Extension CI: postulo-chromium builds twice per run, and postulo-firefox keeps its release package only as an expiring artifact #1148

New issue

Open

opened 2026-10-31 03:04:21 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-31 03:04:21 +00:00

Owner

What exists today

Read from the server's main (fetched 2026-10-30; the local checkouts are behind).

postulo-chromium ci.yml: line 35 npm run build, then line 39 npm run package, whose script in package.json (line 13) begins with npm run build again. Both targets are built twice per run. The runs take 30 s to 3 min in total, so the second build is seconds.
postulo-firefox release.yml (lines 44-48) uploads the tag's zip with actions/upload-artifact@v3; artifacts expire under the instance's retention, and nothing attaches the zip to a Forgejo release. The workflow's own header says the point is that "what is submitted is what the tag says"; after expiry that file is gone and only a rebuild remains.
No extension workflow caches ~/.npm. npm ci installs web-ext (and jsdom in chromium); measured run lengths (20 s to 1 min for firefox) leave little to win.

Corrections to the candidate: web-ext is ^10.8.0 in all three package.json files now (the ^8 was in the stale local checkout; SEC2-051/052 moved it). Firefox's CI building and linting again is not a duplicate of chromium's: it builds from the chromium commit pinned in source.json and checks the pin (npm run check:pin), which chromium's run cannot do. Not filed elsewhere: searches in postulo-chromium and postulo-firefox for release, artifact, cache and CI find only closed security issues and postulo-firefox#1 (reproducible builds, closed).

What would change

postulo-chromium: drop the separate "Build both targets" step and lint after npm run package, or make package not rebuild when dist/ is current. Trivial.
postulo-firefox: in release.yml, after packaging, create a release for the tag and attach the zip (the Forgejo API POST /repos/{owner}/{repo}/releases and /releases/{id}/assets with curl, since setup actions from GitHub may not resolve here), with permissions: contents: write on that workflow only. postulo-thunderbird would follow when it gets a release workflow.
An npm cache is not worth a step: leave it out.

What it saves or protects

small: a few seconds per chromium run; for Firefox, the package submitted to addons.mozilla.org kept for good instead of until the artifact expires

Accessibility

none

Decided by the maintainer (2026-10-31)

Firefox package published as a Forgejo release asset

Decisions

Publish the Firefox package as a release asset? Recommended: yes, it is the file a store reviewer may ask about later.
Split? Recommended: one core issue naming postulo-chromium and postulo-firefox, two small items.

Found by the efficiency and reliability audit of 2026-10-30 (finding PC8; index postulo/postulo#1108). Checked against main at daee30b15 (2026-10-30).

## What exists today Read from the server's `main` (fetched 2026-10-30; the local checkouts are behind). - postulo-chromium `ci.yml`: line 35 `npm run build`, then line 39 `npm run package`, whose script in `package.json` (line 13) begins with `npm run build` again. Both targets are built twice per run. The runs take 30 s to 3 min in total, so the second build is seconds. - postulo-firefox `release.yml` (lines 44-48) uploads the tag's zip with `actions/upload-artifact@v3`; artifacts expire under the instance's retention, and nothing attaches the zip to a Forgejo release. The workflow's own header says the point is that "what is submitted is what the tag says"; after expiry that file is gone and only a rebuild remains. - No extension workflow caches `~/.npm`. `npm ci` installs web-ext (and jsdom in chromium); measured run lengths (20 s to 1 min for firefox) leave little to win. Corrections to the candidate: web-ext is `^10.8.0` in all three `package.json` files now (the `^8` was in the stale local checkout; SEC2-051/052 moved it). Firefox's CI building and linting again is not a duplicate of chromium's: it builds from the chromium commit pinned in `source.json` and checks the pin (`npm run check:pin`), which chromium's run cannot do. Not filed elsewhere: searches in postulo-chromium and postulo-firefox for release, artifact, cache and CI find only closed security issues and postulo-firefox#1 (reproducible builds, closed). ## What would change - postulo-chromium: drop the separate "Build both targets" step and lint after `npm run package`, or make `package` not rebuild when `dist/` is current. Trivial. - postulo-firefox: in `release.yml`, after packaging, create a release for the tag and attach the zip (the Forgejo API `POST /repos/{owner}/{repo}/releases` and `/releases/{id}/assets` with `curl`, since setup actions from GitHub may not resolve here), with `permissions: contents: write` on that workflow only. postulo-thunderbird would follow when it gets a release workflow. - An npm cache is not worth a step: leave it out. ## What it saves or protects small: a few seconds per chromium run; for Firefox, the package submitted to addons.mozilla.org kept for good instead of until the artifact expires ## Accessibility none ## Decided by the maintainer (2026-10-31) Firefox package published as a Forgejo release asset ## Decisions - **Publish the Firefox package as a release asset?** Recommended: yes, it is the file a store reviewer may ask about later. - **Split?** Recommended: one core issue naming postulo-chromium and postulo-firefox, two small items. --- Found by the efficiency and reliability audit of 2026-10-30 (finding PC8; index postulo/postulo#1108). Checked against `main` at `daee30b15` (2026-10-30).

tiagoagueda added this to the 1.0.0 milestone

2026-10-31 03:04:21 +00:00

tiagoagueda added the

performance

enhancement

labels

2026-10-31 03:04:21 +00:00

tiagoagueda referenced this issue

2026-10-31 03:04:41 +00:00

Efficiency and reliability audit of 2026-10-30: index #1108