From 7fab255487c94013c2b766aa409e8ff85301d7e6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 17:12:01 +0000 Subject: [PATCH 1/2] Bump actions/setup-node from 6.4.0 to 7.0.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 134 +++++++++++------------ .github/workflows/release.yml | 198 +++++++++++++++++----------------- 2 files changed, 166 insertions(+), 166 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6da60fc..add9204 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,67 +1,67 @@ -name: CI - -on: - push: - branches: [main] - pull_request: - -# Least privilege: this workflow only needs to read the repo. -permissions: - contents: read - -# Cancel superseded runs for the same ref to save CI minutes. -concurrency: - group: ci-${{ github.ref }} - cancel-in-progress: true - -jobs: - check: - runs-on: ubuntu-latest - strategy: - # Test the oldest Node we claim to support (package.json engines) - # alongside current, so "works on my machine" can't hide an engines - # violation. - matrix: - node-version: [22, 24] - steps: - # Actions are pinned to commit SHAs (supply-chain hardening); the - # trailing comment records the human-readable version. v6 runs on the - # Node 24 action runtime, clearing the Node 20 deprecation warning. - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - # No step here pushes or calls the API; don't leave the token in - # .git/config for the rest of the job. - persist-credentials: false - - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: ${{ matrix.node-version }} - cache: npm - - - run: npm ci - - - name: Validate manifest.json parses - run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))" - - - run: npm run lint - - - run: npm run format:check - - - run: npm run typecheck - - - run: npm run coverage - - - run: npm run build - - # Merge gate: branch protection requires a single status named "check". - # Reporting that name from an aggregate job (instead of the matrix legs, - # whose names carry the Node version) keeps the required-check name - # stable no matter how the matrix changes. - ci-ok: - name: check - needs: check - if: always() - runs-on: ubuntu-latest - steps: - - name: Fail unless every matrix leg succeeded - run: test "${{ needs.check.result }}" = "success" +name: CI + +on: + push: + branches: [main] + pull_request: + +# Least privilege: this workflow only needs to read the repo. +permissions: + contents: read + +# Cancel superseded runs for the same ref to save CI minutes. +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +jobs: + check: + runs-on: ubuntu-latest + strategy: + # Test the oldest Node we claim to support (package.json engines) + # alongside current, so "works on my machine" can't hide an engines + # violation. + matrix: + node-version: [22, 24] + steps: + # Actions are pinned to commit SHAs (supply-chain hardening); the + # trailing comment records the human-readable version. v6 runs on the + # Node 24 action runtime, clearing the Node 20 deprecation warning. + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # No step here pushes or calls the API; don't leave the token in + # .git/config for the rest of the job. + persist-credentials: false + + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: ${{ matrix.node-version }} + cache: npm + + - run: npm ci + + - name: Validate manifest.json parses + run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))" + + - run: npm run lint + + - run: npm run format:check + + - run: npm run typecheck + + - run: npm run coverage + + - run: npm run build + + # Merge gate: branch protection requires a single status named "check". + # Reporting that name from an aggregate job (instead of the matrix legs, + # whose names carry the Node version) keeps the required-check name + # stable no matter how the matrix changes. + ci-ok: + name: check + needs: check + if: always() + runs-on: ubuntu-latest + steps: + - name: Fail unless every matrix leg succeeded + run: test "${{ needs.check.result }}" = "success" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f9706c0..5487623 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,99 +1,99 @@ -name: Release - -# Cut a release by pushing a tag like `v1.1.0` (must match manifest.json). -on: - push: - tags: - - "v*" - -permissions: - contents: write # create the GitHub Release and upload assets - -jobs: - release: - runs-on: ubuntu-latest - # Store-publishing credentials. Both publishing steps below are skipped - # when their secrets are absent, so the workflow degrades gracefully to - # a plain GitHub Release until the secrets are configured - # (repo Settings -> Secrets and variables -> Actions): - # AMO_JWT_ISSUER / AMO_JWT_SECRET - # addons.mozilla.org -> Tools -> Manage API Keys. Must belong to the - # AMO account that owns the gecko id in manifest.json. - # CWS_EXTENSION_ID / CWS_CLIENT_ID / CWS_CLIENT_SECRET / CWS_REFRESH_TOKEN - # Chrome Web Store item id + OAuth credentials for the CWS API - # (see https://developer.chrome.com/docs/webstore/using-api). - env: - AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }} - AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }} - CWS_EXTENSION_ID: ${{ secrets.CWS_EXTENSION_ID }} - CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }} - CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }} - CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }} - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: 24 - cache: npm - - - run: npm ci - - - name: Verify tag matches manifest version - run: | - manifest_version="v$(node -p "require('./manifest.json').version")" - if [ "$manifest_version" != "$GITHUB_REF_NAME" ]; then - echo "Tag $GITHUB_REF_NAME does not match manifest version $manifest_version" >&2 - exit 1 - fi - - - run: npm run build - - # Sign the .xpi with Mozilla so Firefox installs it permanently. - # `unlisted` is the self-distribution channel (installed by dragging - # the .xpi into Firefox, as the README describes) — switch to - # `--channel listed` only if the add-on moves to addons.mozilla.org, - # and note that listed submissions go through human review instead of - # returning a signed file immediately. AMO refuses to sign the same - # version twice, so re-running this workflow for an existing tag will - # fail here — bump the version instead. - - name: Sign the Firefox .xpi with Mozilla (AMO) - if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != '' - run: | - version="$(node -p "require('./manifest.json').version")" - mkdir -p /tmp/xpi-src /tmp/xpi-signed - unzip -q "github-pr-reverse-comments-${version}.xpi" -d /tmp/xpi-src - npx web-ext@8 sign \ - --source-dir /tmp/xpi-src \ - --channel unlisted \ - --api-key "$AMO_JWT_ISSUER" \ - --api-secret "$AMO_JWT_SECRET" \ - --artifacts-dir /tmp/xpi-signed - # Ship the signed file under the same name the Release step uploads. - mv /tmp/xpi-signed/*.xpi "github-pr-reverse-comments-${version}.xpi" - - # Upload the .zip to the Chrome Web Store and publish. Google's - # review still happens asynchronously on their side afterwards. - - name: Publish to the Chrome Web Store - if: >- - env.CWS_EXTENSION_ID != '' && env.CWS_CLIENT_ID != '' && - env.CWS_CLIENT_SECRET != '' && env.CWS_REFRESH_TOKEN != '' - env: - EXTENSION_ID: ${{ env.CWS_EXTENSION_ID }} - CLIENT_ID: ${{ env.CWS_CLIENT_ID }} - CLIENT_SECRET: ${{ env.CWS_CLIENT_SECRET }} - REFRESH_TOKEN: ${{ env.CWS_REFRESH_TOKEN }} - run: | - npx chrome-webstore-upload-cli@3 upload \ - --source github-pr-reverse-comments.zip \ - --auto-publish - - - name: Create GitHub Release with build artifacts - env: - GH_TOKEN: ${{ github.token }} - run: | - gh release create "$GITHUB_REF_NAME" \ - github-pr-reverse-comments.zip \ - github-pr-reverse-comments-*.xpi \ - --title "$GITHUB_REF_NAME" \ - --generate-notes +name: Release + +# Cut a release by pushing a tag like `v1.1.0` (must match manifest.json). +on: + push: + tags: + - "v*" + +permissions: + contents: write # create the GitHub Release and upload assets + +jobs: + release: + runs-on: ubuntu-latest + # Store-publishing credentials. Both publishing steps below are skipped + # when their secrets are absent, so the workflow degrades gracefully to + # a plain GitHub Release until the secrets are configured + # (repo Settings -> Secrets and variables -> Actions): + # AMO_JWT_ISSUER / AMO_JWT_SECRET + # addons.mozilla.org -> Tools -> Manage API Keys. Must belong to the + # AMO account that owns the gecko id in manifest.json. + # CWS_EXTENSION_ID / CWS_CLIENT_ID / CWS_CLIENT_SECRET / CWS_REFRESH_TOKEN + # Chrome Web Store item id + OAuth credentials for the CWS API + # (see https://developer.chrome.com/docs/webstore/using-api). + env: + AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }} + AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }} + CWS_EXTENSION_ID: ${{ secrets.CWS_EXTENSION_ID }} + CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }} + CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }} + CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: 24 + cache: npm + + - run: npm ci + + - name: Verify tag matches manifest version + run: | + manifest_version="v$(node -p "require('./manifest.json').version")" + if [ "$manifest_version" != "$GITHUB_REF_NAME" ]; then + echo "Tag $GITHUB_REF_NAME does not match manifest version $manifest_version" >&2 + exit 1 + fi + + - run: npm run build + + # Sign the .xpi with Mozilla so Firefox installs it permanently. + # `unlisted` is the self-distribution channel (installed by dragging + # the .xpi into Firefox, as the README describes) — switch to + # `--channel listed` only if the add-on moves to addons.mozilla.org, + # and note that listed submissions go through human review instead of + # returning a signed file immediately. AMO refuses to sign the same + # version twice, so re-running this workflow for an existing tag will + # fail here — bump the version instead. + - name: Sign the Firefox .xpi with Mozilla (AMO) + if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != '' + run: | + version="$(node -p "require('./manifest.json').version")" + mkdir -p /tmp/xpi-src /tmp/xpi-signed + unzip -q "github-pr-reverse-comments-${version}.xpi" -d /tmp/xpi-src + npx web-ext@8 sign \ + --source-dir /tmp/xpi-src \ + --channel unlisted \ + --api-key "$AMO_JWT_ISSUER" \ + --api-secret "$AMO_JWT_SECRET" \ + --artifacts-dir /tmp/xpi-signed + # Ship the signed file under the same name the Release step uploads. + mv /tmp/xpi-signed/*.xpi "github-pr-reverse-comments-${version}.xpi" + + # Upload the .zip to the Chrome Web Store and publish. Google's + # review still happens asynchronously on their side afterwards. + - name: Publish to the Chrome Web Store + if: >- + env.CWS_EXTENSION_ID != '' && env.CWS_CLIENT_ID != '' && + env.CWS_CLIENT_SECRET != '' && env.CWS_REFRESH_TOKEN != '' + env: + EXTENSION_ID: ${{ env.CWS_EXTENSION_ID }} + CLIENT_ID: ${{ env.CWS_CLIENT_ID }} + CLIENT_SECRET: ${{ env.CWS_CLIENT_SECRET }} + REFRESH_TOKEN: ${{ env.CWS_REFRESH_TOKEN }} + run: | + npx chrome-webstore-upload-cli@3 upload \ + --source github-pr-reverse-comments.zip \ + --auto-publish + + - name: Create GitHub Release with build artifacts + env: + GH_TOKEN: ${{ github.token }} + run: | + gh release create "$GITHUB_REF_NAME" \ + github-pr-reverse-comments.zip \ + github-pr-reverse-comments-*.xpi \ + --title "$GITHUB_REF_NAME" \ + --generate-notes From cafd9664fdd37ffe7990e56ee8e4e2c4f95cc184 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 23 Jul 2026 17:47:21 +0000 Subject: [PATCH 2/2] Restore LF-normalized workflow files, keeping setup-node v7.0.0 bump Co-authored-by: Julius Walton --- .github/workflows/ci.yml | 132 +++++++++++------------ .github/workflows/release.yml | 196 +++++++++++++++++----------------- 2 files changed, 164 insertions(+), 164 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index add9204..9c42a7d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,67 +1,67 @@ -name: CI - -on: - push: - branches: [main] - pull_request: - -# Least privilege: this workflow only needs to read the repo. -permissions: - contents: read - -# Cancel superseded runs for the same ref to save CI minutes. -concurrency: - group: ci-${{ github.ref }} - cancel-in-progress: true - -jobs: - check: - runs-on: ubuntu-latest - strategy: - # Test the oldest Node we claim to support (package.json engines) - # alongside current, so "works on my machine" can't hide an engines - # violation. - matrix: - node-version: [22, 24] - steps: - # Actions are pinned to commit SHAs (supply-chain hardening); the - # trailing comment records the human-readable version. v6 runs on the - # Node 24 action runtime, clearing the Node 20 deprecation warning. - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - # No step here pushes or calls the API; don't leave the token in - # .git/config for the rest of the job. - persist-credentials: false - +name: CI + +on: + push: + branches: [main] + pull_request: + +# Least privilege: this workflow only needs to read the repo. +permissions: + contents: read + +# Cancel superseded runs for the same ref to save CI minutes. +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +jobs: + check: + runs-on: ubuntu-latest + strategy: + # Test the oldest Node we claim to support (package.json engines) + # alongside current, so "works on my machine" can't hide an engines + # violation. + matrix: + node-version: [22, 24] + steps: + # Actions are pinned to commit SHAs (supply-chain hardening); the + # trailing comment records the human-readable version. v6 runs on the + # Node 24 action runtime, clearing the Node 20 deprecation warning. + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # No step here pushes or calls the API; don't leave the token in + # .git/config for the rest of the job. + persist-credentials: false + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: ${{ matrix.node-version }} - cache: npm - - - run: npm ci - - - name: Validate manifest.json parses - run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))" - - - run: npm run lint - - - run: npm run format:check - - - run: npm run typecheck - - - run: npm run coverage - - - run: npm run build - - # Merge gate: branch protection requires a single status named "check". - # Reporting that name from an aggregate job (instead of the matrix legs, - # whose names carry the Node version) keeps the required-check name - # stable no matter how the matrix changes. - ci-ok: - name: check - needs: check - if: always() - runs-on: ubuntu-latest - steps: - - name: Fail unless every matrix leg succeeded - run: test "${{ needs.check.result }}" = "success" + with: + node-version: ${{ matrix.node-version }} + cache: npm + + - run: npm ci + + - name: Validate manifest.json parses + run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))" + + - run: npm run lint + + - run: npm run format:check + + - run: npm run typecheck + + - run: npm run coverage + + - run: npm run build + + # Merge gate: branch protection requires a single status named "check". + # Reporting that name from an aggregate job (instead of the matrix legs, + # whose names carry the Node version) keeps the required-check name + # stable no matter how the matrix changes. + ci-ok: + name: check + needs: check + if: always() + runs-on: ubuntu-latest + steps: + - name: Fail unless every matrix leg succeeded + run: test "${{ needs.check.result }}" = "success" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5487623..b6fb86d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,99 +1,99 @@ -name: Release - -# Cut a release by pushing a tag like `v1.1.0` (must match manifest.json). -on: - push: - tags: - - "v*" - -permissions: - contents: write # create the GitHub Release and upload assets - -jobs: - release: - runs-on: ubuntu-latest - # Store-publishing credentials. Both publishing steps below are skipped - # when their secrets are absent, so the workflow degrades gracefully to - # a plain GitHub Release until the secrets are configured - # (repo Settings -> Secrets and variables -> Actions): - # AMO_JWT_ISSUER / AMO_JWT_SECRET - # addons.mozilla.org -> Tools -> Manage API Keys. Must belong to the - # AMO account that owns the gecko id in manifest.json. - # CWS_EXTENSION_ID / CWS_CLIENT_ID / CWS_CLIENT_SECRET / CWS_REFRESH_TOKEN - # Chrome Web Store item id + OAuth credentials for the CWS API - # (see https://developer.chrome.com/docs/webstore/using-api). - env: - AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }} - AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }} - CWS_EXTENSION_ID: ${{ secrets.CWS_EXTENSION_ID }} - CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }} - CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }} - CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }} - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - +name: Release + +# Cut a release by pushing a tag like `v1.1.0` (must match manifest.json). +on: + push: + tags: + - "v*" + +permissions: + contents: write # create the GitHub Release and upload assets + +jobs: + release: + runs-on: ubuntu-latest + # Store-publishing credentials. Both publishing steps below are skipped + # when their secrets are absent, so the workflow degrades gracefully to + # a plain GitHub Release until the secrets are configured + # (repo Settings -> Secrets and variables -> Actions): + # AMO_JWT_ISSUER / AMO_JWT_SECRET + # addons.mozilla.org -> Tools -> Manage API Keys. Must belong to the + # AMO account that owns the gecko id in manifest.json. + # CWS_EXTENSION_ID / CWS_CLIENT_ID / CWS_CLIENT_SECRET / CWS_REFRESH_TOKEN + # Chrome Web Store item id + OAuth credentials for the CWS API + # (see https://developer.chrome.com/docs/webstore/using-api). + env: + AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }} + AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }} + CWS_EXTENSION_ID: ${{ secrets.CWS_EXTENSION_ID }} + CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }} + CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }} + CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: 24 - cache: npm - - - run: npm ci - - - name: Verify tag matches manifest version - run: | - manifest_version="v$(node -p "require('./manifest.json').version")" - if [ "$manifest_version" != "$GITHUB_REF_NAME" ]; then - echo "Tag $GITHUB_REF_NAME does not match manifest version $manifest_version" >&2 - exit 1 - fi - - - run: npm run build - - # Sign the .xpi with Mozilla so Firefox installs it permanently. - # `unlisted` is the self-distribution channel (installed by dragging - # the .xpi into Firefox, as the README describes) — switch to - # `--channel listed` only if the add-on moves to addons.mozilla.org, - # and note that listed submissions go through human review instead of - # returning a signed file immediately. AMO refuses to sign the same - # version twice, so re-running this workflow for an existing tag will - # fail here — bump the version instead. - - name: Sign the Firefox .xpi with Mozilla (AMO) - if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != '' - run: | - version="$(node -p "require('./manifest.json').version")" - mkdir -p /tmp/xpi-src /tmp/xpi-signed - unzip -q "github-pr-reverse-comments-${version}.xpi" -d /tmp/xpi-src - npx web-ext@8 sign \ - --source-dir /tmp/xpi-src \ - --channel unlisted \ - --api-key "$AMO_JWT_ISSUER" \ - --api-secret "$AMO_JWT_SECRET" \ - --artifacts-dir /tmp/xpi-signed - # Ship the signed file under the same name the Release step uploads. - mv /tmp/xpi-signed/*.xpi "github-pr-reverse-comments-${version}.xpi" - - # Upload the .zip to the Chrome Web Store and publish. Google's - # review still happens asynchronously on their side afterwards. - - name: Publish to the Chrome Web Store - if: >- - env.CWS_EXTENSION_ID != '' && env.CWS_CLIENT_ID != '' && - env.CWS_CLIENT_SECRET != '' && env.CWS_REFRESH_TOKEN != '' - env: - EXTENSION_ID: ${{ env.CWS_EXTENSION_ID }} - CLIENT_ID: ${{ env.CWS_CLIENT_ID }} - CLIENT_SECRET: ${{ env.CWS_CLIENT_SECRET }} - REFRESH_TOKEN: ${{ env.CWS_REFRESH_TOKEN }} - run: | - npx chrome-webstore-upload-cli@3 upload \ - --source github-pr-reverse-comments.zip \ - --auto-publish - - - name: Create GitHub Release with build artifacts - env: - GH_TOKEN: ${{ github.token }} - run: | - gh release create "$GITHUB_REF_NAME" \ - github-pr-reverse-comments.zip \ - github-pr-reverse-comments-*.xpi \ - --title "$GITHUB_REF_NAME" \ - --generate-notes + with: + node-version: 24 + cache: npm + + - run: npm ci + + - name: Verify tag matches manifest version + run: | + manifest_version="v$(node -p "require('./manifest.json').version")" + if [ "$manifest_version" != "$GITHUB_REF_NAME" ]; then + echo "Tag $GITHUB_REF_NAME does not match manifest version $manifest_version" >&2 + exit 1 + fi + + - run: npm run build + + # Sign the .xpi with Mozilla so Firefox installs it permanently. + # `unlisted` is the self-distribution channel (installed by dragging + # the .xpi into Firefox, as the README describes) — switch to + # `--channel listed` only if the add-on moves to addons.mozilla.org, + # and note that listed submissions go through human review instead of + # returning a signed file immediately. AMO refuses to sign the same + # version twice, so re-running this workflow for an existing tag will + # fail here — bump the version instead. + - name: Sign the Firefox .xpi with Mozilla (AMO) + if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != '' + run: | + version="$(node -p "require('./manifest.json').version")" + mkdir -p /tmp/xpi-src /tmp/xpi-signed + unzip -q "github-pr-reverse-comments-${version}.xpi" -d /tmp/xpi-src + npx web-ext@8 sign \ + --source-dir /tmp/xpi-src \ + --channel unlisted \ + --api-key "$AMO_JWT_ISSUER" \ + --api-secret "$AMO_JWT_SECRET" \ + --artifacts-dir /tmp/xpi-signed + # Ship the signed file under the same name the Release step uploads. + mv /tmp/xpi-signed/*.xpi "github-pr-reverse-comments-${version}.xpi" + + # Upload the .zip to the Chrome Web Store and publish. Google's + # review still happens asynchronously on their side afterwards. + - name: Publish to the Chrome Web Store + if: >- + env.CWS_EXTENSION_ID != '' && env.CWS_CLIENT_ID != '' && + env.CWS_CLIENT_SECRET != '' && env.CWS_REFRESH_TOKEN != '' + env: + EXTENSION_ID: ${{ env.CWS_EXTENSION_ID }} + CLIENT_ID: ${{ env.CWS_CLIENT_ID }} + CLIENT_SECRET: ${{ env.CWS_CLIENT_SECRET }} + REFRESH_TOKEN: ${{ env.CWS_REFRESH_TOKEN }} + run: | + npx chrome-webstore-upload-cli@3 upload \ + --source github-pr-reverse-comments.zip \ + --auto-publish + + - name: Create GitHub Release with build artifacts + env: + GH_TOKEN: ${{ github.token }} + run: | + gh release create "$GITHUB_REF_NAME" \ + github-pr-reverse-comments.zip \ + github-pr-reverse-comments-*.xpi \ + --title "$GITHUB_REF_NAME" \ + --generate-notes