diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ace7f57..8d1b7fb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,15 +17,25 @@ concurrency: jobs: check: runs-on: ubuntu-latest + strategy: + # Test the oldest Node we claim to support (package.json engines) + # alongside current, so "works on my machine" can't hide an engines + # violation. + matrix: + node-version: [22, 24] steps: # Actions are pinned to commit SHAs (supply-chain hardening); the # trailing comment records the human-readable version. v6 runs on the # Node 24 action runtime, clearing the Node 20 deprecation warning. - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + # No step here pushes or calls the API; don't leave the token in + # .git/config for the rest of the job. + persist-credentials: false - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - node-version: 24 + node-version: ${{ matrix.node-version }} cache: npm - run: npm ci @@ -42,3 +52,16 @@ jobs: - run: npm run coverage - run: npm run build + + # Merge gate: branch protection requires a single status named "check". + # Reporting that name from an aggregate job (instead of the matrix legs, + # whose names carry the Node version) keeps the required-check name + # stable no matter how the matrix changes. + ci-ok: + name: check + needs: check + if: always() + runs-on: ubuntu-latest + steps: + - name: Fail unless every matrix leg succeeded + run: test "${{ needs.check.result }}" = "success" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a883b1c..11ba793 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -58,7 +58,7 @@ jobs: # version twice, so re-running this workflow for an existing tag will # fail here — bump the version instead. - name: Sign the Firefox .xpi with Mozilla (AMO) - if: env.AMO_JWT_ISSUER != '' + if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != '' run: | version="$(node -p "require('./manifest.json').version")" mkdir -p /tmp/xpi-src /tmp/xpi-signed @@ -75,7 +75,9 @@ jobs: # Upload the .zip to the Chrome Web Store and publish. Google's # review still happens asynchronously on their side afterwards. - name: Publish to the Chrome Web Store - if: env.CWS_EXTENSION_ID != '' + if: >- + env.CWS_EXTENSION_ID != '' && env.CWS_CLIENT_ID != '' && + env.CWS_CLIENT_SECRET != '' && env.CWS_REFRESH_TOKEN != '' env: EXTENSION_ID: ${{ env.CWS_EXTENSION_ID }} CLIENT_ID: ${{ env.CWS_CLIENT_ID }} diff --git a/CHANGELOG.md b/CHANGELOG.md index fa786e2..42210ed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Fixed + +- Release packaging omitted `checks.js`, so published `.zip`/`.xpi` builds + shipped without the status-checks helpers the content script depends on. + The packaged file list is now derived from `manifest.json` (plus popup + `