release.yml

name: Release

# Cut a release by pushing a tag like `v1.2.1` (must match manifest.json).
on:
  push:
    tags:
      - "v*"

permissions:
  contents: write # create the GitHub Release and upload assets

jobs:
  release:
    runs-on: ubuntu-latest
    # Store-publishing credentials. Both publishing steps below are skipped
    # when their secrets are absent, and continue-on-error so a bad or
    # expired credential cannot block the GitHub Release (which is what
    # Chromium / sideload users need). Configure under
    # repo Settings -> Secrets and variables -> Actions:
    #   AMO_JWT_ISSUER / AMO_JWT_SECRET
    #     addons.mozilla.org -> Tools -> Manage API Keys. Must belong to the
    #     AMO account that owns the gecko id in manifest.json.
    #   CWS_EXTENSION_ID / CWS_CLIENT_ID / CWS_CLIENT_SECRET / CWS_REFRESH_TOKEN
    #     Chrome Web Store item id + OAuth credentials for the CWS API
    #     (see https://developer.chrome.com/docs/webstore/using-api).
    env:
      AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }}
      AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }}
      CWS_EXTENSION_ID: ${{ secrets.CWS_EXTENSION_ID }}
      CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }}
      CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }}
      CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: npm

      - run: npm ci

      - name: Verify tag matches manifest version
        run: |
          manifest_version="v$(node -p "require('./manifest.json').version")"
          if [ "$manifest_version" != "$GITHUB_REF_NAME" ]; then
            echo "Tag $GITHUB_REF_NAME does not match manifest version $manifest_version" >&2
            exit 1
          fi

      - run: npm run build

      # Publish the GitHub Release before store signing/upload. v1.2.0's
      # release never appeared because AMO signing failed first with a bad
      # JWT issuer, so the zip with the packaging fix never shipped.
      - name: Create GitHub Release with build artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            github-pr-reverse-comments.zip \
            github-pr-reverse-comments-*.xpi \
            --title "$GITHUB_REF_NAME" \
            --generate-notes

      # Sign the .xpi with Mozilla so Firefox installs it permanently.
      # `unlisted` is the self-distribution channel (installed by dragging
      # the .xpi into Firefox, as the README describes) — switch to
      # `--channel listed` only if the add-on moves to addons.mozilla.org,
      # and note that listed submissions go through human review instead of
      # returning a signed file immediately. AMO refuses to sign the same
      # version twice, so re-running this workflow for an existing tag will
      # fail here — bump the version instead.
      - name: Sign the Firefox .xpi with Mozilla (AMO)
        id: amo_sign
        continue-on-error: true
        if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != ''
        run: |
          version="$(node -p "require('./manifest.json').version")"
          mkdir -p /tmp/xpi-src /tmp/xpi-signed
          unzip -q "github-pr-reverse-comments-${version}.xpi" -d /tmp/xpi-src
          npx web-ext@8 sign \
            --source-dir /tmp/xpi-src \
            --channel unlisted \
            --api-key "$AMO_JWT_ISSUER" \
            --api-secret "$AMO_JWT_SECRET" \
            --artifacts-dir /tmp/xpi-signed
          # Ship the signed file under the same name the Release step uploads.
          mv /tmp/xpi-signed/*.xpi "github-pr-reverse-comments-${version}.xpi"

      - name: Upload signed Firefox .xpi to the GitHub Release
        if: steps.amo_sign.outcome == 'success'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          version="$(node -p "require('./manifest.json').version")"
          gh release upload "$GITHUB_REF_NAME" \
            "github-pr-reverse-comments-${version}.xpi" \
            --clobber

      # Upload the .zip to the Chrome Web Store and publish. Google's
      # review still happens asynchronously on their side afterwards.
      - name: Publish to the Chrome Web Store
        continue-on-error: true
        if: >-
          env.CWS_EXTENSION_ID != '' && env.CWS_CLIENT_ID != '' &&
          env.CWS_CLIENT_SECRET != '' && env.CWS_REFRESH_TOKEN != ''
        env:
          EXTENSION_ID: ${{ env.CWS_EXTENSION_ID }}
          CLIENT_ID: ${{ env.CWS_CLIENT_ID }}
          CLIENT_SECRET: ${{ env.CWS_CLIENT_SECRET }}
          REFRESH_TOKEN: ${{ env.CWS_REFRESH_TOKEN }}
        run: |
          npx chrome-webstore-upload-cli@3 upload \
            --source github-pr-reverse-comments.zip \
            --auto-publish