Proposal: use GitHub OIDC for Chrome Web Store publishing

[hamzahamidi]

Hi Voyager maintainers,

I noticed .github/workflows/release.yml publishes Chrome with chrome-webstore-upload and long-lived CHROME_CLIENT_ID, CHROME_CLIENT_SECRET, and CHROME_REFRESH_TOKEN secrets. The republish-chrome workflow uses the same credential path.

Would it be useful to migrate the Chrome upload paths to GitHub OIDC and Google Workload Identity Federation, so the workflows use short-lived access tokens instead of a stored refresh token? The normal release currently creates a store-only voyager-chrome-cws-<tag>.zip with manifest.key removed, while the GitHub Release asset keeps that key. That packaging behavior would be preserved. Firefox, Edge, and Safari publishing would stay as it is.

I maintain Publish to Chrome Web Store, a GitHub Action for Chrome Web Store API v2 publishing with a short-lived token. I would propose it for an isolated Chrome publish job, but can adapt to another publisher if you prefer.

If this sounds useful, a possible scope is:

• Give id-token: write only to the isolated Chrome publish job.
• Use the publisher for tag releases and publish_only retries, with trust limited to the intended refs and a protected chrome-web-store environment.
• Document Workload Identity Federation setup and remove the old OAuth secrets after migration.
• Preserve the current store-only key stripping and GitHub Release zip.

One detail to settle is that the manual retry runs from main, while normal releases run from tags. The Workload Identity trust condition would need to allow only the intended protected refs and environment. I am happy to discuss a narrower first step if that is preferable.

I have not changed code. The contribution guide asks for maintainer approval before implementing a new workflow feature, so I will wait for your direction before preparing a PR.

[Nagi-ovo]

Thanks for the proposal! We're fine with the current setup for now and would prefer not to add a third-party publish action. Will revisit if we decide to move to OIDC.

[hamzahamidi]

Sure NP. I’ll leave the WIF setup documentation here in case you revisit OIDC in the future. Happy to help if you do.