release.ts

1#!/usr/bin/env bun2// scripts/release.ts3// One command to release Peach to both Chrome Web Store and Firefox AMO.4// Usage: npm run release5//        npm run release:chrome   (Chrome only — skips AMO)6//7// Required environment variables (set from your secret store, then export8// in the release shell — PB-26-013: never written to a shell profile):9//   CWS_CLIENT_ID, CWS_CLIENT_SECRET, CWS_REFRESH_TOKEN, CWS_EXTENSION_ID,10//   PUBLISHER_ID11//   AMO_JWT_ISSUER, AMO_JWT_SECRET  (not needed for --chrome-only)12//13// PB-26-211: all tools are resolved from node_modules/.bin — run14// `bun install --frozen-lockfile` before invoking release.1516import {17  preflight,18  readVersion,19  runCommand,20  safeEnv,21  uploadChrome,22  packageSourceArchive,23  signFirefox,24} from "./release-lib";2526const CHROME_ONLY = process.argv.includes("--chrome-only");2728const BOLD = "\x1b[1m";29const DIM = "\x1b[2m";30const ACCENT = "\x1b[38;5;208m";31const GREEN = "\x1b[32m";32const RESET = "\x1b[0m";3334function success(msg: string) {35  console.log(`${GREEN}✓ ${msg}${RESET}`);36}3738// ─── Header ──────────────────────────────────────────────────────────────────3940console.clear();41console.log("");42console.log(`${ACCENT}${BOLD}  ░░  peach release  ░░${RESET}`);43console.log("");4445// ─── Preflight ───────────────────────────────────────────────────────────────4647preflight();48const version = readVersion("manifest.json");49const targets = CHROME_ONLY ? "Chrome" : "Chrome + Firefox";50console.log(`${BOLD}Releasing Peach v${version} to ${targets}${RESET}`);51console.log(`${DIM}Stores update automatically for existing users.${RESET}`);5253// ─── CI gate ──────────────────────────────────────────────────────────────────54// PB-26-211: CI runs with a minimal safe environment — no store credentials.5556runCommand("npm", ["run", "ci"], {57  label: "Running CI gate",58  env: safeEnv(),59});60success("All tests pass");6162// ─── Build ────────────────────────────────────────────────────────────────────63// PB-26-211: build children receive no store credentials.6465if (CHROME_ONLY) {66  runCommand("npm", ["run", "build:chrome"], {67    label: "Building Chrome target",68    env: safeEnv(),69  });70} else {71  runCommand("npm", ["run", "build"], {72    label: "Building all targets (Chrome + Firefox)",73    env: safeEnv(),74  });75}76success("Build complete");7778runCommand("npm", ["run", "test:sync:cross-client"], {79  label: "Running cross-client sync gate",80  env: safeEnv(),81});828384// ─── Chrome release ───────────────────────────────────────────────────────────85// PB-26-211: CWS credentials are read and validated here, immediately before86// upload. They are passed only to the Chrome upload child, never to build or87// CI children.8889console.log(`\n${ACCENT}${BOLD}Chrome Web Store${RESET}`);90uploadChrome(version);91success(`Chrome v${version} submitted — review typically takes minutes to hours`);9293// ─── Firefox release ──────────────────────────────────────────────────────────94// PB-26-211: AMO credentials are read and validated here, immediately before95// signing. They are passed only to the web-ext child, never to Chrome tooling96// or build children.9798if (!CHROME_ONLY) {99  console.log(`\n${ACCENT}${BOLD}Firefox Add-ons (AMO)${RESET}`);100  const sourceZip = packageSourceArchive(version);101  signFirefox(sourceZip);102  success(`Firefox v${version} submitted with source archive retained in artifacts/`);103}104105// ─── Done ─────────────────────────────────────────────────────────────────────106107console.log("");108console.log(`${ACCENT}${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}`);109console.log(`${ACCENT}${BOLD}  Peach v${version} released to ${targets}.${RESET}`);110console.log(`${ACCENT}${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}`);111console.log("");112113if (!CHROME_ONLY) {114  console.log(`  Chrome:  under review — existing users update automatically`);115  console.log(`  Firefox: under review — existing users update automatically`);116} else {117  console.log(`  Chrome: under review — existing users update automatically`);118}119120console.log("");121console.log(`${DIM}Check status:${RESET}`);122console.log(`  Chrome:  https://chrome.google.com/webstore/devconsole`);123if (!CHROME_ONLY) {124  console.log(`  Firefox: https://addons.mozilla.org/developers/`);125}126console.log("");