Release: merge development into beta

.github/workflows/browser-extension.yml

@@ -1,46 +1,56 @@
 name: Browser extension
 
-# Builds the extension for Chromium and Firefox and loads each package in a
-# headless browser to check its background starts and answers the popup
-# (clients-browser-builds). Safari needs a macOS runner and stays an open task.
+# Tests, typechecks, lints and builds the WXT extension in browser-extension/
+# for Chromium MV3 and Firefox MV2. The crypto tests read the web app's vectors,
+# so a change to those runs this too.
 
 on:
   push:
     branches: [main, development]
-    paths: ["browser-extension/**", "src/crypto/**", "src/totp/**", ".github/workflows/browser-extension.yml"]
+    paths: ["browser-extension/**", "tests/vectors/crypto/**", ".github/workflows/browser-extension.yml"]
   pull_request:
     branches: [main, development, beta]
-    paths: ["browser-extension/**", "src/crypto/**", "src/totp/**", ".github/workflows/browser-extension.yml"]
+    paths: ["browser-extension/**", "tests/vectors/crypto/**", ".github/workflows/browser-extension.yml"]
   workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  build-and-load:
+  check-and-build:
     runs-on: ubuntu-latest
-    # A build and two browser starts; minutes at most.
-    timeout-minutes: 20
+    # Tests, two builds and a lint; minutes at most.
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: browser-extension
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: "24"
           cache: npm
+          cache-dependency-path: browser-extension/package-lock.json
+      # No install scripts from dependencies; `wxt prepare` is the one postinstall we need.
       - run: npm ci --ignore-scripts
-      - run: npm run build:extension
-      - name: Chromium loads the package
+      - run: npx wxt prepare
+      - name: No chrome.* in executable code
         run: |
-          npx playwright install --with-deps chromium
-          node browser-extension/load-check/chromium.mjs
-      - name: Firefox loads the package
-        run: |
-          npm install --no-save selenium-webdriver@4
-          firefox --version
-          geckodriver --version
-          node browser-extension/load-check/firefox.mjs
+          if grep -rnE '(^|[^.[:alnum:]_])chrome\.' src entrypoints --include='*.ts' --include='*.tsx' | grep -vE '^\S+:[0-9]+:\s*(//|\*|/\*)'; then
+            echo "::error::Use browser.* instead of chrome.* (WXT-AND-BROWSERS.md § 1)"
+            exit 1
+          fi
+      - run: npm test
+      - run: npm run typecheck
+      - run: npm run lint
+      - run: npm run build
+      - run: npm run build:firefox
+      - name: Lint the Firefox package
+        run: npx web-ext lint --source-dir .output/firefox-mv2 --warnings-as-errors=false
       - uses: actions/upload-artifact@v4
         with:
           name: browser-extension
-          path: browser-extension/dist/
+          path: |
+            browser-extension/.output/chrome-mv3/
+            browser-extension/.output/firefox-mv2/
           retention-days: 14

.github/workflows/code-quality.yml

@@ -183,8 +183,7 @@ jobs:
       enable-eslint: true
       enable-phpunit: true
       enable-newman: true
-      # Keepiq needs no other app (ADR-006); standalone.yml proves that on an
-      # instance with Keepiq alone. OpenRegister is installed HERE so this
+      # Keepiq needs no other app (ADR-006). OpenRegister is installed HERE so this
       # suite covers the integrations that need it: the Flows pages and the
       # MCP tools, which appear only when OpenRegister is enabled.
       #