linusu / wext-shipit

Automate the process of shipping Web Extensions for Chrome, Firefox, Safari, Opera and Edge

Web Extensions - Shipit

Automate the process of shipping Web Extensions for Chrome, Firefox, Safari, Opera and Edge.

PRs welcome 🚀

Installation

npm install --save @wext/shipit

Usage

# Publish the "distribution/chrome-prod" folder to the Chrome WebStore
shipit chrome distribution/chrome-prod

# Publish the "distribution/firefox-prod" folder to Mozilla Addons (AMO)
shipit firefox distribution/firefox-prod

# Publish the "distribution/opera-prod" folder to Opera Extensions
shipit opera distribution/opera-prod

Implemented browsers

Feature	Chrome	Firefox	Safari	Opera	Edge
shipit	✅	✅	❌	✅	❌

Credentials

The neccessary credentials for submitting are read from the environment and, if the file exists, a .env file containing key value pairs. Required keys are documented for each browser below.

We recommend placing the values in a .env file, and adding .env to your gitignore so that you don't accidentaly check these values into git.

Chrome

• WEXT_SHIPIT_CHROME_EXTENSION_ID - The id of the extension (can be seen in the url to the Chrome WebStore page)
• WEXT_SHIPIT_CHROME_CLIENT_ID - See clientId below
• WEXT_SHIPIT_CHROME_CLIENT_SECRET - See clientSecret below
• WEXT_SHIPIT_CHROME_REFRESH_TOKEN - See refreshToken below

Follow this guide to generate clientId, clientSecret and refreshToken.

Firefox

• WEXT_SHIPIT_FIREFOX_JWT_ISSUER - See "JWT issuer" below
• WEXT_SHIPIT_FIREFOX_JWT_SECRET - See "JWT secret" below

Go to this site and generate API Credentials. It will output "JWT issuer" and "JWT secret".

Make sure that your extension id is specified in your manifest, like shown here.

Opera

• WEXT_SHIPIT_OPERA_EMAIL - Email address used to log in to addons.opera.com
• WEXT_SHIPIT_OPERA_EXTENSION_ID - ID of the extension (can be seen in the url in the developer dashboard)
• WEXT_SHIPIT_OPERA_PASSWORD - Password used to log in to addons.opera.com

wext-shipit's Issues

Prototype Pollution introduced due to vulnerable minimist version

npm audit reports the following:

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @wext/shipit [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @wext/shipit > web-ext > chrome-launcher > mkdirp > minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @wext/shipit [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @wext/shipit > web-ext > mkdirp > minimist                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 2 low severity vulnerabilities in 13241 scanned packages
  2 vulnerabilities require manual review. See the full report for details.

This is caused by depending on an old version of web-ext. Unfortunately, a newer web-ext version is not yet released (but fixed in their master).

Where does it put artifacts?

I'm using this in conjunction with semantic-release and I'd like to upload the firefox xpi/chrome zip file to the corresponding GitHub release at the end of the build, but it's not clear to me where those files end up.

Need clarification - Regarding publishing update to listed AMO addon

Hi,
Need clarification - if an addon is already listed on AMO, does it publish a version update in AMO?
Thanks.

Uploading to Opera returns no errors but doesn't seem to do anything?

When trying shipit opera dist it doesn't throw an error, but I also don't see my extension in the store.

I do get these warnings however

- Packing extension...
(node:1808) Warning: Accessing non-existent property 'cat' of module exports inside circular dependency
(Use `node --trace-warnings ...` to show where the warning was created)
(node:1808) Warning: Accessing non-existent property 'cd' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'chmod' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'cp' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'dirs' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'pushd' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'popd' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'echo' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'tempdir' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'pwd' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'exec' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'ls' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'find' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'grep' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'head' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'ln' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'mkdir' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'rm' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'mv' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'sed' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'set' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'sort' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'tail' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'test' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'to' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'toEnd' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'touch' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'uniq' of module exports inside circular dependency
(node:1808) Warning: Accessing non-existent property 'which' of module exports inside circular dependency

Add ability to get package from web store

Over at my project release instructions I have a manual process to get my packages from firefox and chrome web stores.

It'd be really nice to have it here also.

Is this dead ?

I'd like to use this, is it still working ?
Do you plan to add remaining browsers ?

Opera script fails with node not found error

Hi, Opera script has started to fail recently with node not found error. I think Opera addons page changed their template. I will try to look into this over the weekend.
Edit: I should have posted it in your upload-opera-extension repo, couldnt find it from mobile so posted this into this repo.

Add Edge as build target

Now that Edge is Chromium-based, it should be fairly easy to use as a build target. Just requires minor modifications to the manifests (to remove Chrome references), as noted by a Preact core team member on Twitter.

Submit failed for all browsers

EDIT: Chrome now works

Chrome failed with: ``` Response code 400 (Bad Request) { "error": "invalid_request", "error_description": "Parameter not allowed for this message type: redirect_uri" } Error: Command failed: D:\Projects\ConstructAddonInstaller\Installer\node_modules\@wext\shipit\node_modules\.bin\webstore upload --source BrowserExtension --extension-id xxx --client-id xxx --client-secret xxx --refresh-token xxx --auto-publish ```

Firefox failed with:

× Error: Failed to submit extension to addons.mozilla.org

(all other steps are successfull)

Opera failed with:

× Error: waiting failed: timeout 30000ms exceeded

Requesting option to directly use provided ext.zip to AMO

Requesting option to directly use provided ext.zip to AMO
Currently, the folder is built with web-ext and published. If provided with a .zip of extension, will be useful if it can simply upload to AMO.

Accept multiple browsers at once

For example:

$ shipit chrome,firefox directory

When trying to upload to firefox shipit raises a TypeError

× TypeError: StreamSearch is not a constructor
TypeError: StreamSearch is not a constructor

It actually still successfully deploys. Btw I love the idea of this module so much!

Firefox publishing new extension instead of new version

Am I missing a value somewhere? What value does shipit use to uniquely identify AMO extensions? Instead of uploading a new version of my extension, shipit is creating a completely new extension.

Make some browsers optional?

I don't know if this is possible, but it would be cool if I could not install the dependencies for opera, which includes the very heavy puppeteer, if I'm not going to be deploying there.