Automate Firefox signing (AMO) and Chrome Web Store publishing in the release workflow

[ShiosOS]

Summary

Extends the tag-triggered release workflow with two store-publishing steps, both gated on secrets being configured — until the secrets exist, each step is skipped and the workflow behaves exactly as today (build + GitHub Release). Safe to merge before any credential setup.

Firefox (AMO)

After the build, the .xpi is signed by Mozilla via web-ext sign on the unlisted (self-distribution) channel — matching the current README install flow of dragging a signed .xpi into Firefox — and the signed file replaces the unsigned one attached to the GitHub Release.

Requires two repo secrets: AMO_JWT_ISSUER and AMO_JWT_SECRET (addons.mozilla.org → Tools → Manage API Keys, from the account that owns the gecko.id in manifest.json).

Note: AMO refuses to sign the same version twice, so re-running the workflow for an existing tag fails at this step by design — bump the version instead.

Chrome Web Store

The .zip is uploaded to the existing CWS item and submitted for publication via chrome-webstore-upload-cli (Google's review still happens asynchronously).

Requires four repo secrets: CWS_EXTENSION_ID, CWS_CLIENT_ID, CWS_CLIENT_SECRET, CWS_REFRESH_TOKEN. One-time setup: the $5 developer registration, a first manual listing submission to obtain the extension ID, and OAuth credentials for the Chrome Web Store API (enable the API in a Google Cloud project, create a Desktop-app OAuth client, publish the consent screen to "In production" so the refresh token doesn't expire, and mint a refresh token — npx chrome-webstore-upload-keys walks through it).

All secrets are documented in comments at the top of the job. Ordering: signing/publishing run before the GitHub Release is created, so a signing failure never produces a release with an unsigned artifact.

Verification

Prettier check passes and the workflow YAML parses. The publishing steps themselves can only be exercised for real with store credentials on a tag push.

  

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3f7bfd4. Configure here.}

[cursor]

Risk: medium. Not approving: Cursor Bugbot reported 1 unresolved finding (store publishing steps may run with incomplete credentials) and the Bugbot check completed as skipped. Human review is needed; assigned ShiosOS.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}