From 705667b532dde9c343497e15f9e785d93d41bced Mon Sep 17 00:00:00 2001
From: Josh Patra <joshpatra12@gmail.com>
Date: Tue, 31 Mar 2026 14:48:37 -0400
Subject: [PATCH] Fix beta signing: use AMO unlisted channel instead of
 unsigned build

Unsigned XPIs are blocked by Firefox. Beta releases must be signed via
AMO --channel unlisted to allow manual installation.
---
 .github/workflows/deploy.yml | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3dc7374..9bbc7cf 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -20,22 +20,28 @@ jobs:
       - name: Lint
         run: web-ext lint
 
-      # Build & release steps only run on tags (not dev branch CI pushes)
-      - name: Build XPI
-        if: startsWith(github.ref, 'refs/tags/')
-        run: web-ext build --overwrite-dest
+      # Beta tag (v*-beta) → Sign as unlisted on AMO, attach signed XPI to GitHub Prerelease
+      # Firefox blocks all unsigned XPIs, even for self-hosted installs — unlisted signing is required
+      - name: Sign XPI via AMO (unlisted, beta)
+        if: contains(github.ref_name, '-beta')
+        run: |
+          web-ext sign \
+            --api-key ${{ secrets.FIREFOX_API_KEY }} \
+            --api-secret ${{ secrets.FIREFOX_API_SECRET }} \
+            --source-dir . \
+            --artifacts-dir web-ext-artifacts \
+            --channel unlisted
 
-      - name: Rename XPI
-        if: startsWith(github.ref, 'refs/tags/')
+      - name: Get signed XPI path (beta)
+        if: contains(github.ref_name, '-beta')
         id: xpi
         run: |
-          FILE=$(ls web-ext-artifacts/*.zip | head -n 1)
+          FILE=$(ls web-ext-artifacts/*.xpi | head -n 1)
           XPI="web-ext-artifacts/speeder-${{ github.ref_name }}.xpi"
           mv "$FILE" "$XPI"
           echo "file=$XPI" >> $GITHUB_OUTPUT
 
-      # Beta tag (v*-beta) → GitHub Prerelease with XPI for self-hosting
-      - name: Create GitHub Release (beta)
+      - name: Create GitHub Prerelease (beta)
         if: contains(github.ref_name, '-beta')
         uses: softprops/action-gh-release@v2
         with:
@@ -44,7 +50,7 @@ jobs:
           files: ${{ steps.xpi.outputs.file }}
           prerelease: true
           body: |
-            Beta build — manual installation only.
+            Beta build — signed for self-hosted manual installation.
 
             ### Installation Instructions
             1. Download the `.xpi` file