winui-packaging
MSIX packaging, code signing, and distribution for WinUI 3 apps with WinApp CLI 0.7+ — SDK-native project packaging, Native AOT, certificates, self-contained deployment, CI/CD, and Microsoft Store handoff. Use when preparing for release, creating MSIX installers, managing certificates, setting up CI/CD packaging, or publishing to the Microsoft Store.
- Installs
- 169
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/microsoft/win-dev-skills --skill winui-packaging- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads winui-packaging automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Requires WinApp CLI 0.7+. For analyzer setup, see winui-dev-workflow.
Quick Reference
| Task | Command |
|---|---|
| Release package + sign | winapp package .\MyApp.csproj --arch x64 --cert .\devcert.pfx |
| Unsigned multi-architecture bundle | winapp package .\MyApp.csproj --arch x64 --arch arm64 --no-sign |
| Generate dev certificate | winapp cert generate |
| Trust certificate (admin) | winapp cert install ./devcert.pfx |
| Sign existing file | winapp sign ./app.msix ./devcert.pfx |
| Bundle Windows App SDK runtime | winapp package .\MyApp.csproj --arch x64 --cert .\devcert.pfx --self-contained |
End-to-End Workflow
Step 1: Check the Project and Deployment Intent
- Pass the explicit project file, not
.or a guessedbinfolder. WinUI project packaging uses SDK-nativedotnet publishpackaging, defaults to Release, and preserves project AOT settings. - Check manifest identity, target architectures, the SDK for the app's TFM, and release warnings.
- For Native AOT, set
<PublishAot>true</PublishAot>in the project and fix IL/CsWinRT warnings; there is nowinapp package --aot. AOT also needs the MSVC C++ build tools. See source-generator patterns. - Project packaging rejects
WindowsPackageType=None; restore the packaged setting first (seewinui-dev-workflowCritical Rules).
Do not run/register/unregister a development package just to produce release artifacts. Project packaging builds without a development winapp run --no-launch step. For WinUI SDK-native packaging, do not pass layout overrides --manifest, --executable, or --skip-pri; fix the project/manifest instead.
Step 2: Generate Certificate (one-time)
winapp cert generate --manifest .\Package.appxmanifest
Creates a development devcert.pfx (default password: password). This certificate command's --manifest flag auto-matches the Publisher field in Package.appxmanifest. Keep PFX files/passwords out of source control; production signing needs the organization's signing policy.
Step 3: Trust on the Intended Test Machine (optional, admin)
winapp cert install ./devcert.pfx
Adds the cert to the machine trust store and persists across reboots. Do this only with approval on the intended test machine; it is not required just to build/package in CI.
Step 4: Package and Sign
winapp package .\MyApp.csproj --arch x64 --cert .\devcert.pfx
# Repeat --arch for a bundle
winapp package .\MyApp.csproj --arch x64 --arch arm64 --no-sign
Choose one signing policy: --cert takes a PFX file, not a certificate thumbprint; its subject must match the manifest's Identity.Publisher. --no-sign leaves an artifact for external signing. Use the artifact paths reported by the command, not a guessed output directory.
For timestamped production signing, create an unsigned package then sign the resulting artifact:
# Replace MyApp.msix with the package/bundle path returned above
winapp sign .\MyApp.msix .\prod.pfx --timestamp http://timestamp.digicert.com
--timestamp belongs to winapp sign, not winapp package. Use an approved timestamp service and protect the PFX/password.
Step 5: Install or Distribute
When installation/testing is part of the task, choose the target per winui-ui-testing Step 1, and get consent for certificate trust and dependency provisioning on that machine. Packaging alone is not permission to install an app.
Self-Contained Does Not Mean Single-File
winapp package --self-contained sets only WindowsAppSDKSelfContained=true, not .NET SelfContained=true. For a fully self-contained JIT .NET app, set both in the project:
<PropertyGroup>
<SelfContained>true</SelfContained>
<WindowsAppSDKSelfContained>true</WindowsAppSDKSelfContained>
</PropertyGroup>
Native AOT covers the .NET runtime but still needs the Windows App SDK choice. Native WinUI runtime files stay alongside the executable/in the package; do not promise a single-file WinUI EXE. Some APIs still require additional MSIX dependencies; see the deployment guidance.
CI/CD
On a Windows runner provisioned with CLI 0.7+, the app's .NET SDK, and (for AOT) the native C++ toolchain, the packaging step can be:
winapp package .\MyApp.csproj --arch x64 --arch arm64 --no-sign
- Committed package references, including the analyzer, restore normally; no machine-local analyzer is needed.
- Archive the reported
.msix/.msixbundleoutputs using the CI system's artifact step. No UI launch or development registration is needed. - Retrieve production signing material through approved secret storage and sign in a separate protected step. Never commit a PFX or install a development root certificate just to build.
Store Submission
Associate the app with its Partner Center identity and follow its current submission requirements (package validation, ratings, screenshots, privacy policy). Use the SDK/Visual Studio packaging workflow when Store-upload artifacts or resource-package splitting are required. winapp package produces package artifacts; it does not publish to the Store or replace that submission workflow.
Troubleshooting
| Error | Solution |
|---|---|
| "Publisher mismatch" | Run winapp cert generate --manifest to re-generate |
| "Certificate not trusted" | Run winapp cert install ./devcert.pfx as admin |
| "Access denied" | cert install needs admin elevation |
| "Certificate file already exists" | Use --if-exists overwrite or --if-exists skip |
| Manifest missing / layout override rejected | Check the explicit project and its original manifest; do not use winapp init or layout overrides to bypass SDK packaging |
| "Package installation failed" | Check signing/trust and the exact conflicting identity; remove a stale registration only if confirmed and authorized |
| Signature invalid after time | Sign with an approved timestamp service via winapp sign --timestamp |
References
| File | Read when... |
|---|---|
| references/sourcegen-patterns.md | Setting up AOT/trimming, JSON source generators, Native AOT readiness, CsWin32 |
FAQ
What does the winui-packaging skill do?
MSIX packaging, code signing, and distribution for WinUI 3 apps with WinApp CLI 0.7+ — SDK-native project packaging, Native AOT, certificates, self-contained deployment, CI/CD, and Microsoft Store handoff. Use when preparing for release, creating MSIX installers, managing certificates, setting up CI/CD packaging, or publishing to the Microsoft Store.
How do I install winui-packaging?
Run npx skills add https://github.com/microsoft/win-dev-skills --skill winui-packaging in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/winui-packaging/ (personal) or .claude/skills/winui-packaging/ (project).
Which AI agents can use winui-packaging?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is winui-packaging safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains winui-packaging?
It is published by microsoft in microsoft/win-dev-skills, and it is an official skill from the maker of the technology it covers. It has 169 recorded installs.
More from microsoft/win-dev-skills
winui-design
microsoft/win-dev-skills
Open the skill to read its SKILL.md instructions.
winui-ui-testing
microsoft/win-dev-skills
Automated UI testing for Windows desktop apps — generate a batch test script with the winapp ui UI Automation harness (WinApp CLI 0.7+), run all tests in one pass, read results. Covers assertions, interactions, keyboard/touch/pen input, file pickers, dialogs, persistence, accessibility, and screenshot/video capture for Win32, WPF, WinForms, and WinUI 3, in Windows Sandbox or locally.
winui-code-review
microsoft/win-dev-skills
Code quality review for WinUI 3 apps — MVVM compliance, x:Bind correctness, accessibility, theming, security, and performance. Use before committing to catch issues that the compiler and UI tests won't find.
winui-dev-workflow
microsoft/win-dev-skills
Build and run workflow for WinUI 3 apps with WinApp CLI 0.7+ — project creation with winapp new, per-app NuGet analyzer setup, project-mode winapp run, Native AOT publish runs, crash diagnosis, and prerequisites. Use when creating, building, running, or fixing build errors in a WinUI 3 project.
winui-setup
microsoft/win-dev-skills
Install and verify WinUI 3 prerequisites — .NET SDK 8.0.100+, WinApp CLI 0.7+, and Developer Mode; identify additional Native AOT and Windows Sandbox requirements. Use when the user asks to set up or repair the toolchain, or when another WinUI skill finds a missing or outdated prerequisite.
pr-review
microsoft/win-dev-skills
Open the skill to read its SKILL.md instructions.
Popular devops & cloud skills
microsoft-foundry
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure
azure-diagnostics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
azure-prepare
microsoft/azure-skills
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
azure-deploy
microsoft/azure-skills
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.