feat: publish Firefox releases to GitHub

LICENSE

@@ -0,0 +1,17 @@
+Verstak Browser Extension
+Copyright (C) 2026 Verstak contributors
+
+This program is free software: you can redistribute it and/or modify it under
+the terms of the GNU Affero General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT
+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+details.
+
+The complete license text is available at:
+https://www.gnu.org/licenses/agpl-3.0.html
+
+SPDX-License-Identifier: AGPL-3.0-or-later

README.md

@@ -1,4 +1,4 @@
-# verstak-browser-extension
+# Verstak Browser Extension
 
 Verstak Browser Extension captures pages, selected text, links, and selected
 files and sends them to a local Verstak browser inbox receiver.
@@ -7,6 +7,8 @@ The extension does not know Notes, Files, Activity, or Journal internals. It
 only sends capture events through the public local receiver protocol. If the
 receiver is offline, captures stay in the extension pending queue.
 
+> **Alpha software.** Use with a matching Verstak Desktop alpha release.
+
 ## Build
 
 ```bash
@@ -20,12 +22,52 @@ Build output:
 - `dist/chromium`
 - `dist/firefox`
 
-## Firefox Release
+Load `dist/chromium` as an unpacked extension in Chromium-based browsers, or
+load `dist/firefox` temporarily in Firefox during development.
+
+## Passive domain activity
+
+Passive tracking is **off by default**. On first use the extension explains
+what it records; the user must explicitly enable it in extension settings.
+
+When enabled, it observes only the focused browser's active tab and sends
+bounded aggregate intervals as a canonical domain name plus duration. It never
+sends URL paths, page titles, page text, selected text, keystrokes, navigation
+history or inactive-tab time. The settings screen has an exclusion list for
+domains such as `youtube.com` or `x.com`.
+
+Manual “Send page”, selection, link and file actions are separate. They create
+Browser Inbox captures; they do not create a workspace or a journal entry.
+
+## Firefox download and updates
+
+The signed XPI is published on the [GitHub Releases page](https://github.com/mirivlad/verstak-browser-extension/releases).
+Download the Firefox asset named `verstak-firefox-<version>.xpi` from the latest
+release and open it in Firefox to install it.
+
+After the first public release, installed copies check GitHub Releases for
+updates through the release's `updates.json` asset. During the alpha phase each
+published release is the current update channel.
+
+## Firefox release publishing
 
 Firefox signing uses `web-ext` and AMO credentials from an env file. The script
 requires `WEB_EXT_API_PROXY`; AMO upload and approval polling run through that
 proxy.
 
+Create the signed XPI and publish it, together with `updates.json`, as the
+current GitHub Release:
+
+```bash
+VERSTAK_BROWSER_ENV=/path/to/.env npm run publish:firefox
+```
+
+The first invocation publishes tag `v2.0.2` and bootstraps the
+`releases/latest/download/updates.json` endpoint. Re-running the command
+replaces those two release assets for the same tag.
+
+To sign and prepare release files locally without changing GitHub:
+
 ```bash
 VERSTAK_BROWSER_ENV=/home/mirivlad/git/verstak/.env npm run release:firefox
 ```
@@ -35,8 +77,19 @@ Release output:
 - `release/firefox/verstak-firefox-<version>.xpi`
 - `release/firefox/updates.json`
 
-The XPI is signed as an unlisted/self-distributed Firefox extension. Build and
+The XPI is signed as an unlisted/self-distributed Firefox extension; GitHub
-release artifacts are local outputs and are not committed.
+Releases distribute that signed file. Build and release artifacts are local
+outputs and are not committed.
+
+## Reproducible local package
+
+```bash
+npm run release:package -- v0.1.0-alpha.1
+```
+
+This runs the tests and build, then writes unsigned Chromium and Firefox source
+packages to `release/` with a `SHA256SUMS` file. Use `release:firefox` above
+when an AMO-signed XPI is required.
 
 ## Manual Check
 
@@ -109,3 +162,8 @@ Expected success response:
 ```json
 { "status": "accepted", "captureId": "uuid-or-generated-id" }
 ```
+
+## License
+
+Copyright © 2026 Verstak contributors. Licensed under
+[GNU AGPLv3 or later](LICENSE).

docs/superpowers/plans/2026-07-12-github-firefox-updates.md

@@ -0,0 +1,329 @@
+# GitHub Firefox Updates Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Publish signed Firefox XPI releases to GitHub Releases and let installed alpha extensions discover them through a GitHub-hosted update manifest.
+
+**Architecture:** Firefox keeps one immutable `update_url` targeting the current GitHub Release's `updates.json` asset. A small Node helper owns the tag, asset URL and update-manifest formatting so it has focused unit tests. The existing local signing command remains local; an explicit publishing command uploads its two artifacts to the public GitHub release.
+
+**Tech Stack:** Manifest V2 JSON, Node.js CommonJS tests, Bash, `web-ext`, GitHub CLI (`gh`).
+
+## Global Constraints
+
+- Publish repository: `mirivlad/verstak-browser-extension`.
+- Firefox addon ID: `verstak-bridge@verstak.app`.
+- Initial GitHub release: `v2.0.2`; package and both browser manifests are version `2.0.2`.
+- Every alpha GitHub release is ordinary/latest, not a prerelease.
+- XPI remains Mozilla-signed as an unlisted/self-distributed addon before upload.
+- `npm run release:firefox` remains a local sign-and-package action.
+- `npm run publish:firefox` is the only command allowed to create or modify a GitHub Release.
+- Generated `release/` output remains untracked.
+
+---
+
+### Task 1: Make GitHub update metadata testable
+
+**Files:**
+- Create: `scripts/firefox-github-release.js`
+- Create: `scripts/test-firefox-github-release.js`
+- Modify: `package.json:8-15`
+
+**Interfaces:**
+- Produces `releaseTag(version)`, `releaseAssetURL(version, assetName)`, and `updateManifest(addonID, version, assetName)` from `scripts/firefox-github-release.js`.
+- `updateManifest` returns the object written as `updates.json` and uses the fixed GitHub repository.
+- Later shell scripts invoke `node scripts/firefox-github-release.js write-updates <addon-id> <version> <asset-name> <output-path>`.
+
+- [ ] **Step 1: Write the failing metadata test**
+
+Create `scripts/test-firefox-github-release.js` with:
+
+```js
+const assert = require('assert');
+const release = require('./firefox-github-release');
+
+const version = '2.0.2';
+const asset = 'verstak-firefox-2.0.2.xpi';
+assert.equal(release.releaseTag(version), 'v2.0.2');
+assert.equal(
+  release.releaseAssetURL(version, asset),
+  'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.2/verstak-firefox-2.0.2.xpi',
+);
+assert.deepEqual(release.updateManifest('verstak-bridge@verstak.app', version, asset), {
+  addons: {
+    'verstak-bridge@verstak.app': {
+      updates: [{
+        version: '2.0.2',
+        update_link: 'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.2/verstak-firefox-2.0.2.xpi',
+      }],
+    },
+  },
+});
+console.log('Firefox GitHub release metadata tests passed');
+```
+
+- [ ] **Step 2: Run the focused test and verify it fails**
+
+Run: `node scripts/test-firefox-github-release.js`
+
+Expected: failure because `scripts/firefox-github-release.js` does not yet exist.
+
+- [ ] **Step 3: Implement the metadata helper**
+
+Create `scripts/firefox-github-release.js` with these exact exports and CLI:
+
+```js
+const fs = require('fs');
+const REPOSITORY = 'mirivlad/verstak-browser-extension';
+
+function releaseTag(version) { return `v${version}`; }
+function releaseAssetURL(version, assetName) {
+  return `https://github.com/${REPOSITORY}/releases/download/${releaseTag(version)}/${assetName}`;
+}
+function updateManifest(addonID, version, assetName) {
+  return { addons: { [addonID]: { updates: [{ version, update_link: releaseAssetURL(version, assetName) }] } } };
+}
+
+if (require.main === module) {
+  const [, , command, addonID, version, assetName, outputPath] = process.argv;
+  if (command !== 'write-updates' || !addonID || !version || !assetName || !outputPath) process.exitCode = 2;
+  else fs.writeFileSync(outputPath, `${JSON.stringify(updateManifest(addonID, version, assetName), null, 2)}\n`);
+}
+
+module.exports = { REPOSITORY, releaseTag, releaseAssetURL, updateManifest };
+```
+
+- [ ] **Step 4: Register and run the test**
+
+Append `node scripts/test-firefox-github-release.js` to the existing `test`
+script in `package.json`, then run:
+
+```bash
+npm test
+```
+
+Expected: all existing tests and `Firefox GitHub release metadata tests passed`.
+
+- [ ] **Step 5: Commit and push**
+
+```bash
+git add package.json scripts/firefox-github-release.js scripts/test-firefox-github-release.js
+git commit -m "test: cover Firefox GitHub release metadata"
+git push origin main
+```
+
+### Task 2: Point Firefox and local release artifacts at GitHub
+
+**Files:**
+- Modify: `firefox/manifest.json:8-17`
+- Modify: `scripts/release-firefox-xpi.sh:29-70`
+- Test: `scripts/test-firefox-github-release.js`
+
+**Interfaces:**
+- Firefox reads `https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json`.
+- `release-firefox-xpi.sh` invokes the Task 1 helper to write a versioned update manifest.
+- It continues producing `release/firefox/verstak-firefox-<version>.xpi` and `release/firefox/updates.json` locally.
+
+- [ ] **Step 1: Extend the failing test with the stable manifest URL**
+
+Add this assertion to `scripts/test-firefox-github-release.js` before its final
+success message:
+
+```js
+const firefoxManifest = require('../firefox/manifest.json');
+assert.equal(
+  firefoxManifest.browser_specific_settings.gecko.update_url,
+  'https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json',
+);
+```
+
+- [ ] **Step 2: Run the focused test and verify it fails**
+
+Run: `node scripts/test-firefox-github-release.js`
+
+Expected: assertion failure because the manifest still uses `mirv.top`.
+
+- [ ] **Step 3: Replace the update endpoint and JSON writer**
+
+In `firefox/manifest.json`, replace only the Gecko `update_url` value with:
+
+```json
+"update_url": "https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json"
+```
+
+In `scripts/release-firefox-xpi.sh`, remove `UPDATE_BASE_URL` and replace the
+heredoc that writes `updates.json` with:
+
+```bash
+node scripts/firefox-github-release.js write-updates \
+  "$ADDON_ID" "$VERSION" "$RELEASE_XPI" "$RELEASE_DIR/updates.json"
+```
+
+- [ ] **Step 4: Run targeted checks**
+
+Run:
+
+```bash
+node scripts/test-firefox-github-release.js
+bash -n scripts/release-firefox-xpi.sh
+npm test
+npm run build
+```
+
+Expected: all commands succeed; `dist/firefox/manifest.json` contains the
+GitHub update URL after the build.
+
+- [ ] **Step 5: Commit and push**
+
+```bash
+git add firefox/manifest.json scripts/release-firefox-xpi.sh scripts/test-firefox-github-release.js
+git commit -m "feat: host Firefox updates on GitHub Releases"
+git push origin main
+```
+
+### Task 3: Add explicit GitHub publishing and public instructions
+
+**Files:**
+- Create: `scripts/publish-firefox-github-release.sh`
+- Modify: `package.json:8-15`
+- Modify: `README.md:42-68`
+- Test: `scripts/publish-firefox-github-release.sh`
+
+**Interfaces:**
+- `npm run publish:firefox` calls `scripts/publish-firefox-github-release.sh`.
+- The script runs the existing local release command, then uploads
+  `verstak-firefox-<version>.xpi` and `updates.json` to release tag
+  `v<version>` in `mirivlad/verstak-browser-extension`.
+- A pre-existing tag receives asset replacement through `gh release upload --clobber`.
+
+- [ ] **Step 1: Write the shell-contract test**
+
+Create a Node test that reads the publish script and asserts the mandatory
+commands are present:
+
+```js
+const assert = require('assert');
+const fs = require('fs');
+const source = fs.readFileSync('scripts/publish-firefox-github-release.sh', 'utf8');
+assert.match(source, /gh auth status/);
+assert.match(source, /gh release create/);
+assert.match(source, /gh release upload/);
+assert.match(source, /--clobber/);
+assert.match(source, /--latest/);
+```
+
+Place those assertions in `scripts/test-firefox-github-release.js` and run the
+test. Expected: it fails before the publish script exists.
+
+- [ ] **Step 2: Implement an explicit idempotent publisher**
+
+Create `scripts/publish-firefox-github-release.sh` with this behavior:
+
+1. Set `ROOT_DIR`, `cd` to it and run `gh auth status`.
+2. Run `./scripts/release-firefox-xpi.sh`.
+3. Read `VERSION` from `dist/firefox/manifest.json`, set `TAG="v${VERSION}"`,
+   `REPOSITORY="mirivlad/verstak-browser-extension"`, and locate the two local
+   release assets by exact names.
+4. Run `gh release view "$TAG" --repo "$REPOSITORY"`; when it is absent, run
+   `gh release create "$TAG" "$XPI" "$UPDATES" --repo "$REPOSITORY" --title
+   "Verstak Browser Extension $VERSION" --generate-notes --latest --target
+   "$(git rev-parse HEAD)"`.
+5. When the release already exists, run `gh release upload "$TAG" "$XPI"
+   "$UPDATES" --repo "$REPOSITORY" --clobber`.
+6. Print the GitHub release URL with `gh release view "$TAG" --repo
+   "$REPOSITORY" --json url --jq .url`.
+
+- [ ] **Step 3: Register the command and document it**
+
+Add to `package.json`:
+
+```json
+"publish:firefox": "./scripts/publish-firefox-github-release.sh"
+```
+
+Rewrite the Firefox Release README section so it documents:
+
+- the public [GitHub Releases](https://github.com/mirivlad/verstak-browser-extension/releases) page;
+- `VERSTAK_BROWSER_ENV=/path/to/.env npm run publish:firefox`;
+- that signing remains unlisted with Mozilla but distribution and automatic
+  updates use GitHub Release assets;
+- that the first `v2.0.2` publish bootstraps the `latest/download/updates.json`
+  endpoint.
+
+- [ ] **Step 4: Run checks without publishing**
+
+Run:
+
+```bash
+bash -n scripts/publish-firefox-github-release.sh
+node scripts/test-firefox-github-release.js
+npm test
+npm run build
+git diff --check
+```
+
+Expected: all commands succeed. Do not invoke `npm run publish:firefox` in this
+task; it creates a public GitHub Release and needs available AMO credentials.
+
+- [ ] **Step 5: Commit and push**
+
+```bash
+git add README.md package.json scripts/publish-firefox-github-release.sh scripts/test-firefox-github-release.js
+git commit -m "feat: publish Firefox releases to GitHub"
+git push origin main
+```
+
+### Task 4: Bootstrap and verify the first public update release
+
+**Files:**
+- Generated: `release/firefox/verstak-firefox-2.0.2.xpi` (untracked)
+- Generated: `release/firefox/updates.json` (untracked)
+
+**Interfaces:**
+- Consumes the Task 3 `npm run publish:firefox` command and valid AMO signing credentials.
+- Produces GitHub Release tag `v2.0.2` and public XPI/update-manifest assets.
+
+- [ ] **Step 1: Verify release credentials before write operations**
+
+Run:
+
+```bash
+gh auth status
+test -n "${VERSTAK_BROWSER_ENV:-}" || test -f .env
+```
+
+Expected: authenticated GitHub CLI and a configured environment file path for
+the existing AMO signing command.
+
+- [ ] **Step 2: Publish the first release**
+
+Run:
+
+```bash
+npm run publish:firefox
+```
+
+Expected: Mozilla signing succeeds, GitHub Release `v2.0.2` is latest, and it
+contains `verstak-firefox-2.0.2.xpi` plus `updates.json`.
+
+- [ ] **Step 3: Verify public delivery**
+
+Run:
+
+```bash
+gh release view v2.0.2 --repo mirivlad/verstak-browser-extension --json isLatest,url,assets
+curl -fsSL https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json
+```
+
+Expected: the release is latest and the JSON contains addon ID
+`verstak-bridge@verstak.app`, version `2.0.2`, and the versioned GitHub XPI
+asset URL.
+
+- [ ] **Step 4: Record release verification without committing assets**
+
+Run:
+
+```bash
+git status --short
+```
+
+Expected: no generated `release/` assets are staged or committed.

docs/superpowers/specs/2026-07-12-github-firefox-updates-design.md

@@ -0,0 +1,66 @@
+# GitHub Releases for Firefox Updates
+
+## Decision
+
+Firefox XPI releases are published as ordinary public GitHub Releases in
+`mirivlad/verstak-browser-extension`. During the alpha phase every such release
+is marked as the repository's latest release, including alpha versions. There
+are no other Verstak users whose automatic updates need a separate stable
+channel yet.
+
+## Update protocol
+
+The Firefox manifest uses this stable endpoint:
+
+```text
+https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json
+```
+
+Each release uploads two assets:
+
+- `verstak-firefox-<version>.xpi`, signed by Mozilla as an unlisted addon;
+- `updates.json`, whose `update_link` points to that same release tag's XPI
+  asset.
+
+For version `2.0.2`, the versioned link is:
+
+```text
+https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.2/verstak-firefox-2.0.2.xpi
+```
+
+The stable `latest/download` endpoint lets already installed extensions discover
+the next version without changing the manifest on each release.
+
+## Release commands
+
+`npm run release:firefox` remains the local sign-and-package command. A new
+explicit `npm run publish:firefox` command runs it, verifies `gh`
+authentication, creates or reuses the `v<manifest-version>` GitHub Release,
+and uploads the XPI plus `updates.json`. Re-running the command replaces only
+those two assets, so a failed network upload can be retried safely.
+
+Publishing requires the existing AMO credentials used for signing and a
+GitHub-authenticated `gh` CLI. It does not use the invalid `mirv.top` update
+endpoint.
+
+## Bootstrap
+
+There is currently no GitHub Release in this repository. After the code change,
+the first `v2.0.2` signed release must be published before shipping a manifest
+that points to `latest/download/updates.json`; until then that URL is a 404.
+The current package, Chromium manifest and Firefox manifest all use version
+`2.0.2`, so the initial tag and XPI asset name are unambiguous.
+
+## Documentation
+
+The README links users to the GitHub Releases page for downloading the signed
+Firefox XPI and documents that releases are currently the auto-update channel.
+
+## Verification
+
+- add a focused script test for versioned GitHub URLs and generated
+  `updates.json`;
+- run the existing extension test suite and build;
+- run shell syntax validation for the publish script;
+- verify a published release's assets and `latest/download/updates.json` with
+  unauthenticated HTTPS requests.

firefox/manifest.json

@@ -4,12 +4,12 @@
   "version": "2.0.2",
   "description": "Send pages, selections, links, and files to the local Verstak browser inbox.",
   "author": "Verstak",
-  "homepage_url": "https://git.mirv.top/verstak/verstak-browser-extension",
+  "homepage_url": "https://github.com/mirivlad/verstak-browser-extension",
   "browser_specific_settings": {
     "gecko": {
       "id": "verstak-bridge@verstak.app",
       "strict_min_version": "115.0",
-      "update_url": "https://mirv.top/verstak/firefox/updates.json",
+      "update_url": "https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json",
       "data_collection_permissions": {
         "required": ["none"]
       }

package.json

@@ -3,11 +3,14 @@
   "version": "2.0.2",
   "private": true,
   "description": "Verstak browser capture extension for Chromium and Firefox",
+  "license": "AGPL-3.0-or-later",
   "scripts": {
     "build": "node scripts/build-extension.js",
-    "test": "node scripts/test-hostname.js && node scripts/test-activity-tracker.js && node scripts/test-protocol.js && node scripts/test-i18n.js && node scripts/test-popup-settings.js && node scripts/test-popup-catalog-fallback.js && node scripts/test-background-i18n.js",
+    "test": "node scripts/test-hostname.js && node scripts/test-activity-tracker.js && node scripts/test-protocol.js && node scripts/test-i18n.js && node scripts/test-popup-settings.js && node scripts/test-popup-catalog-fallback.js && node scripts/test-background-i18n.js && node scripts/test-firefox-github-release.js",
     "sign:firefox": "./scripts/sign-firefox-xpi.sh",
-    "release:firefox": "./scripts/release-firefox-xpi.sh"
+    "release:firefox": "./scripts/release-firefox-xpi.sh",
+    "publish:firefox": "./scripts/publish-firefox-github-release.sh",
+    "release:package": "./scripts/package-release.sh"
   },
   "devDependencies": {
     "web-ext": "^8.3.0"

scripts/firefox-github-release.js

@@ -0,0 +1,40 @@
+const fs = require('fs');
+
+const REPOSITORY = 'mirivlad/verstak-browser-extension';
+
+function releaseTag(version) {
+  return `v${version}`;
+}
+
+function releaseAssetURL(version, assetName) {
+  return `https://github.com/${REPOSITORY}/releases/download/${releaseTag(version)}/${assetName}`;
+}
+
+function updateManifest(addonID, version, assetName) {
+  return {
+    addons: {
+      [addonID]: {
+        updates: [{
+          version,
+          update_link: releaseAssetURL(version, assetName),
+        }],
+      },
+    },
+  };
+}
+
+function writeUpdates(addonID, version, assetName, outputPath) {
+  fs.writeFileSync(outputPath, `${JSON.stringify(updateManifest(addonID, version, assetName), null, 2)}\n`);
+}
+
+if (require.main === module) {
+  const [, , command, addonID, version, assetName, outputPath] = process.argv;
+  if (command !== 'write-updates' || !addonID || !version || !assetName || !outputPath) {
+    console.error('usage: node scripts/firefox-github-release.js write-updates <addon-id> <version> <asset-name> <output-path>');
+    process.exitCode = 2;
+  } else {
+    writeUpdates(addonID, version, assetName, outputPath);
+  }
+}
+
+module.exports = { REPOSITORY, releaseTag, releaseAssetURL, updateManifest, writeUpdates };

scripts/package-release.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+VERSION="${1:-}"
+
+if [[ -z "$VERSION" || ! "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
+  echo "usage: $0 <version>" >&2
+  echo "example: $0 v0.1.0-alpha.1" >&2
+  exit 2
+fi
+
+echo "=== verstak browser extension release $VERSION ==="
+(cd "$ROOT" && npm ci --no-audit --no-fund && npm test && npm run build)
+
+RELEASE_ROOT="$ROOT/release"
+STAGING="$RELEASE_ROOT/verstak-browser-extension-$VERSION"
+ARCHIVE="$RELEASE_ROOT/verstak-browser-extension-$VERSION.tar.gz"
+rm -rf "$STAGING" "$ARCHIVE"
+mkdir -p "$STAGING"
+
+cp "$ROOT/README.md" "$ROOT/LICENSE" "$STAGING/"
+cp -R "$ROOT/dist" "$STAGING/dist"
+tar -C "$RELEASE_ROOT" -czf "$ARCHIVE" "$(basename "$STAGING")"
+(cd "$RELEASE_ROOT" && sha256sum "$(basename "$ARCHIVE")" > SHA256SUMS)
+
+echo "release archive: $ARCHIVE"
+echo "checksums:       $RELEASE_ROOT/SHA256SUMS"

scripts/publish-firefox-github-release.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+REPOSITORY="mirivlad/verstak-browser-extension"
+SOURCE_DIR="${VERSTAK_FIREFOX_SOURCE_DIR:-dist/firefox}"
+RELEASE_DIR="${VERSTAK_FIREFOX_RELEASE_DIR:-release/firefox}"
+
+if ! command -v gh >/dev/null; then
+  echo "ERROR: gh CLI is required to publish a GitHub Release" >&2
+  exit 1
+fi
+
+gh auth status
+./scripts/release-firefox-xpi.sh
+
+VERSION="$(node -e "console.log(require('./${SOURCE_DIR}/manifest.json').version)")"
+TAG="v${VERSION}"
+XPI="$RELEASE_DIR/verstak-firefox-${VERSION}.xpi"
+UPDATES="$RELEASE_DIR/updates.json"
+
+for artifact in "$XPI" "$UPDATES"; do
+  if [[ ! -f "$artifact" ]]; then
+    echo "ERROR: release artifact not found: $artifact" >&2
+    exit 1
+  fi
+done
+
+if gh release view "$TAG" --repo "$REPOSITORY" >/dev/null 2>&1; then
+  gh release upload "$TAG" "$XPI" "$UPDATES" --repo "$REPOSITORY" --clobber
+else
+  gh release create "$TAG" "$XPI" "$UPDATES" \
+    --repo "$REPOSITORY" \
+    --title "Verstak Browser Extension $VERSION" \
+    --generate-notes \
+    --latest \
+    --target "$(git rev-parse HEAD)"
+fi
+
+echo "GitHub release:"
+gh release view "$TAG" --repo "$REPOSITORY" --json url --jq .url

scripts/release-firefox-xpi.sh

@@ -32,7 +32,6 @@ load_env_file "$ENV_FILE"
 SOURCE_DIR="${VERSTAK_FIREFOX_SOURCE_DIR:-dist/firefox}"
 ARTIFACTS_DIR="${WEB_EXT_ARTIFACTS_DIR:-web-ext-artifacts}"
 RELEASE_DIR="${VERSTAK_FIREFOX_RELEASE_DIR:-release/firefox}"
-UPDATE_BASE_URL="${VERSTAK_FIREFOX_UPDATE_BASE_URL:-https://mirv.top/verstak/firefox}"
 
 ./scripts/sign-firefox-xpi.sh
 
@@ -54,20 +53,8 @@ mkdir -p "$RELEASE_DIR"
 RELEASE_XPI="verstak-firefox-${VERSION}.xpi"
 cp "$SIGNED_XPI" "$RELEASE_DIR/$RELEASE_XPI"
 
-cat > "$RELEASE_DIR/updates.json" <<EOF
+node scripts/firefox-github-release.js write-updates \
-{
+  "$ADDON_ID" "$VERSION" "$RELEASE_XPI" "$RELEASE_DIR/updates.json"
-  "addons": {
-    "${ADDON_ID}": {
-      "updates": [
-        {
-          "version": "${VERSION}",
-          "update_link": "${UPDATE_BASE_URL}/${RELEASE_XPI}"
-        }
-      ]
-    }
-  }
-}
-EOF
 
 echo "Firefox release artifacts:"
 echo "$RELEASE_DIR/$RELEASE_XPI"

scripts/test-firefox-github-release.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+const assert = require('assert');
+const fs = require('fs');
+const release = require('./firefox-github-release');
+
+const version = '2.0.2';
+const asset = 'verstak-firefox-2.0.2.xpi';
+
+assert.equal(release.releaseTag(version), 'v2.0.2');
+assert.equal(
+  release.releaseAssetURL(version, asset),
+  'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.2/verstak-firefox-2.0.2.xpi',
+);
+assert.deepEqual(release.updateManifest('verstak-bridge@verstak.app', version, asset), {
+  addons: {
+    'verstak-bridge@verstak.app': {
+      updates: [{
+        version: '2.0.2',
+        update_link: 'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.2/verstak-firefox-2.0.2.xpi',
+      }],
+    },
+  },
+});
+
+const firefoxManifest = require('../firefox/manifest.json');
+assert.equal(firefoxManifest.homepage_url, 'https://github.com/mirivlad/verstak-browser-extension');
+assert.equal(
+  firefoxManifest.browser_specific_settings.gecko.update_url,
+  'https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json',
+);
+
+const publisher = fs.readFileSync('scripts/publish-firefox-github-release.sh', 'utf8');
+assert.match(publisher, /gh auth status/);
+assert.match(publisher, /gh release create/);
+assert.match(publisher, /gh release upload/);
+assert.match(publisher, /--clobber/);
+assert.match(publisher, /--latest/);
+
+console.log('Firefox GitHub release metadata tests passed');