···5656 echo "AMO credentials not provided. Skipping signing step."
5757 exit 0
5858 fi
5959+ set +e
5960 web-ext sign \
6061 --channel=unlisted \
6162 --source-dir ./extension \
6262- --artifacts-dir ./web-ext-artifacts
6363+ --artifacts-dir ./web-ext-artifacts 2>&1 | tee ./sign.log
6464+ rc=${PIPESTATUS[0]}
6565+ set -e
6666+ if [ $rc -ne 0 ]; then
6767+ if grep -q "Version ${VERSION} already exists" ./sign.log; then
6868+ echo "AMO already has version ${VERSION}; skipping signing."
6969+ exit 0
7070+ fi
7171+ echo "Signing failed:"
7272+ cat ./sign.log
7373+ exit $rc
7474+ fi
63756476 - name: Rename signed archive (optional)
6577 if: ${{ hashFiles('web-ext-artifacts/*.xpi') != '' }}
+2-1
README.md
···888889891. Configure `AMO_JWT_ISSUER` and `AMO_JWT_SECRET` repository secrets with your AMO API credentials if you want automatic signing.
9090 Without the secrets, the workflow still produces an unsigned ZIP you can download.
9191-2. Trigger the workflow manually (`Actions` → **package-extension** → **Run workflow**) or push changes to `main`.
9191+2. Trigger the workflow manually (`Actions` → **package-extension** → **Run workflow**).
92923. Download the artifacts:
9393 - `frontpage-extension-unsigned` contains the ZIP that `web-ext build` generates.
9494 - `frontpage-extension-signed` (only when secrets are present) contains the signed `.xpi` from AMO for self-hosting.
95954. Each run also publishes a GitHub Release (tagged `v<version>-<run-id>`) that ships the same ZIP/XPI assets, so you can share a permanent download link.
9696+ - Mozilla requires every signed upload to have a unique version number. Bump `version` in `extension/manifest.json` before rerunning the workflow if you need a new signed package.
96979798These artifacts can be hosted directly for self-distribution as described in the [Mozilla documentation](https://extensionworkshop.com/documentation/publish/self-distribution/).
9899