Thingport/.github/workflows/extension-release.yml

name: Extension release

# Builds Thingport Grab on every change to extension/: checks, the extension-latest release's zips
# and the self-signed Firefox .xpi. Store releases are extension-store-release.yml.
# Publishes to the fixed "extension-latest" tag rather than GitHub's single repo-wide "latest"
# release, which Bridge's download links rely on.
on:
  push:
    branches: [main]
    paths:
      - "extension/**"
      - ".github/workflows/extension-release.yml"
  pull_request:
    branches: [main, develop]
    paths:
      - "extension/**"
      - ".github/workflows/extension-release.yml"
  workflow_dispatch: {}

concurrency:
  group: extension-release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-chrome:
    # A main -> develop back-merge only brings release commits main already tested.
    if: github.head_ref != 'main'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: extension
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: extension/package-lock.json
      - run: npm ci
      - name: Typecheck
        run: npm run typecheck
      - name: Lint
        run: npm run lint
      - name: Build and package
        run: npm run zip:chrome && npm run zip:edge
      - uses: actions/upload-artifact@v4
        with:
          name: thingport-grab-chrome
          path: extension/dist/zips/thingport-grab-chrome.zip
          if-no-files-found: error
      - uses: actions/upload-artifact@v4
        with:
          name: thingport-grab-edge
          path: extension/dist/zips/thingport-grab-edge.zip
          if-no-files-found: error

  build-firefox:
    # A main -> develop back-merge only brings release commits main already tested.
    if: github.head_ref != 'main'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: extension
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: extension/package-lock.json
      - run: npm ci
      - name: Build (and the source archive AMO asks for alongside bundled code)
        run: npm run zip:firefox
      - name: Lint (validates the built manifest for both PRs and pushes, no AMO credentials needed)
        run: npx web-ext lint --source-dir dist/firefox
      # Only on pushes to main (forked PRs lack the AMO_JWT_* secrets). AMO rejects any version it has
      # seen before, so the run number is appended as an extra version segment (e.g. 1.1.0.456).
      - name: Patch a build-local version for signing
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          jq --arg run "${{ github.run_number }}" '.version = "\(.version).\($run)"' \
            dist/firefox/manifest.json > manifest.json.tmp
          mv manifest.json.tmp dist/firefox/manifest.json
      - name: Sign (unlisted -- not published to addons.mozilla.org's public listing)
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          WEB_EXT_API_KEY: ${{ secrets.AMO_JWT_ISSUER }}
          WEB_EXT_API_SECRET: ${{ secrets.AMO_JWT_SECRET }}
        run: |
          npx web-ext sign \
            --source-dir dist/firefox \
            --artifacts-dir dist/signed \
            --upload-source-code dist/zips/thingport-grab-sources.zip \
            --channel unlisted
      - name: Rename to a stable filename
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          xpi=$(ls dist/signed/*.xpi | head -n1)
          mv "$xpi" dist/signed/thingport-grab-firefox.xpi
      - uses: actions/upload-artifact@v4
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          name: thingport-grab-firefox
          path: extension/dist/signed/thingport-grab-firefox.xpi
          if-no-files-found: error

  release:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: [build-chrome, build-firefox]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: thingport-grab-chrome
          path: dist
      - uses: actions/download-artifact@v4
        with:
          name: thingport-grab-edge
          path: dist
      - uses: actions/download-artifact@v4
        with:
          name: thingport-grab-firefox
          path: dist
      - name: Move the extension-latest tag to this commit
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release delete extension-latest --yes --cleanup-tag || true
      - name: Publish release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: extension-latest
          name: Thingport Grab (latest)
          body: |
            Automated build of the Thingport Grab browser extension (see `extension/README.md`)
            from ${{ github.sha }}.

            See `extension/README.md` for install instructions:

            - **Chrome / other Chromium browsers**: install it from the
              [Chrome Web Store](https://chromewebstore.google.com/detail/nmblahmglpbplmfcggghdgohohlaeiee),
              which keeps it up to date. `thingport-grab-chrome.zip` here is a build of this commit,
              for loading by hand (`chrome://extensions` → **Developer mode** → **Load unpacked**).
            - **Firefox**: install it from
              [Firefox Add-ons](https://addons.mozilla.org/firefox/addon/thingport-grab/), which keeps
              it up to date. `thingport-grab-firefox.xpi` here is a Mozilla-signed build of this
              commit, for installing by hand (open it directly, or drag it onto a Firefox window).
            - **Edge**: install it from
              [Microsoft Edge Add-ons](https://microsoftedge.microsoft.com/addons/detail/kahfidpmojfocohinlmglnfoaimocbol),
              which keeps it up to date. `thingport-grab-edge.zip` here is the same build, for
              loading by hand (`edge://extensions` → **Developer mode** → **Load unpacked**).
          files: |
            dist/thingport-grab-chrome.zip
            dist/thingport-grab-edge.zip
            dist/thingport-grab-firefox.xpi