ci: security lint, tests, reproducible-build + size/permissions guards (V2-690, V2-691)#9
Merged
Conversation
…s (V2-690, V2-691) Harden CI ahead of the i18n change so any surfaced issues stay decoupled from that review. Existing CI ran typecheck + build:all + web-ext lint (Firefox); this adds: - ESLint (security-focused, no style overhaul): eslint-plugin-no-unsanitized plus a hard ban on innerHTML/outerHTML/insertAdjacentHTML/eval. The extension injects a content script on <all_urls> and follows a "textContent, never innerHTML" convention by discipline — this enforces it. src/ passes clean. - npm test in CI — version.test.ts (min-version / pre-release gating) existed but was never run by CI. 13 tests. - Reproducible-build check — two clean builds must be byte-identical, backing BUILD.md's byte-for-byte AMO reproduction promise. - Bundle-size budget (scripts/check-bundle-size.mjs) — guards content.js, which is injected on every page, against size regressions. - PR-only permissions guard (scripts/check-permissions.mjs) — annotates the PR when manifest permissions/host_permissions change (they trigger store re-review + user re-consent). Non-failing. Branched off main so it can merge independently of / ahead of the i18n PR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Node 20's test runner treated 'src/**/*.test.ts' as a literal path (glob support landed in Node 21+) and can't execute TypeScript, so 'npm test' failed with 'Could not find ...'. Node 20 is also deprecated on GitHub runners. Bump both jobs to 24 (matches local, where npm test is 13/13 green). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Nic-dorman
added a commit
that referenced
this pull request
Jul 21, 2026
…source (V2-688) (#10) On a `v*` tag push (or manual workflow_dispatch), build from a clean checkout and produce the distributable artifacts, then attach them to the GitHub Release: - ant-webex-chrome-vX.Y.Z.zip — CWS upload package (manifest at zip root). - ant-webex-firefox-vX.Y.Z.xpi — signed, unlisted via `web-ext sign` when the AMO API secrets (WEB_EXT_API_KEY/SECRET) are set; installable by testers. Falls back to an unsigned .zip (with a warning) when creds are absent, so the rest of the release still succeeds. - ant-webex-source-vX.Y.Z.zip — `git archive` source tree for AMO's source-code submission requirement. Guards: version must agree across tag / manifest.json / package.json; web-ext lint runs before signing so a broken build doesn't burn an AMO version number. Runs in a `release` GitHub Environment so signing can be gated behind a required reviewer and secrets aren't exposed to fork-PR runs. RELEASING.md documents the tag flow + one-time AMO credential setup. Branched off main; independent of the i18n (#8) and CI-hardening (#9) PRs. Co-authored-by: Nic <nic@nics-mbp.home> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens CI for the wider
ant-webexrepo. Deliberately branched offmain, not the i18n branch (#8) — so if turning on lint/tests surfaces anything, it stays decoupled from that review and can merge first.Existing CI already ran typecheck +
build:all+web-ext lint(Firefox). This adds:Security lint (V2-690)
ESLint with a security-only ruleset (no
any/style churn):eslint-plugin-no-unsanitized(property+method) plus a hardno-restricted-syntaxban oninnerHTML/outerHTML/insertAdjacentHTML, andno-eval/no-implied-eval. The extension injects a content script on<all_urls>and has a prior XSS fix in its history; it follows a "build DOM viatextContent/createElement, neverinnerHTML" convention by discipline — this makes it a gate.src/passes clean today; a plantedel.innerHTML = location.hashis correctly rejected.CI hardening (V2-691)
npm testin CI —version.test.ts(min-version / pre-release gating) existed but CI never ran it. 13 tests.BUILD.md's byte-for-byte AMO reproduction promise.scripts/check-bundle-size.mjs) — guardscontent.js(injected on every page) against regressions. Budgets carry headroom (content 48 KB vs ~15 KB today / ~24 KB after i18n).scripts/check-permissions.mjs) — annotates the PR when manifestpermissions/host_permissionschange (they trigger store re-review + user re-consent). Non-failing.Verified locally
lint·typecheck·test(13 pass) ·build:all·web-ext lintFirefox (0 errors) ·size(all within budget) · reproducible-build (byte-identical) · permissions guard (no changes on this branch) — all green.Follow-up for #8
Once this merges, the i18n PR should rebase to pick up the new
ci.yml, and its own i18n integrity gate (locale key-parity / placeholder validation) can be added there since it depends on the locale files. Noted separately.🤖 Generated with Claude Code