用 GitHub Actions 自動發布 Chrome 與 Edge 擴充套件到商店

gh secret set EDGE_CLIENT_ID gh secret set EDGE_API_KEY

publish-edge: needs: build-and-release runs-on: ubuntu-latest env: EDGE_PRODUCT_ID: <edge-product-id> EDGE_CLIENT_ID: ${{ secrets.EDGE_CLIENT_ID }} EDGE_API_KEY: ${{ secrets.EDGE_API_KEY }} EDGE_API: https://api.addons.microsoftedge.microsoft.com VERSION: ${{ needs.build-and-release.outputs.version }} steps: - name: Check credentials id: creds run: | if [ -z "$EDGE_CLIENT_ID" ] || [ -z "$EDGE_API_KEY" ]; then echo "enabled=false" >> $GITHUB_OUTPUT else echo "enabled=true" >> $GITHUB_OUTPUT fi - uses: actions/download-artifact@v4 if: steps.creds.outputs.enabled == 'true' with: name: extension-package - name: Upload package if: steps.creds.outputs.enabled == 'true' id: upload run: | HEADERS=$(mktemp) CODE=$(curl -sS -o /dev/null -D "$HEADERS" -w '%{http_code}' \ -H "Authorization: ApiKey $EDGE_API_KEY" \ -H "X-ClientID: $EDGE_CLIENT_ID" \ -H "Content-Type: application/zip" \ -X POST --data-binary "@my-extension-${VERSION}.zip" \ "$EDGE_API/v1/products/$EDGE_PRODUCT_ID/submissions/draft/package") [ "$CODE" = "202" ] || { echo "::error::upload failed HTTP $CODE"; exit 1; } OP=$(grep -i '^Location:' "$HEADERS" | tr -d '\r' | awk '{print $2}' | sed 's#.*/##') echo "operation_id=$OP" >> $GITHUB_OUTPUT - name: Wait for package validation if: steps.creds.outputs.enabled == 'true' run: | for i in $(seq 1 30); do STATUS=$(curl -sS -H "Authorization: ApiKey $EDGE_API_KEY" -H "X-ClientID: $EDGE_CLIENT_ID" \ "$EDGE_API/v1/products/$EDGE_PRODUCT_ID/submissions/draft/package/operations/${{ steps.upload.outputs.operation_id }}" \ | jq -r '.status // empty') case "$STATUS" in Succeeded) exit 0 ;; Failed) echo "::error::package validation failed"; exit 1 ;; esac sleep 10 done exit 1 - name: Publish submission if: steps.creds.outputs.enabled == 'true' run: | curl -sS -o /dev/null -w '%{http_code}\n' \ -H "Authorization: ApiKey $EDGE_API_KEY" \ -H "X-ClientID: $EDGE_CLIENT_ID" \ -H "Content-Type: application/json" \ -X POST -d '{"notes":"Automated submission via GitHub Actions"}' \ "$EDGE_API/v1/products/$EDGE_PRODUCT_ID/submissions"

gh secret set CHROME_PUBLISHER_ID gh secret set CHROME_CLIENT_ID gh secret set CHROME_CLIENT_SECRET gh secret set CHROME_REFRESH_TOKEN

publish-chrome: needs: build-and-release runs-on: ubuntu-latest env: CHROME_EXTENSION_ID: <chrome-extension-id> CHROME_PUBLISHER_ID: ${{ secrets.CHROME_PUBLISHER_ID }} CHROME_CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }} CHROME_CLIENT_SECRET: ${{ secrets.CHROME_CLIENT_SECRET }} CHROME_REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }} CWS_API: https://chromewebstore.googleapis.com VERSION: ${{ needs.build-and-release.outputs.version }} steps: - name: Check credentials id: creds run: | if [ -z "$CHROME_CLIENT_ID" ] || [ -z "$CHROME_REFRESH_TOKEN" ] || [ -z "$CHROME_PUBLISHER_ID" ]; then echo "enabled=false" >> $GITHUB_OUTPUT else echo "enabled=true" >> $GITHUB_OUTPUT fi - uses: actions/download-artifact@v4 if: steps.creds.outputs.enabled == 'true' with: name: extension-package - name: Get access token if: steps.creds.outputs.enabled == 'true' id: token run: | TOKEN=$(curl -sS -X POST https://oauth2.googleapis.com/token \ -d client_id="$CHROME_CLIENT_ID" \ -d client_secret="$CHROME_CLIENT_SECRET" \ -d refresh_token="$CHROME_REFRESH_TOKEN" \ -d grant_type=refresh_token | jq -r '.access_token // empty') [ -n "$TOKEN" ] || { echo "::error::refresh token invalid or expired"; exit 1; } echo "::add-mask::$TOKEN" echo "token=$TOKEN" >> $GITHUB_OUTPUT - name: Upload package if: steps.creds.outputs.enabled == 'true' env: TOKEN: ${{ steps.token.outputs.token }} run: | ITEM="publishers/$CHROME_PUBLISHER_ID/items/$CHROME_EXTENSION_ID" STATE=$(curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/zip" \ -T "my-extension-${VERSION}.zip" "$CWS_API/upload/v2/$ITEM:upload" | jq -r '.uploadState // empty') for i in $(seq 1 30); do case "$STATE" in SUCCEEDED) exit 0 ;; FAILED|"") echo "::error::upload failed"; exit 1 ;; esac sleep 10 STATE=$(curl -sS -H "Authorization: Bearer $TOKEN" "$CWS_API/v2/$ITEM:fetchStatus" \ | jq -r '.lastAsyncUploadState // empty') done exit 1 - name: Publish item if: steps.creds.outputs.enabled == 'true' env: TOKEN: ${{ steps.token.outputs.token }} run: | ITEM="publishers/$CHROME_PUBLISHER_ID/items/$CHROME_EXTENSION_ID" curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \ -d '{"publishType":"DEFAULT_PUBLISH"}' "$CWS_API/v2/$ITEM:publish" | jq .