release.ts

1#!/usr/bin/env bun2// scripts/release.ts3// One command to release Peach to both Chrome Web Store and Firefox AMO.4// Usage: npm run release5//        npm run release:chrome   (Chrome only — skips AMO)6//7// Required environment variables (set from your secret store, then export8// in the release shell — PB-26-013: never written to a shell profile):9//   CWS_CLIENT_ID, CWS_CLIENT_SECRET, CWS_REFRESH_TOKEN, CWS_EXTENSION_ID,10//   PUBLISHER_ID11//   AMO_JWT_ISSUER, AMO_JWT_SECRET  (not needed for --chrome-only)12//13// PB-26-211: all tools are resolved from node_modules/.bin — run14// `bun install --frozen-lockfile` before invoking release.1516import {17  preflight,18  readVersion,19  runCommand,20  safeEnv,21  releaseGateEnv,22  uploadChrome,23  packageSourceArchive,24  signFirefox,25} from "./release-lib";2627const CHROME_ONLY = process.argv.includes("--chrome-only");2829const BOLD = "\x1b[1m";30const DIM = "\x1b[2m";31const ACCENT = "\x1b[38;5;208m";32const GREEN = "\x1b[32m";33const RESET = "\x1b[0m";3435function success(msg: string) {36  console.log(`${GREEN}✓ ${msg}${RESET}`);37}3839// ─── Header ──────────────────────────────────────────────────────────────────4041console.clear();42console.log("");43console.log(`${ACCENT}${BOLD}  ░░  peach release  ░░${RESET}`);44console.log("");4546// ─── Preflight ───────────────────────────────────────────────────────────────4748preflight();49const version = readVersion("manifest.json");50const targets = CHROME_ONLY ? "Chrome" : "Chrome + Firefox";51console.log(`${BOLD}Releasing Peach v${version} to ${targets}${RESET}`);52console.log(`${DIM}Stores update automatically for existing users.${RESET}`);5354// ─── CI gate ──────────────────────────────────────────────────────────────────55// PEACH_RELEASE_BROWSER_GATE=1 is injected by releaseGateEnv for this child.56// PB-26-211: CI runs with a minimal safe environment — no store credentials.5758runCommand("npm", ["run", "ci"], {59  label: "Running CI gate",60  env: releaseGateEnv(),61});62success("All tests pass");6364// ─── Build ────────────────────────────────────────────────────────────────────65// PB-26-211: build children receive no store credentials.6667if (CHROME_ONLY) {68  runCommand("npm", ["run", "build:chrome"], {69    label: "Building Chrome target",70    env: safeEnv(),71  });72} else {73  runCommand("npm", ["run", "build"], {74    label: "Building all targets (Chrome + Firefox)",75    env: safeEnv(),76  });77}78success("Build complete");7980// ─── Chrome release ───────────────────────────────────────────────────────────81// PB-26-211: CWS credentials are read and validated here, immediately before82// upload. They are passed only to the Chrome upload child, never to build or83// CI children.8485console.log(`\n${ACCENT}${BOLD}Chrome Web Store${RESET}`);86uploadChrome(version);87success(`Chrome v${version} submitted — review typically takes minutes to hours`);8889// ─── Firefox release ──────────────────────────────────────────────────────────90// PB-26-211: AMO credentials are read and validated here, immediately before91// signing. They are passed only to the web-ext child, never to Chrome tooling92// or build children.9394if (!CHROME_ONLY) {95  console.log(`\n${ACCENT}${BOLD}Firefox Add-ons (AMO)${RESET}`);96  const sourceZip = packageSourceArchive(version);97  signFirefox(sourceZip);98  success(`Firefox v${version} submitted with source archive retained in artifacts/`);99}100101// ─── Done ─────────────────────────────────────────────────────────────────────102103console.log("");104console.log(`${ACCENT}${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}`);105console.log(`${ACCENT}${BOLD}  Peach v${version} released to ${targets}.${RESET}`);106console.log(`${ACCENT}${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}`);107console.log("");108109if (!CHROME_ONLY) {110  console.log(`  Chrome:  under review — existing users update automatically`);111  console.log(`  Firefox: under review — existing users update automatically`);112} else {113  console.log(`  Chrome: under review — existing users update automatically`);114}115116console.log("");117console.log(`${DIM}Check status:${RESET}`);118console.log(`  Chrome:  https://chrome.google.com/webstore/devconsole`);119if (!CHROME_ONLY) {120  console.log(`  Firefox: https://addons.mozilla.org/developers/`);121}122console.log("");