{"slug": "i-built-relaypublisher-a-winget-like-publishing-workflow-for-microsoft-intune", "title": "I Built RelayPublisher: A winget-like Publishing Workflow for Microsoft Intune", "summary": "A developer created RelayPublisher, an open-source tool that publishes winget-like YAML manifests as Microsoft Intune LOB apps from CI. The tool enables application definitions to be managed as code, with commands for validation, planning, packaging, and publishing, and was made feasible by generative AI reducing development effort.", "body_md": "## Note about this article\n\nThe original version of this article was written entirely by me in Japanese.\n\nI used AI to translate and polish the English version for a global audience, but the ideas, design decisions, implementation details, and original content are all my own work.\n\nIf you'd like to read the original Japanese article, you can find it here:\n\nManaging custom applications in Microsoft Intune has always felt more complicated than it should be.\n\nWhen you need to publish an internal application, you typically have a few options:\n\nAll of these approaches work, but none of them feel particularly developer-friendly.\n\nIn my case, the process was even more frustrating because I normally don't operate with elevated privileges. Every time I needed to publish or update an application, I had to perform a PIM elevation before making changes.\n\nThat led me to a simple question:\n\nWhy can't Intune application publishing work more like winget?\n\nI wanted a workflow where application definitions could live in source control, be described in YAML, and be published automatically through CI/CD.\n\nThat idea became **RelayPublisher**.\n\nRelaypublisher publishes winget-like YAML manifests as Microsoft Intune LOB apps from CI.\n\nDistribution:\n\n`relaypublisher`\n\n`relaypublisher`\n\n`vX.Y.Z`\n\n`win-x64`\n\n, `win-arm64`\n\n, and `osx-arm64`\n\nare attached to each\nGitHub release. They are neither code-signed nor notarized, so macOS shows a Gatekeeper warning.Quick install:\n\n```\ndotnet tool install --global relaypublisher\n```\n\nSee [doc/05-operation.md](https://github.com/kkamegawa/Relaypublisher/doc/05-operation.md#0-tool-installation-and-version-control) for installing\nfrom GitHub Packages or Azure Artifacts instead.\n\nThe repository now contains the .NET CLI foundation for the normal workflow:\n\n`validate`\n\nchecks manifest schema rules and repository-wide identity uniqueness.`plan`\n\nresolves the target manifest set once and writes `manifest-list.json`\n\nfor later CI jobs.`package`\n\nstages app files: Windows Win32 `.intunewin`\n\npackages (Windows runner required) or a\nstaged, checksum-verified macOS `.pkg`\n\n(any OS).`publish`\n\ncreates or updates Intune apps, uploads packaged content…RelayPublisher is an open-source tool that allows you to define Intune applications using YAML and publish them through automation.\n\nInstead of clicking through the Intune portal, you manage application definitions as code.\n\nIf you're already familiar with Infrastructure as Code (IaC) or GitOps practices, the concept should feel natural.\n\nHistorically, building this type of tool felt like a lot of work.\n\nThere are many moving parts:\n\nThe emergence of generative AI significantly reduced the effort required to create and maintain a project like this. Tasks that would previously have been tedious became much easier to implement.\n\nAs a result, I was finally able to build the tool I had wanted for a long time.\n\nA sample YAML definition is included in the repository to help you get started quickly.\n\nExample:\n\n```\nSchemaVersion: \"1.0\"\nPackageIdentifier: Microsoft.PowerShell\nPackageName: PowerShell\nDeveloper: Microsoft Corporation\nPublisher: Microsoft Corporation\nDescription: PowerShell 7 cross-platform automation and configuration tool.\nPackageVersion: 7.6.5\nAssignmentSync: merge\n\nApps:\n  - Platform: macos\n    Architecture: arm64\n    InstallerType: pkg\n    # pkg (default): unmanaged macOSPkgApp, unsigned allowed, up to 8 GB, and the\n    # only AppType that can target MinimumOSVersion 14+ (v14_0/v15_0 are beta-only\n    # flags; see doc/01-manifest-schema.md 5.7 and MacOsMinimumOperatingSystemTable).\n    AppType: pkg\n    DisplayName: PowerShell [macOS ARM64]\n\n    # Single Source item for macOS (unified source item shape, doc/01-manifest-schema.md 5.0.1).\n    # PowerShell/PowerShell is a public repository, so Auth.Type: none is enough\n    # for anonymous asset download.\n    Source:\n      Type: githubRelease\n      Owner: PowerShell\n      Repository: PowerShell\n      Tag: v7.6.5\n      AssetName: powershell-7.6.5-osx-arm64.pkg\n      Destination: powershell-7.6.5-osx-arm64.pkg\n      Sha256: \"6ea58f4e91ab2df133ac18a42e291e4e870a623e3c5ab6f8368259cd9ac22770\"\n      Auth:\n        Type: none\n\n    Requirements:\n      # PowerShell 7.6 (LTS) supports macOS 14 (Sonoma), 15 (Sequoia), and 26 (Tahoe).\n      # 14.0 is the lowest version Relaypublisher's version table can map (26.0 is not\n      # yet defined there); AppType: pkg allows the beta-only v14_0 flag.\n      MinimumOSVersion: \"15.0\"\n\n    Detection:\n      IgnoreAppVersion: false\n      IncludedApps:\n        - BundleId: com.microsoft.powershell\n          BundleVersion: 7.6.5\n\n    # Optional, AppType: pkg only (doc/01-manifest-schema.md §5.4.2): pre/post-install\n    # shell scripts, mapped to Graph macOSPkgApp.preInstallScript/postInstallScript.\n    # Paths are relative to --repo-root (samples/, per this file's own README).\n    Scripts:\n      PreInstall: scripts/macos/powershell/preinstall.sh\n      PostInstall: scripts/macos/powershell/postinstall.sh\n\n    # Left empty so this manifest applies unmodified in any tenant. Add your own\n    # target group(s) before a real (non-dry-run) publish, for example:\n    # Assignments:\n    #   - Target: group\n    #     GroupId: \"<your-assignment-group-guid>\"\n    #     Intent: required\n    Assignments: []\n```\n\n", "url": "https://wpnews.pro/news/i-built-relaypublisher-a-winget-like-publishing-workflow-for-microsoft-intune", "canonical_source": "https://dev.to/kkamegawa/i-built-relaypublisher-a-winget-like-publishing-workflow-for-microsoft-intune-1oep", "published_at": "2026-09-01 05:09:19+00:00", "updated_at": "2026-09-01 05:51:56.886008+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["RelayPublisher", "Microsoft Intune", "winget", "GitHub", "PowerShell", "kkamegawa"], "alternates": {"html": "https://wpnews.pro/news/i-built-relaypublisher-a-winget-like-publishing-workflow-for-microsoft-intune", "markdown": "https://wpnews.pro/news/i-built-relaypublisher-a-winget-like-publishing-workflow-for-microsoft-intune.md", "text": "https://wpnews.pro/news/i-built-relaypublisher-a-winget-like-publishing-workflow-for-microsoft-intune.txt", "jsonld": "https://wpnews.pro/news/i-built-relaypublisher-a-winget-like-publishing-workflow-for-microsoft-intune.jsonld"}}