feat: publish Firefox releases to GitHub

README.md

@@ -39,12 +39,35 @@ domains such as `youtube.com` or `x.com`.
 Manual “Send page”, selection, link and file actions are separate. They create
 Browser Inbox captures; they do not create a workspace or a journal entry.
 
-## Firefox Release
+## Firefox download and updates
+
+The signed XPI is published on the [GitHub Releases page](https://github.com/mirivlad/verstak-browser-extension/releases).
+Download the Firefox asset named `verstak-firefox-<version>.xpi` from the latest
+release and open it in Firefox to install it.
+
+After the first public release, installed copies check GitHub Releases for
+updates through the release's `updates.json` asset. During the alpha phase each
+published release is the current update channel.
+
+## Firefox release publishing
 
 Firefox signing uses `web-ext` and AMO credentials from an env file. The script
 requires `WEB_EXT_API_PROXY`; AMO upload and approval polling run through that
 proxy.
 
+Create the signed XPI and publish it, together with `updates.json`, as the
+current GitHub Release:
+
+```bash
+VERSTAK_BROWSER_ENV=/path/to/.env npm run publish:firefox
+```
+
+The first invocation publishes tag `v2.0.2` and bootstraps the
+`releases/latest/download/updates.json` endpoint. Re-running the command
+replaces those two release assets for the same tag.
+
+To sign and prepare release files locally without changing GitHub:
+
 ```bash
 VERSTAK_BROWSER_ENV=/home/mirivlad/git/verstak/.env npm run release:firefox
 ```
@@ -54,8 +77,9 @@ Release output:
 - `release/firefox/verstak-firefox-<version>.xpi`
 - `release/firefox/updates.json`
 
-The XPI is signed as an unlisted/self-distributed Firefox extension. Build and
-release artifacts are local outputs and are not committed.
+The XPI is signed as an unlisted/self-distributed Firefox extension; GitHub
+Releases distribute that signed file. Build and release artifacts are local
+outputs and are not committed.
 
 ## Reproducible local package
 

firefox/manifest.json

@@ -4,12 +4,12 @@
   "version": "2.0.2",
   "description": "Send pages, selections, links, and files to the local Verstak browser inbox.",
   "author": "Verstak",
-  "homepage_url": "https://git.mirv.top/verstak/verstak-browser-extension",
+  "homepage_url": "https://github.com/mirivlad/verstak-browser-extension",
   "browser_specific_settings": {
     "gecko": {
       "id": "verstak-bridge@verstak.app",
       "strict_min_version": "115.0",
-      "update_url": "https://mirv.top/verstak/firefox/updates.json",
+      "update_url": "https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json",
       "data_collection_permissions": {
         "required": ["none"]
       }

package.json

@@ -6,9 +6,10 @@
   "license": "AGPL-3.0-or-later",
   "scripts": {
     "build": "node scripts/build-extension.js",
-    "test": "node scripts/test-hostname.js && node scripts/test-activity-tracker.js && node scripts/test-protocol.js && node scripts/test-i18n.js && node scripts/test-popup-settings.js && node scripts/test-popup-catalog-fallback.js && node scripts/test-background-i18n.js",
+    "test": "node scripts/test-hostname.js && node scripts/test-activity-tracker.js && node scripts/test-protocol.js && node scripts/test-i18n.js && node scripts/test-popup-settings.js && node scripts/test-popup-catalog-fallback.js && node scripts/test-background-i18n.js && node scripts/test-firefox-github-release.js",
     "sign:firefox": "./scripts/sign-firefox-xpi.sh",
     "release:firefox": "./scripts/release-firefox-xpi.sh",
+    "publish:firefox": "./scripts/publish-firefox-github-release.sh",
     "release:package": "./scripts/package-release.sh"
   },
   "devDependencies": {

scripts/firefox-github-release.js

@@ -0,0 +1,40 @@
+const fs = require('fs');
+
+const REPOSITORY = 'mirivlad/verstak-browser-extension';
+
+function releaseTag(version) {
+  return `v${version}`;
+}
+
+function releaseAssetURL(version, assetName) {
+  return `https://github.com/${REPOSITORY}/releases/download/${releaseTag(version)}/${assetName}`;
+}
+
+function updateManifest(addonID, version, assetName) {
+  return {
+    addons: {
+      [addonID]: {
+        updates: [{
+          version,
+          update_link: releaseAssetURL(version, assetName),
+        }],
+      },
+    },
+  };
+}
+
+function writeUpdates(addonID, version, assetName, outputPath) {
+  fs.writeFileSync(outputPath, `${JSON.stringify(updateManifest(addonID, version, assetName), null, 2)}\n`);
+}
+
+if (require.main === module) {
+  const [, , command, addonID, version, assetName, outputPath] = process.argv;
+  if (command !== 'write-updates' || !addonID || !version || !assetName || !outputPath) {
+    console.error('usage: node scripts/firefox-github-release.js write-updates <addon-id> <version> <asset-name> <output-path>');
+    process.exitCode = 2;
+  } else {
+    writeUpdates(addonID, version, assetName, outputPath);
+  }
+}
+
+module.exports = { REPOSITORY, releaseTag, releaseAssetURL, updateManifest, writeUpdates };

scripts/publish-firefox-github-release.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+REPOSITORY="mirivlad/verstak-browser-extension"
+SOURCE_DIR="${VERSTAK_FIREFOX_SOURCE_DIR:-dist/firefox}"
+RELEASE_DIR="${VERSTAK_FIREFOX_RELEASE_DIR:-release/firefox}"
+
+if ! command -v gh >/dev/null; then
+  echo "ERROR: gh CLI is required to publish a GitHub Release" >&2
+  exit 1
+fi
+
+gh auth status
+./scripts/release-firefox-xpi.sh
+
+VERSION="$(node -e "console.log(require('./${SOURCE_DIR}/manifest.json').version)")"
+TAG="v${VERSION}"
+XPI="$RELEASE_DIR/verstak-firefox-${VERSION}.xpi"
+UPDATES="$RELEASE_DIR/updates.json"
+
+for artifact in "$XPI" "$UPDATES"; do
+  if [[ ! -f "$artifact" ]]; then
+    echo "ERROR: release artifact not found: $artifact" >&2
+    exit 1
+  fi
+done
+
+if gh release view "$TAG" --repo "$REPOSITORY" >/dev/null 2>&1; then
+  gh release upload "$TAG" "$XPI" "$UPDATES" --repo "$REPOSITORY" --clobber
+else
+  gh release create "$TAG" "$XPI" "$UPDATES" \
+    --repo "$REPOSITORY" \
+    --title "Verstak Browser Extension $VERSION" \
+    --generate-notes \
+    --latest \
+    --target "$(git rev-parse HEAD)"
+fi
+
+echo "GitHub release:"
+gh release view "$TAG" --repo "$REPOSITORY" --json url --jq .url

scripts/release-firefox-xpi.sh

@@ -32,7 +32,6 @@ load_env_file "$ENV_FILE"
 SOURCE_DIR="${VERSTAK_FIREFOX_SOURCE_DIR:-dist/firefox}"
 ARTIFACTS_DIR="${WEB_EXT_ARTIFACTS_DIR:-web-ext-artifacts}"
 RELEASE_DIR="${VERSTAK_FIREFOX_RELEASE_DIR:-release/firefox}"
-UPDATE_BASE_URL="${VERSTAK_FIREFOX_UPDATE_BASE_URL:-https://mirv.top/verstak/firefox}"
 
 ./scripts/sign-firefox-xpi.sh
 
@@ -54,20 +53,8 @@ mkdir -p "$RELEASE_DIR"
 RELEASE_XPI="verstak-firefox-${VERSION}.xpi"
 cp "$SIGNED_XPI" "$RELEASE_DIR/$RELEASE_XPI"
 
-cat > "$RELEASE_DIR/updates.json" <<EOF
-{
-  "addons": {
-    "${ADDON_ID}": {
-      "updates": [
-        {
-          "version": "${VERSION}",
-          "update_link": "${UPDATE_BASE_URL}/${RELEASE_XPI}"
-        }
-      ]
-    }
-  }
-}
-EOF
+node scripts/firefox-github-release.js write-updates \
+  "$ADDON_ID" "$VERSION" "$RELEASE_XPI" "$RELEASE_DIR/updates.json"
 
 echo "Firefox release artifacts:"
 echo "$RELEASE_DIR/$RELEASE_XPI"

scripts/test-firefox-github-release.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+const assert = require('assert');
+const fs = require('fs');
+const release = require('./firefox-github-release');
+
+const version = '2.0.2';
+const asset = 'verstak-firefox-2.0.2.xpi';
+
+assert.equal(release.releaseTag(version), 'v2.0.2');
+assert.equal(
+  release.releaseAssetURL(version, asset),
+  'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.2/verstak-firefox-2.0.2.xpi',
+);
+assert.deepEqual(release.updateManifest('verstak-bridge@verstak.app', version, asset), {
+  addons: {
+    'verstak-bridge@verstak.app': {
+      updates: [{
+        version: '2.0.2',
+        update_link: 'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.2/verstak-firefox-2.0.2.xpi',
+      }],
+    },
+  },
+});
+
+const firefoxManifest = require('../firefox/manifest.json');
+assert.equal(firefoxManifest.homepage_url, 'https://github.com/mirivlad/verstak-browser-extension');
+assert.equal(
+  firefoxManifest.browser_specific_settings.gecko.update_url,
+  'https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json',
+);
+
+const publisher = fs.readFileSync('scripts/publish-firefox-github-release.sh', 'utf8');
+assert.match(publisher, /gh auth status/);
+assert.match(publisher, /gh release create/);
+assert.match(publisher, /gh release upload/);
+assert.match(publisher, /--clobber/);
+assert.match(publisher, /--latest/);
+
+console.log('Firefox GitHub release metadata tests passed');