ci: release-artifacts workflow — Chrome zip, signed Firefox xpi, AMO source (V2-688)#10
Merged
Merged
Conversation
…source (V2-688) On a `v*` tag push (or manual workflow_dispatch), build from a clean checkout and produce the distributable artifacts, then attach them to the GitHub Release: - ant-webex-chrome-vX.Y.Z.zip — CWS upload package (manifest at zip root). - ant-webex-firefox-vX.Y.Z.xpi — signed, unlisted via `web-ext sign` when the AMO API secrets (WEB_EXT_API_KEY/SECRET) are set; installable by testers. Falls back to an unsigned .zip (with a warning) when creds are absent, so the rest of the release still succeeds. - ant-webex-source-vX.Y.Z.zip — `git archive` source tree for AMO's source-code submission requirement. Guards: version must agree across tag / manifest.json / package.json; web-ext lint runs before signing so a broken build doesn't burn an AMO version number. Runs in a `release` GitHub Environment so signing can be gated behind a required reviewer and secrets aren't exposed to fork-PR runs. RELEASING.md documents the tag flow + one-time AMO credential setup. Branched off main; independent of the i18n (#8) and CI-hardening (#9) PRs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements V2-688 — the first stage of store automation: turn a version tag into the distributable artifacts, from a clean checkout, so releases stop depending on hand-zipping local
dist/. Standalone (offmain), independent of the i18n (#8) and CI-hardening (#9) PRs.Trigger
Push a
v*tag (git tag v0.1.3 && git push origin v0.1.3) — or Actions → Run workflow (workflow_dispatch) for an ad-hoc build without tagging.Artifacts (attached to the GitHub Release for the tag)
ant-webex-chrome-vX.Y.Z.zipzipofdist/(manifest at root)ant-webex-firefox-vX.Y.Z.xpiweb-ext sign --channel=unlistedant-webex-source-vX.Y.Z.zipgit archive HEADDesign notes
.xpi. When absent → an unsigned.zipwith a warning, so Chrome + source still ship and the run stays green. Add the secrets later and it upgrades automatically.releaseEnvironment. The job runs in areleaseenvironment so you can (optionally) add a required reviewer to gate every release, and so secrets aren't exposed to fork-PR runs.WEB_EXT_API_KEY/WEB_EXT_API_SECRETlive there (or as repo secrets).manifest.json==package.jsonversion — kills the "tagged v0.1.3 but manifest says 0.1.2" footgun.autonomi@webexis already in the Firefox manifest; unlisted signing auto-registers it on first run.RELEASING.mddocuments the whole flow + one-time credential setup.Verification
Every packaging command was dry-run locally and produces valid output: Chrome zip has
manifest.jsonat the root, source zip includes build files but excludesnode_modules,web-ext buildsucceeds. YAML validated. The signing step and full GitHub run can't be exercised pre-merge (workflow_dispatchonly runs from the default branch, and I didn't want to create throwaway tags) — first live run is the first tag, or a dispatch once this is onmain.Follow-up
Unblocks V2-689 (automated public store uploads — CWS listing + AMO listed channel), which consumes these artifacts and adds the CWS credentials.
🤖 Generated with Claude Code