Skip to content

Commit 7fab255

Browse files
dependabot[bot]dependabot[bot]
authored
Bump actions/setup-node from 6.4.0 to 7.0.0
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
1 parent 27124dd commit 7fab255

2 files changed

Lines changed: 166 additions & 166 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 67 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,67 @@
1-
name: CI
2-
3-
on:
4-
push:
5-
branches: [main]
6-
pull_request:
7-
8-
# Least privilege: this workflow only needs to read the repo.
9-
permissions:
10-
contents: read
11-
12-
# Cancel superseded runs for the same ref to save CI minutes.
13-
concurrency:
14-
group: ci-${{ github.ref }}
15-
cancel-in-progress: true
16-
17-
jobs:
18-
check:
19-
runs-on: ubuntu-latest
20-
strategy:
21-
# Test the oldest Node we claim to support (package.json engines)
22-
# alongside current, so "works on my machine" can't hide an engines
23-
# violation.
24-
matrix:
25-
node-version: [22, 24]
26-
steps:
27-
# Actions are pinned to commit SHAs (supply-chain hardening); the
28-
# trailing comment records the human-readable version. v6 runs on the
29-
# Node 24 action runtime, clearing the Node 20 deprecation warning.
30-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
31-
with:
32-
# No step here pushes or calls the API; don't leave the token in
33-
# .git/config for the rest of the job.
34-
persist-credentials: false
35-
36-
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
37-
with:
38-
node-version: ${{ matrix.node-version }}
39-
cache: npm
40-
41-
- run: npm ci
42-
43-
- name: Validate manifest.json parses
44-
run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))"
45-
46-
- run: npm run lint
47-
48-
- run: npm run format:check
49-
50-
- run: npm run typecheck
51-
52-
- run: npm run coverage
53-
54-
- run: npm run build
55-
56-
# Merge gate: branch protection requires a single status named "check".
57-
# Reporting that name from an aggregate job (instead of the matrix legs,
58-
# whose names carry the Node version) keeps the required-check name
59-
# stable no matter how the matrix changes.
60-
ci-ok:
61-
name: check
62-
needs: check
63-
if: always()
64-
runs-on: ubuntu-latest
65-
steps:
66-
- name: Fail unless every matrix leg succeeded
67-
run: test "${{ needs.check.result }}" = "success"
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
8+
# Least privilege: this workflow only needs to read the repo.
9+
permissions:
10+
contents: read
11+
12+
# Cancel superseded runs for the same ref to save CI minutes.
13+
concurrency:
14+
group: ci-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
check:
19+
runs-on: ubuntu-latest
20+
strategy:
21+
# Test the oldest Node we claim to support (package.json engines)
22+
# alongside current, so "works on my machine" can't hide an engines
23+
# violation.
24+
matrix:
25+
node-version: [22, 24]
26+
steps:
27+
# Actions are pinned to commit SHAs (supply-chain hardening); the
28+
# trailing comment records the human-readable version. v6 runs on the
29+
# Node 24 action runtime, clearing the Node 20 deprecation warning.
30+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
31+
with:
32+
# No step here pushes or calls the API; don't leave the token in
33+
# .git/config for the rest of the job.
34+
persist-credentials: false
35+
36+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
37+
with:
38+
node-version: ${{ matrix.node-version }}
39+
cache: npm
40+
41+
- run: npm ci
42+
43+
- name: Validate manifest.json parses
44+
run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))"
45+
46+
- run: npm run lint
47+
48+
- run: npm run format:check
49+
50+
- run: npm run typecheck
51+
52+
- run: npm run coverage
53+
54+
- run: npm run build
55+
56+
# Merge gate: branch protection requires a single status named "check".
57+
# Reporting that name from an aggregate job (instead of the matrix legs,
58+
# whose names carry the Node version) keeps the required-check name
59+
# stable no matter how the matrix changes.
60+
ci-ok:
61+
name: check
62+
needs: check
63+
if: always()
64+
runs-on: ubuntu-latest
65+
steps:
66+
- name: Fail unless every matrix leg succeeded
67+
run: test "${{ needs.check.result }}" = "success"

‎.github/workflows/release.yml‎

Lines changed: 99 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -1,99 +1,99 @@
1-
name: Release
2-
3-
# Cut a release by pushing a tag like `v1.1.0` (must match manifest.json).
4-
on:
5-
push:
6-
tags:
7-
- "v*"
8-
9-
permissions:
10-
contents: write # create the GitHub Release and upload assets
11-
12-
jobs:
13-
release:
14-
runs-on: ubuntu-latest
15-
# Store-publishing credentials. Both publishing steps below are skipped
16-
# when their secrets are absent, so the workflow degrades gracefully to
17-
# a plain GitHub Release until the secrets are configured
18-
# (repo Settings -> Secrets and variables -> Actions):
19-
# AMO_JWT_ISSUER / AMO_JWT_SECRET
20-
# addons.mozilla.org -> Tools -> Manage API Keys. Must belong to the
21-
# AMO account that owns the gecko id in manifest.json.
22-
# CWS_EXTENSION_ID / CWS_CLIENT_ID / CWS_CLIENT_SECRET / CWS_REFRESH_TOKEN
23-
# Chrome Web Store item id + OAuth credentials for the CWS API
24-
# (see https://developer.chrome.com/docs/webstore/using-api).
25-
env:
26-
AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }}
27-
AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }}
28-
CWS_EXTENSION_ID: ${{ secrets.CWS_EXTENSION_ID }}
29-
CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }}
30-
CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }}
31-
CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }}
32-
steps:
33-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
34-
35-
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
36-
with:
37-
node-version: 24
38-
cache: npm
39-
40-
- run: npm ci
41-
42-
- name: Verify tag matches manifest version
43-
run: |
44-
manifest_version="v$(node -p "require('./manifest.json').version")"
45-
if [ "$manifest_version" != "$GITHUB_REF_NAME" ]; then
46-
echo "Tag $GITHUB_REF_NAME does not match manifest version $manifest_version" >&2
47-
exit 1
48-
fi
49-
50-
- run: npm run build
51-
52-
# Sign the .xpi with Mozilla so Firefox installs it permanently.
53-
# `unlisted` is the self-distribution channel (installed by dragging
54-
# the .xpi into Firefox, as the README describes) — switch to
55-
# `--channel listed` only if the add-on moves to addons.mozilla.org,
56-
# and note that listed submissions go through human review instead of
57-
# returning a signed file immediately. AMO refuses to sign the same
58-
# version twice, so re-running this workflow for an existing tag will
59-
# fail here — bump the version instead.
60-
- name: Sign the Firefox .xpi with Mozilla (AMO)
61-
if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != ''
62-
run: |
63-
version="$(node -p "require('./manifest.json').version")"
64-
mkdir -p /tmp/xpi-src /tmp/xpi-signed
65-
unzip -q "github-pr-reverse-comments-${version}.xpi" -d /tmp/xpi-src
66-
npx web-ext@8 sign \
67-
--source-dir /tmp/xpi-src \
68-
--channel unlisted \
69-
--api-key "$AMO_JWT_ISSUER" \
70-
--api-secret "$AMO_JWT_SECRET" \
71-
--artifacts-dir /tmp/xpi-signed
72-
# Ship the signed file under the same name the Release step uploads.
73-
mv /tmp/xpi-signed/*.xpi "github-pr-reverse-comments-${version}.xpi"
74-
75-
# Upload the .zip to the Chrome Web Store and publish. Google's
76-
# review still happens asynchronously on their side afterwards.
77-
- name: Publish to the Chrome Web Store
78-
if: >-
79-
env.CWS_EXTENSION_ID != '' && env.CWS_CLIENT_ID != '' &&
80-
env.CWS_CLIENT_SECRET != '' && env.CWS_REFRESH_TOKEN != ''
81-
env:
82-
EXTENSION_ID: ${{ env.CWS_EXTENSION_ID }}
83-
CLIENT_ID: ${{ env.CWS_CLIENT_ID }}
84-
CLIENT_SECRET: ${{ env.CWS_CLIENT_SECRET }}
85-
REFRESH_TOKEN: ${{ env.CWS_REFRESH_TOKEN }}
86-
run: |
87-
npx chrome-webstore-upload-cli@3 upload \
88-
--source github-pr-reverse-comments.zip \
89-
--auto-publish
90-
91-
- name: Create GitHub Release with build artifacts
92-
env:
93-
GH_TOKEN: ${{ github.token }}
94-
run: |
95-
gh release create "$GITHUB_REF_NAME" \
96-
github-pr-reverse-comments.zip \
97-
github-pr-reverse-comments-*.xpi \
98-
--title "$GITHUB_REF_NAME" \
99-
--generate-notes
1+
name: Release
2+
3+
# Cut a release by pushing a tag like `v1.1.0` (must match manifest.json).
4+
on:
5+
push:
6+
tags:
7+
- "v*"
8+
9+
permissions:
10+
contents: write # create the GitHub Release and upload assets
11+
12+
jobs:
13+
release:
14+
runs-on: ubuntu-latest
15+
# Store-publishing credentials. Both publishing steps below are skipped
16+
# when their secrets are absent, so the workflow degrades gracefully to
17+
# a plain GitHub Release until the secrets are configured
18+
# (repo Settings -> Secrets and variables -> Actions):
19+
# AMO_JWT_ISSUER / AMO_JWT_SECRET
20+
# addons.mozilla.org -> Tools -> Manage API Keys. Must belong to the
21+
# AMO account that owns the gecko id in manifest.json.
22+
# CWS_EXTENSION_ID / CWS_CLIENT_ID / CWS_CLIENT_SECRET / CWS_REFRESH_TOKEN
23+
# Chrome Web Store item id + OAuth credentials for the CWS API
24+
# (see https://developer.chrome.com/docs/webstore/using-api).
25+
env:
26+
AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }}
27+
AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }}
28+
CWS_EXTENSION_ID: ${{ secrets.CWS_EXTENSION_ID }}
29+
CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }}
30+
CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }}
31+
CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }}
32+
steps:
33+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
34+
35+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
36+
with:
37+
node-version: 24
38+
cache: npm
39+
40+
- run: npm ci
41+
42+
- name: Verify tag matches manifest version
43+
run: |
44+
manifest_version="v$(node -p "require('./manifest.json').version")"
45+
if [ "$manifest_version" != "$GITHUB_REF_NAME" ]; then
46+
echo "Tag $GITHUB_REF_NAME does not match manifest version $manifest_version" >&2
47+
exit 1
48+
fi
49+
50+
- run: npm run build
51+
52+
# Sign the .xpi with Mozilla so Firefox installs it permanently.
53+
# `unlisted` is the self-distribution channel (installed by dragging
54+
# the .xpi into Firefox, as the README describes) — switch to
55+
# `--channel listed` only if the add-on moves to addons.mozilla.org,
56+
# and note that listed submissions go through human review instead of
57+
# returning a signed file immediately. AMO refuses to sign the same
58+
# version twice, so re-running this workflow for an existing tag will
59+
# fail here — bump the version instead.
60+
- name: Sign the Firefox .xpi with Mozilla (AMO)
61+
if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != ''
62+
run: |
63+
version="$(node -p "require('./manifest.json').version")"
64+
mkdir -p /tmp/xpi-src /tmp/xpi-signed
65+
unzip -q "github-pr-reverse-comments-${version}.xpi" -d /tmp/xpi-src
66+
npx web-ext@8 sign \
67+
--source-dir /tmp/xpi-src \
68+
--channel unlisted \
69+
--api-key "$AMO_JWT_ISSUER" \
70+
--api-secret "$AMO_JWT_SECRET" \
71+
--artifacts-dir /tmp/xpi-signed
72+
# Ship the signed file under the same name the Release step uploads.
73+
mv /tmp/xpi-signed/*.xpi "github-pr-reverse-comments-${version}.xpi"
74+
75+
# Upload the .zip to the Chrome Web Store and publish. Google's
76+
# review still happens asynchronously on their side afterwards.
77+
- name: Publish to the Chrome Web Store
78+
if: >-
79+
env.CWS_EXTENSION_ID != '' && env.CWS_CLIENT_ID != '' &&
80+
env.CWS_CLIENT_SECRET != '' && env.CWS_REFRESH_TOKEN != ''
81+
env:
82+
EXTENSION_ID: ${{ env.CWS_EXTENSION_ID }}
83+
CLIENT_ID: ${{ env.CWS_CLIENT_ID }}
84+
CLIENT_SECRET: ${{ env.CWS_CLIENT_SECRET }}
85+
REFRESH_TOKEN: ${{ env.CWS_REFRESH_TOKEN }}
86+
run: |
87+
npx chrome-webstore-upload-cli@3 upload \
88+
--source github-pr-reverse-comments.zip \
89+
--auto-publish
90+
91+
- name: Create GitHub Release with build artifacts
92+
env:
93+
GH_TOKEN: ${{ github.token }}
94+
run: |
95+
gh release create "$GITHUB_REF_NAME" \
96+
github-pr-reverse-comments.zip \
97+
github-pr-reverse-comments-*.xpi \
98+
--title "$GITHUB_REF_NAME" \
99+
--generate-notes

0 commit comments

Comments
 (0)