Release workflow: sign .xpi via AMO and publish to Chrome Web Store

[ShiosOS]

Both steps are gated on their secrets being configured, so the workflow
keeps producing a plain GitHub Release until AMO_JWT_ISSUER/SECRET and
the CWS_* secrets are added. With secrets present, the .xpi attached to
the release is the Mozilla-signed (unlisted channel) file, and the .zip
is uploaded to the Chrome Web Store and submitted for publication.

Co-authored-by: Julius Walton ShiosOS@users.noreply.github.com

---

Note

Low Risk
CI-only conditional changes with no application code impact; reduces failed release runs when secrets are partially configured.

Overview
Release workflow now skips Mozilla signing and Chrome Web Store publishing unless every credential for that step is configured, not just a single secret.

The AMO sign step runs only when both AMO_JWT_ISSUER and AMO_JWT_SECRET are non-empty (previously only the issuer was checked). The CWS publish step requires CWS_EXTENSION_ID, CWS_CLIENT_ID, CWS_CLIENT_SECRET, and CWS_REFRESH_TOKEN together (previously only the extension id). Partial secret setup no longer triggers steps that would fail at runtime; the job still falls back to a plain GitHub Release when secrets are missing.

^{Reviewed by Cursor Bugbot for commit 1f4fc47. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale comment

[cursor]

🔒 Agentic Security Review
Severity: HIGH
Job-level env exports AMO and Chrome Web Store credentials to all steps in this job, including npm ci and npm run build.

If any dependency lifecycle script or build-time tool is compromised, it can read and exfiltrate publishing credentials before the guarded publish steps run.

 

^{Reviewed by Cursor Security Reviewer for commit 1e77cc1. Configure here.}

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM
This release path runs npx web-ext@8 (and later npx chrome-webstore-upload-cli@3) with publishing credentials available, which resolves mutable package versions at runtime.

A compromised upstream release in these ranges could execute attacker-controlled code in CI and steal store-signing/publishing secrets.

 

^{Reviewed by Cursor Security Reviewer for commit 1e77cc1. Configure here.}

[cursor]

Stale comment

Risk: medium. Cursor Bugbot completed successfully with no findings, but unresolved Security Reviewer findings (HIGH and MEDIUM) remain on this PR. Not approving per policy; human review is needed and no additional reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Risk: medium. Approved: Cursor Bugbot completed with no findings. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}