Release workflow: sign .xpi via AMO and publish to Chrome Web Store (… #29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Least privilege: this workflow only needs to read the repo. | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs for the same ref to save CI minutes. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| # Test the oldest Node we claim to support (package.json engines) | |
| # alongside current, so "works on my machine" can't hide an engines | |
| # violation. | |
| matrix: | |
| node-version: [22, 24] | |
| steps: | |
| # Actions are pinned to commit SHAs (supply-chain hardening); the | |
| # trailing comment records the human-readable version. v6 runs on the | |
| # Node 24 action runtime, clearing the Node 20 deprecation warning. | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| # No step here pushes or calls the API; don't leave the token in | |
| # .git/config for the rest of the job. | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: npm | |
| - run: npm ci | |
| - name: Validate manifest.json parses | |
| run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))" | |
| - run: npm run lint | |
| - run: npm run format:check | |
| - run: npm run typecheck | |
| - run: npm run coverage | |
| - run: npm run build | |
| # Merge gate: branch protection requires a single status named "check". | |
| # Reporting that name from an aggregate job (instead of the matrix legs, | |
| # whose names carry the Node version) keeps the required-check name | |
| # stable no matter how the matrix changes. | |
| ci-ok: | |
| name: check | |
| needs: check | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Fail unless every matrix leg succeeded | |
| run: test "${{ needs.check.result }}" = "success" |