Harden GitHub Actions manual store submission with secret-free preflight

PeterDaveHello · PeterDaveHello · commit a87ab633753e · 2026-07-06T01:44:54.000+08:00
Manual dispatches should validate release artifacts without invoking
publish-browser-extension's authenticated dry-run path.

Run workflow_dispatch as a read-only GitHub Actions preflight job with
no persisted checkout credentials. Keep real store submission on tag
pushes only. Cover artifact, manifest shape, process environment, and
credential boundaries with targeted tests.
diff --git a/.github/workflows/tagged-release.yml b/.github/workflows/tagged-release.yml
@@ -3,123 +3,115 @@ on:
   workflow_dispatch:
     inputs:
       submit_stores:
-        description: "Run Chrome, Firefox, and Edge store submission preflight"
+        description: 'Run store submission artifact preflight without store credentials'
         required: false
-        default: "false"
+        default: 'false'
         type: choice
         options:
-          - "false"
-          - "true"
-      dry_run:
-        description: "Validate store submission without uploading artifacts"
-        required: false
-        default: "true"
-        type: choice
-        options:
-          - "true"
-          - "false"
+          - 'false'
+          - 'true'
   push:
     tags:
-      - "v*"
-
-permissions:
-  id-token: "write"
-  contents: "write"
-env:
-  GH_TOKEN: ${{ github.token }}
+      - 'v*'
 
 jobs:
-  build_and_release:
+  manual_preflight:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: macos-14
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.ref_name }}
+          persist-credentials: false
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+      - run: npm ci
+
+      - run: npm run build
+
+      - run: npm run release:firefox-sources
+
+      - name: Submit stores preflight
+        if: inputs.submit_stores == 'true'
+        run: npm run release:submit:preflight
+
+  release:
+    if: github.event_name == 'push'
     runs-on: macos-14
+    permissions:
+      contents: write
 
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.event_name == 'push' && 'master' || github.ref_name }}
+          ref: master
+          persist-credentials: true
 
       - uses: actions/setup-node@v6
         with:
           node-version: 22
       - run: npm ci
 
       - name: Resolve release version
-        run: |
-          if [ "${{ github.event_name }}" = "push" ]; then
-            echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV
-          else
-            version="$(node -p "require('./src/manifest.json').version")"
-            echo "VERSION=${version}" >> $GITHUB_ENV
-          fi
+        run: printf 'VERSION=%s\n' "${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
 
       - name: Update manifest.json version
-        if: github.event_name == 'push'
         uses: jossef/action-set-json-field@v2.2
         with:
           file: src/manifest.json
           field: version
           value: ${{ env.VERSION }}
 
       - name: Update manifest.v2.json version
-        if: github.event_name == 'push'
         uses: jossef/action-set-json-field@v2.2
         with:
           file: src/manifest.v2.json
           field: version
           value: ${{ env.VERSION }}
 
       - name: Push files
-        if: github.event_name == 'push'
         continue-on-error: true
         run: |
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
-          git commit -am "release v${{ env.VERSION }}"
+          git commit -am "release v${VERSION}"
           git push
 
-      - if: github.event_name == 'push'
-        run: |
-          gh release create ${{github.ref_name}} -d -F CURRENT_CHANGE.md -t ${{github.ref_name}}
+      - run: |
+          gh release create "$RELEASE_TAG" -d -F CURRENT_CHANGE.md -t "$RELEASE_TAG"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
 
       - uses: actions/setup-python@v6
-        if: github.event_name == 'push'
         with:
           python-version: '3.10' # for appdmg
       - uses: maxim-lobanov/setup-xcode@v1
-        if: github.event_name == 'push'
         with:
           xcode-version: 16.2
-      - if: github.event_name == 'push'
-        run: sed -i '' "s/0.0.0/${{ env.VERSION }}/g" safari/project.pre.patch
-      - if: github.event_name == 'push'
-        run: sed -i '' "s/0.0.0/${{ env.VERSION }}/g" safari/project.patch
-      - if: github.event_name == 'push'
-        run: npm run build:safari
-
-      - if: github.event_name != 'push'
-        run: npm run build
+      - run: sed -i '' "s/0.0.0/${VERSION}/g" safari/project.pre.patch
+      - run: sed -i '' "s/0.0.0/${VERSION}/g" safari/project.patch
+      - run: npm run build:safari
 
       - run: npm run release:firefox-sources
 
-      - if: github.event_name == 'push'
-        run: |
-          gh release upload ${{github.ref_name}} build/chromium.zip
-          gh release upload ${{github.ref_name}} build/firefox.zip
-          gh release upload ${{github.ref_name}} build/safari.dmg
-          gh release upload ${{github.ref_name}} build/chromium-without-katex-and-tiktoken.zip
-          gh release upload ${{github.ref_name}} build/firefox-without-katex-and-tiktoken.zip
+      - run: |
+          gh release upload "$RELEASE_TAG" build/chromium.zip
+          gh release upload "$RELEASE_TAG" build/firefox.zip
+          gh release upload "$RELEASE_TAG" build/safari.dmg
+          gh release upload "$RELEASE_TAG" build/chromium-without-katex-and-tiktoken.zip
+          gh release upload "$RELEASE_TAG" build/firefox-without-katex-and-tiktoken.zip
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
 
       - name: Submit stores
-        if: github.event_name == 'push' || inputs.submit_stores == 'true'
-        run: |
-          args=()
-          if [ "${{ github.event_name }}" != "push" ]; then
-            if [ "${{ inputs.dry_run }}" != "true" ]; then
-              echo "::error::Manual store submission only supports dry_run=true. Push a v* tag for a real submission."
-              exit 1
-            fi
-            args+=(--dry-run)
-          fi
-          npm run release:submit -- "${args[@]}"
+        run: npm run release:submit
         env:
           CHROME_EXTENSION_ID: ${{ secrets.CHROME_EXTENSION_ID }}
           CHROME_CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }}
@@ -137,6 +129,8 @@ jobs:
           EDGE_CLIENT_ID: ${{ secrets.EDGE_CLIENT_ID }}
           EDGE_API_KEY: ${{ secrets.EDGE_API_KEY }}
 
-      - if: github.event_name == 'push'
-        run: |
-          gh release edit ${{github.ref_name}} --draft=false
+      - run: |
+          gh release edit "$RELEASE_TAG" --draft=false
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
diff --git a/package.json b/package.json
@@ -20,6 +20,7 @@
     "release:firefox-sources": "node scripts/create-firefox-sources-zip.mjs",
     "release:submit": "node scripts/submit-stores.mjs",
     "release:submit:dry-run": "node scripts/submit-stores.mjs --dry-run",
+    "release:submit:preflight": "node scripts/submit-stores.mjs --preflight-only",
     "release:update-firefox-metadata": "node scripts/update-firefox-metadata.mjs",
     "release:check-edge-api-key": "node scripts/check-edge-api-key-expiry.mjs"
   },
diff --git a/scripts/submit-stores.mjs b/scripts/submit-stores.mjs
@@ -36,6 +36,7 @@ const REQUIRED_ENV = [
 export function parseArgs(args) {
   return {
     dryRun: args.includes('--dry-run'),
+    preflightOnly: args.includes('--preflight-only'),
   }
 }
 
@@ -160,14 +161,18 @@ function resolvePublishExtensionBin() {
   return path.join(process.cwd(), 'node_modules', '.bin', command)
 }
 
-async function runPublishExtension(args) {
+function buildPublishExtensionEnv(env = process.env) {
+  return { ...process.env, ...env }
+}
+
+export async function runPublishExtension(args, { env = process.env, spawnImpl = spawn } = {}) {
   const command = resolvePublishExtensionBin()
 
   await new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
+    const child = spawnImpl(command, args, {
       stdio: 'inherit',
       shell: false,
-      env: process.env,
+      env: buildPublishExtensionEnv(env),
     })
 
     child.once('error', reject)
@@ -181,34 +186,61 @@ async function runPublishExtension(args) {
   })
 }
 
-export async function submitStores({ argv = process.argv.slice(2), env = process.env } = {}) {
-  const { dryRun } = parseArgs(argv)
-  const missingArtifacts = await findMissingArtifacts()
-  const missingEnv = findMissingEnv(env)
+export async function submitStores({
+  argv = process.argv.slice(2),
+  env = process.env,
+  exists = fs.pathExists,
+  readJson = fs.readJson,
+  runPublishExtensionImpl = runPublishExtension,
+  updateFirefoxVersionNotesImpl = updateFirefoxVersionNotes,
+  logger = console.log,
+  errorLogger = console.error,
+} = {}) {
+  const { dryRun, preflightOnly } = parseArgs(argv)
+  const missingArtifacts = await findMissingArtifacts({ exists })
+  const missingEnv = preflightOnly ? [] : findMissingEnv(env)
 
   if (missingArtifacts.length > 0 || missingEnv.length > 0) {
     if (missingArtifacts.length > 0) {
-      console.error(`Missing release artifacts: ${missingArtifacts.join(', ')}`)
+      errorLogger(`Missing release artifacts: ${missingArtifacts.join(', ')}`)
     }
     if (missingEnv.length > 0) {
-      console.error(`Missing store submission environment variables: ${missingEnv.join(', ')}`)
+      errorLogger(`Missing store submission environment variables: ${missingEnv.join(', ')}`)
     }
     throw new Error('Store submission preflight failed')
   }
 
-  const manifest = await fs.readJson('build/firefox/manifest.json')
-  const args = buildPublishExtensionArgs({ dryRun })
+  let manifest
+  try {
+    manifest = await readJson('build/firefox/manifest.json')
+  } catch (error) {
+    errorLogger('Missing or invalid Firefox manifest: build/firefox/manifest.json')
+    throw new Error('Store submission preflight failed', { cause: error })
+  }
+
+  if (!manifest || typeof manifest.version !== 'string' || manifest.version.trim().length === 0) {
+    errorLogger('Missing Firefox manifest version: build/firefox/manifest.json')
+    throw new Error('Store submission preflight failed')
+  }
+
   const firefoxReleaseNotes = buildFirefoxReleaseNotes(manifest.version)
+  const mode = preflightOnly ? 'preflight' : dryRun ? 'dry-run' : 'submit'
 
-  console.log(`Submitting ChatGPTBox ${manifest.version} to Chrome, Firefox, and Edge`)
-  console.log(`Mode: ${dryRun ? 'dry-run' : 'submit'}`)
-  console.log(`Artifacts: ${REQUIRED_ARTIFACTS.join(', ')}`)
-  console.log(`Firefox version notes: ${firefoxReleaseNotes}`)
+  logger(`${preflightOnly ? 'Checking' : 'Submitting'} ChatGPTBox ${manifest.version}`)
+  logger(`Mode: ${mode}`)
+  logger(`Artifacts: ${REQUIRED_ARTIFACTS.join(', ')}`)
+  logger(`Firefox version notes: ${firefoxReleaseNotes}`)
 
-  await runPublishExtension(args)
+  if (preflightOnly) {
+    logger('Store authentication, upload, and submission are skipped in preflight mode')
+    return
+  }
+
+  const args = buildPublishExtensionArgs({ dryRun })
+  await runPublishExtensionImpl(args, { env })
 
   if (!dryRun) {
-    await updateFirefoxVersionNotes({
+    await updateFirefoxVersionNotesImpl({
       extensionId: env.FIREFOX_EXTENSION_ID,
       version: manifest.version,
       jwtIssuer: env.FIREFOX_JWT_ISSUER,
diff --git a/tests/unit/release/submit-stores.test.mjs b/tests/unit/release/submit-stores.test.mjs
