Packaging knowledge
CI/CD for packaging without uploading installers
Metadata jobs, API keys and audit: connecting packaging to a pipeline without moving sources off-site.
What the API does and does not do
A packaging API automates the run, not the decision. It produces packages or metadata; it does not check silent parameters for you and does not replace the Windows test.
Expect otherwise and you build a pipeline that produces wrong packages faster.
Metadata-only jobs
The interesting part for regulated environments: jobs that produce metadata only, without storing vendor files. Sources stay local, the pipeline receives the result and the review state. That is the difference between automation and outsourcing.
According to the documentation, enterprise API keys are workspace-bound, stored hashed and limited to defined scopes.
Keys and scopes
A key belongs to a workspace, not a person. It has the rights its job needs — no more. A key that can do everything is an operational risk once it sits in a pipeline.
Audit events
A pipeline without audit is a black box. Who started which job when, which package was created, which step failed — that belongs in a log. Otherwise the failure cannot be reconstructed after the next run.
A typical pipeline
Check the source, produce metadata, build the package, mark review points, store the result. The Windows test remains a separate step — automated or manual, but visible.
---