release-firefox.ts

1#!/usr/bin/env bun2// scripts/release-firefox.ts3// One-command Firefox AMO release.4// Usage: bun run scripts/release-firefox.ts5//6// Required environment variables:7//   AMO_JWT_ISSUER, AMO_JWT_SECRET8//9// PB-26-211: all tools are resolved from node_modules/.bin — run10// `bun install --frozen-lockfile` before invoking release.1112import {13  preflight,14  readVersion,15  runCommand,16  safeEnv,17  packageSourceArchive,18  signFirefox,19} from "./release-lib";2021// ─── Preflight ───────────────────────────────────────────────────────────────2223preflight();24const version = readVersion("manifest.firefox.json");25console.log(`\n🍑 Peach Firefox — releasing v${version}`);2627// ─── CI gate ───────────────────────────────────────────────────────────────────28// PB-26-211: CI runs with a minimal safe environment — no store credentials.2930runCommand("npm", ["run", "ci"], {31  label: "Running CI gate",32  env: safeEnv(),33});3435// ─── Build ─────────────────────────────────────────────────────────────────────3637runCommand("npm", ["run", "build:firefox"], {38  label: `Building Firefox extension v${version}`,39  env: safeEnv(),40});4142runCommand("npm", ["run", "test:sync:cross-client"], {43  label: "Running cross-client sync gate",44  env: safeEnv(),45});464748// ─── Package source archive ────────────────────────────────────────────────────49// AMO requires source for any extension with minified/transpiled code.50// This zips everything a reviewer needs to build Peach from source.5152const sourceZip = packageSourceArchive(version);5354// ─── Sign and submit ───────────────────────────────────────────────────────────55// PB-26-211: AMO credentials are read and validated here, immediately before56// signing. They are passed only to the web-ext child.5758signFirefox(sourceZip);5960// ─── Done ──────────────────────────────────────────────────────────────────────6162console.log(`\n✓ Peach Firefox v${version} submitted to AMO.`);63console.log(`  Source archive retained at ${sourceZip}.`);64console.log("  Existing users will receive the update automatically.");65console.log("  Check AMO developer hub for review status.");66console.log("");