release-firefox.ts

1#!/usr/bin/env bun2// scripts/release-firefox.ts3// One-command Firefox AMO release.4// Usage: bun run scripts/release-firefox.ts5//6// Required environment variables:7//   AMO_JWT_ISSUER, AMO_JWT_SECRET8//9// PB-26-211: all tools are resolved from node_modules/.bin — run10// `bun install --frozen-lockfile` before invoking release.1112import {13  preflight,14  readVersion,15  runCommand,16  safeEnv,17  packageSourceArchive,18  signFirefox,19} from "./release-lib";2021// ─── Preflight ───────────────────────────────────────────────────────────────2223preflight();24const version = readVersion("manifest.firefox.json");25console.log(`\n🍑 Peach Firefox — releasing v${version}`);2627// ─── CI gate ───────────────────────────────────────────────────────────────────28// PB-26-211: CI runs with a minimal safe environment — no store credentials.2930runCommand("npm", ["run", "ci"], {31  label: "Running CI gate",32  env: safeEnv(),33});3435// ─── Build ─────────────────────────────────────────────────────────────────────3637runCommand("npm", ["run", "build:firefox"], {38  label: `Building Firefox extension v${version}`,39  env: safeEnv(),40});4142// ─── Package source archive ────────────────────────────────────────────────────43// AMO requires source for any extension with minified/transpiled code.44// This zips everything a reviewer needs to build Peach from source.4546const sourceZip = packageSourceArchive(version);4748// ─── Sign and submit ───────────────────────────────────────────────────────────49// PB-26-211: AMO credentials are read and validated here, immediately before50// signing. They are passed only to the web-ext child.5152signFirefox(sourceZip);5354// ─── Done ──────────────────────────────────────────────────────────────────────5556console.log(`\n✓ Peach Firefox v${version} submitted to AMO.`);57console.log(`  Source archive retained at ${sourceZip}.`);58console.log("  Existing users will receive the update automatically.");59console.log("  Check AMO developer hub for review status.");60console.log("");