ci: gated store-publish workflow — CWS + AMO listed (V2-689)#11
Merged
Conversation
Manual, gated publishing of a tagged release to the public store listings. - publish.yml: workflow_dispatch only, in a `store-publish` GitHub Environment so a required reviewer can approve every publish; never runs on tags/merges. Inputs: tag, stores (both/chrome/firefox), chrome_target (trustedTesters → default). Checks out the tag, rebuilds (reproducible → equals the released artifact), then publishes to the selected stores; fails clearly if a selected store's secrets are missing. - scripts/cws-publish.mjs: self-contained CWS publish (OAuth refresh → upload → publish) using Node's fetch — no third-party action receives the store credentials. Supports publishTarget (trustedTesters/default). - Firefox AMO: `web-ext sign --channel=listed`. - PUBLISHING.md: one-time listing creation, credential setup (CWS OAuth + refresh token, AMO JWT) on the store-publish environment, and the caveats (review queues, one-shot versions, AMO source submission, trusted-testers-first). Consumes the artifacts produced by V2-688. Branched off main. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements V2-689 — the second stage of store automation: manual, gated publishing of a tagged release to the public Chrome Web Store and Firefox AMO listings. Consumes what V2-688 (#10) produces. Standalone (off
main).How it works
publish.ymlisworkflow_dispatch-only — it never runs on tags or merges, so publishing is always a deliberate button press. It runs in astore-publishGitHub Environment, so you can add a required reviewer to approve every publish, and store secrets stay off fork-PR runs.Actions → Publish to stores → Run workflow, choose:
both/chrome/firefoxtrustedTesters(safe default) →default(public)It checks out the tag, rebuilds (reproducible → identical to the released artifact), and publishes to the selected stores; it fails clearly if a selected store's secrets aren't set.
Chrome without a third-party action
scripts/cws-publish.mjsdoes the CWS publish itself — OAuth refresh → upload → publish via Node'sfetch, no npm dep and no marketplace action, so the store credentials are never handed to code we don't control. SupportspublishTarget(trusted testers vs public). Firefox usesweb-ext sign --channel=listed.Honest caveats (in PUBLISHING.md)
Verification
YAML validated;
cws-publish.mjspassesnode --checkand its guard paths (missing creds / bad target / missing source) all exit cleanly with actionable errors — verified locally without any network call. The live publish path can't be exercised without real store credentials + existing listings, so this is ready to wire: add thestore-publishsecrets and dispatch withtrustedTestersfor the first safe run.Secrets to add (store-publish environment)
CWS_CLIENT_ID,CWS_CLIENT_SECRET,CWS_REFRESH_TOKEN,CWS_EXTENSION_ID,WEB_EXT_API_KEY,WEB_EXT_API_SECRET.🤖 Generated with Claude Code