Automate Firefox signing (AMO) and Chrome Web Store publishing in the release workflow#16
Merged
Merged
Conversation
Both steps are gated on their secrets being configured, so the workflow keeps producing a plain GitHub Release until AMO_JWT_ISSUER/SECRET and the CWS_* secrets are added. With secrets present, the .xpi attached to the release is the Mozilla-signed (unlisted channel) file, and the .zip is uploaded to the Chrome Web Store and submitted for publication. Co-authored-by: Julius Walton <ShiosOS@users.noreply.github.com>
ShiosOS
marked this pull request as ready for review
July 14, 2026 18:25
Merged
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3f7bfd4. Configure here.
There was a problem hiding this comment.
Risk: medium. Not approving: Cursor Bugbot reported 1 unresolved finding (store publishing steps may run with incomplete credentials) and the Bugbot check completed as skipped. Human review is needed; assigned ShiosOS.
Sent by Cursor Approval Agent: Pull Request Router and Approver
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends the tag-triggered release workflow with two store-publishing steps, both gated on secrets being configured — until the secrets exist, each step is skipped and the workflow behaves exactly as today (build + GitHub Release). Safe to merge before any credential setup.
Firefox (AMO)
After the build, the
.xpiis signed by Mozilla viaweb-ext signon the unlisted (self-distribution) channel — matching the current README install flow of dragging a signed.xpiinto Firefox — and the signed file replaces the unsigned one attached to the GitHub Release.Requires two repo secrets:
AMO_JWT_ISSUERandAMO_JWT_SECRET(addons.mozilla.org → Tools → Manage API Keys, from the account that owns thegecko.idinmanifest.json).Note: AMO refuses to sign the same version twice, so re-running the workflow for an existing tag fails at this step by design — bump the version instead.
Chrome Web Store
The
.zipis uploaded to the existing CWS item and submitted for publication viachrome-webstore-upload-cli(Google's review still happens asynchronously).Requires four repo secrets:
CWS_EXTENSION_ID,CWS_CLIENT_ID,CWS_CLIENT_SECRET,CWS_REFRESH_TOKEN. One-time setup: the $5 developer registration, a first manual listing submission to obtain the extension ID, and OAuth credentials for the Chrome Web Store API (enable the API in a Google Cloud project, create a Desktop-app OAuth client, publish the consent screen to "In production" so the refresh token doesn't expire, and mint a refresh token —npx chrome-webstore-upload-keyswalks through it).All secrets are documented in comments at the top of the job. Ordering: signing/publishing run before the GitHub Release is created, so a signing failure never produces a release with an unsigned artifact.
Verification
Prettier check passes and the workflow YAML parses. The publishing steps themselves can only be exercised for real with store credentials on a tag push.