[Twest2]

StepForge is live in the Microsoft Store (9NDH81CF1HGV). This PR updates the docs, builds the Store package in its own job, and has every stable release submit itself to Partner Center.

Release workflow

authorize-release
 ├─ build-windows          (.exe)
 ├─ build-windows-store    (.appx)   ← new job, was a step after the .exe
 ├─ build-linux
 └─ build-fedora
      └─ release (GitHub Release, waits for all four)
           ├─ publish-debian
           ├─ publish-fedora
           ├─ publish-chocolatey
           └─ publish-microsoft-store   ← new, stable releases only

• build-windows-store runs the same sign-in configuration and version stamp steps as the installer job, then npm run package:windows:store. It no longer uses --if-configured, because identity.json is filled in now, so a broken Store build fails the release. The .appx is still not attached to the GitHub Release.

• publish-microsoft-store installs Microsoft's Store Developer CLI (microsoft/microsoft-store-apppublisher@v1.4, pinned to CLI v0.4.3) and runs scripts/publish-microsoft-store.js:

  1. msstore reconfigure with the Partner Center credentials.
  2. If this Store version is already in certification or live, it stops. That makes re-dispatching the same version safe.
  3. msstore publish <pkg>.msix --appId 9NDH81CF1HGV --priceId Free --noCommit replaces any draft with a copy of the live submission and uploads the package. --priceId Free keeps the CLI from stopping when Partner Center returns per-market pricing that the submission API can't accept back.
  4. It marks every earlier package PendingDelete, then runs msstore submission update --payload. The CLI on its own only removes an old package with the same extension, so the hand-uploaded .appx from the first release would stay.
  5. msstore submission publish, then submission poll, which waits for Partner Center to accept the submission, not for certification.

  The CLI only accepts .msix, so the .appx is copied to StepForge_<storeVersion>_x64.msix. The bytes are the same; only the extension changes.

• storeVersion moved into a dependency-free scripts/store-version.js, so the submission job needs no npm ci. package-windows-store.js still exports it.

Setup needed before the next release

The submission job fails with a message naming whatever is missing until these exist:

1. In Partner Center, go to Account settings → User management → Microsoft Entra applications. Add an Entra ID app (or create one there) and give it the Manager role. Your Partner Center account needs an associated Entra tenant; Partner Center offers to create one.
2. In Entra (entra.microsoft.com), open that app and create a client secret under Certificates & secrets.
3. Add the IDs as repository variables and the secret as a repository secret:

gh variable set MICROSOFT_STORE_TENANT_ID -R Twest2/StepForge   # Entra → Overview → Tenant ID
gh variable set MICROSOFT_STORE_SELLER_ID -R Twest2/StepForge   # Partner Center → Account settings → Legal info → Seller ID
gh variable set MICROSOFT_STORE_CLIENT_ID -R Twest2/StepForge   # the app's Application (client) ID
gh secret set MICROSOFT_STORE_CLIENT_SECRET -R Twest2/StepForge

The submission copies the live submission's settings. If Partner Center is set to publish manually after certification, each release still waits for you to press Publish.

Docs

• Removed the "coming in the next couple of days" note from docs/windows/microsoft-store.md.
• The README, docs/windows_installation.md and docs/windows/microsoft-store.md now link to the listing instead of a Store search.
• Added Microsoft's official Get it from Microsoft badge to the README install section.
• docs/CONTRIBUTING.md and the script/workflow comments no longer link to the deleted MICROSOFT_STORE_RELEASE.md.

Testing

• npm test: 1121 pass, 0 fail.
• New tests/unit/publish-microsoft-store.test.js runs against a stand-in msstore. It covers the command order, the .msix name, the old .appx being marked PendingDelete and stale draft uploads being dropped, reruns skipping a version that is in certification or live, failed submissions being retried, missing credentials, and the workflow job's wiring.
• I checked the CLI behaviour the script relies on against the msstore-cli v0.4.3 source: the .msix-only extension check, same-extension package replacement, --payload, and clean JSON on stdout.
• actionlint reports no issues in the new jobs.
• Not yet run against Partner Center. That needs the credentials above and a real release.