI products.

Command mapping used

microsoft/store-submission	MSStore CLI
command: configure + tenant-id/seller-id/client-id/client-secret	msstore reconfigure --tenantId … --sellerId … --clientId … --clientSecret …
command: update + product-update	msstore submission update <productId> '<json>'
command: publish	msstore submission publish <productId>
type: win32 / type: packaged	dropped — the CLI resolves the product type itself

Notes

• No secrets added or renamed — this uses exactly the same ones the workflow already referenced.
• The JSON payload is unchanged. msstore submission update deserializes into UpdatePackagesRequest → { "packages": [ { packageUrl, languages, architectures, isSilentInstall, installerParameters, packageType, genericDocUrl, … } ] }, which is the same shape product-update took, so the payload carried over verbatim.
• Secret values are passed via env: and referenced as shell variables rather than interpolated straight into the command line — same behaviour, and it keeps them out of the process command line.
• I can't execute this pipeline against your Partner Center product, so please sanity-check before merging. Happy to adjust anything.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[jirimaier]

As far as I know, the automatic upload to MS store is not possible with personal Microsoft account, so I need to do it manually anyway.

[azchohfi]

You may have more options here than you'd expect — the requirement is a Microsoft Entra ID tenant associated with Partner Center, which isn't the same thing as needing a company/organizational account.

If you don't already have a tenant, you can create one from within Partner Center at no additional charge, then associate it with your account under Account settings → Tenants. From there you'd register an Entra application with the Manager role, which gives you the tenant ID, client ID and secret the CLI needs.

That said — totally your call whether it's worth the setup. If manual submission works fine for you, feel free to close this; I mainly wanted to flag the option in case it was ruled out on a misunderstanding. Either way the old action is going away, so this file would just be dead weight otherwise.