Avoid second environment approval for msi job

- msi job used RELEASE_PAT only so that publishing would trigger
  winget.yml, which required approving the release environment again
- Publish with GITHUB_TOKEN instead and call winget.yml directly
- Skip winget for prerelease versions, as the released event did

.github/workflows/release.yml

@@ -92,7 +92,6 @@ jobs:
   msi:
     needs: release
     runs-on: windows-latest
-    environment: release
     env:
       # MSI versions cannot have a suffix such as -rc1
       BUILD_MSI: ${{ !contains(needs.release.outputs.version, '-') }}
@@ -135,8 +134,6 @@ jobs:
           name: windows-msi
           path: dist/*.msi
 
-      # Publishing the draft triggers winget.yml, so it must come after the
-      # MSIs are uploaded
       - name: Upload MSI installers and publish release
         if: github.event_name == 'push'
         shell: bash
@@ -153,4 +150,15 @@ jobs:
           fi
           gh release edit "v$V" --draft=false
         env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_PAT }}
+          GITHUB_TOKEN: ${{ github.token }}
+
+  # Called directly because a release published with GITHUB_TOKEN does not
+  # trigger other workflows
+  winget:
+    needs: [release, msi]
+    if: github.event_name == 'push' && !contains(needs.release.outputs.version, '-')
+    uses: ./.github/workflows/winget.yml
+    with:
+      release-tag: v${{ needs.release.outputs.version }}
+    secrets:
+      WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}

.github/workflows/winget.yml

@@ -1,7 +1,13 @@
 name: Publish to Winget
 on:
-  release:
-    types: [released]
+  workflow_call:
+    inputs:
+      release-tag:
+        type: string
+        required: true
+    secrets:
+      WINGET_TOKEN:
+        required: true
   workflow_dispatch:
     inputs:
       release-tag:
@@ -16,6 +22,6 @@ jobs:
       - uses: vedantmgoyal2009/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
         with:
           identifier: junegunn.fzf
-          release-tag: ${{ inputs.release-tag || github.event.release.tag_name }}
+          release-tag: ${{ inputs.release-tag }}
           installers-regex: '-windows_(armv7|arm64|amd64)\.(zip|msi)$'
           token: ${{ secrets.WINGET_TOKEN }}