pass store credentials via child env in release scripts so they are not visible in the process table (audit #5)

@@ -9,10 +9,10 @@99 1010 const ROOT = process.cwd();1111 12-function run(cmd: string, label?: string) {12+function run(cmd: string, label?: string, env?: Record<string, string>) {1313   const display = label ?? cmd;1414   console.log(`\n▶ ${display}`);15-  execSync(cmd, { stdio: "inherit", cwd: ROOT });15+  execSync(cmd, { stdio: "inherit", cwd: ROOT, env: { ...process.env, ...env } });1616 }1717 1818 function fail(msg: string): never {@@ -89,11 +89,15 @@8989     "npx web-ext sign",9090     "--source-dir dist-firefox",9191     "--artifacts-dir artifacts",92-    `--api-key=${process.env.AMO_JWT_ISSUER}`,93-    `--api-secret=${process.env.AMO_JWT_SECRET}`,9492     "--channel=listed",9593   ].join(" "),96-  "Signing and submitting to AMO"94+  "Signing and submitting to AMO",95+  // web-ext reads WEB_EXT_API_KEY/WEB_EXT_API_SECRET from env — pass via96+  // child env so the JWT credentials are not visible in the process table.97+  {98+    WEB_EXT_API_KEY: process.env.AMO_JWT_ISSUER!,99+    WEB_EXT_API_SECRET: process.env.AMO_JWT_SECRET!,100+  }97101 );98102 99103 // ── Cleanup zip ───────────────────────────────────────────────────────────────

@@ -22,9 +22,9 @@2222 const RED = "\x1b[31m";2323 const RESET = "\x1b[0m";2424 25-function run(cmd: string, label?: string) {25+function run(cmd: string, label?: string, env?: Record<string, string>) {2626   console.log(`\n${ACCENT}▶${RESET} ${label ?? cmd}`);27-  execSync(cmd, { stdio: "inherit", cwd: ROOT });27+  execSync(cmd, { stdio: "inherit", cwd: ROOT, env: { ...process.env, ...env } });2828 }2929 3030 function success(msg: string) {@@ -111,16 +111,20 @@111111 112112 run(113113   [114-    `CLIENT_ID="${CWS_CLIENT_ID}"`,115-    `CLIENT_SECRET="${CWS_CLIENT_SECRET}"`,116-    `REFRESH_TOKEN="${CWS_REFRESH_TOKEN}"`,117-    `PUBLISHER_ID="${CWS_PUBLISHER_ID}"`,118114     "npx chrome-webstore-upload-cli upload",119115     `--source "${chromeZip}"`,120116     `--extension-id "${CWS_EXTENSION_ID}"`,121117     "--auto-publish",122118   ].join(" "),123119   "Uploading and publishing to Chrome Web Store",120+  // Credentials via child env, not inline command-line assignments, so they121+  // are not visible in the process table. The CLI reads these from env.122+  {123+    CLIENT_ID: CWS_CLIENT_ID,124+    CLIENT_SECRET: CWS_CLIENT_SECRET,125+    REFRESH_TOKEN: CWS_REFRESH_TOKEN,126+    PUBLISHER_ID: CWS_PUBLISHER_ID,127+  },124128 );125129 126130 success(`Chrome v${version} submitted — review typically takes minutes to hours`);@@ -161,11 +165,15 @@161165       "npx web-ext sign",162166       "--source-dir dist-firefox",163167       "--artifacts-dir artifacts",164-      `--api-key="${AMO_JWT_ISSUER}"`,165-      `--api-secret="${AMO_JWT_SECRET}"`,166168       "--channel=listed",167169     ].join(" "),168170     "Signing and submitting to Firefox AMO",171+    // web-ext reads WEB_EXT_API_KEY/WEB_EXT_API_SECRET from env — pass via172+    // child env so the JWT credentials are not visible in the process table.173+    {174+      WEB_EXT_API_KEY: AMO_JWT_ISSUER,175+      WEB_EXT_API_SECRET: AMO_JWT_SECRET,176+    },169177   );170178 171179   rmSync(join(ROOT, sourceZip), { force: true });