chrome-store-releases

Vendor the orchestrator workflow, reusable workflows, and composite actions into the repo's .github/ directory, then write a required .github/release.config with five explicit keys: manifest_path, package_json_path, setup_command, test_command, and ship_paths. Add the four CHROME_* secrets after the first manual publication.

Patch bumps belong to the change itself: any PR touching shipped files raises the patch version in manifest.json and package.json together. For minor or major bumps, dispatch the Release to Chrome Store workflow with mode: bump and part: minor or major.

Google fetches the listing's privacy policy URL at publish time and re-checks it on every publish. Fix it in the developer dashboard's Privacy tab by setting the exact live /privacy/ permalink, save the draft, and re-run the publish.

Create a Google Cloud project, enable the Chrome Web Store API, configure and publish the OAuth consent screen, create a Web application OAuth client, then mint a refresh token in the OAuth 2.0 Playground with the chromewebstore scope. Store all four values as repository secrets.

The store requires a written justification for every permission in the Privacy-practices dashboard tab before publishing, and permission changes trigger deeper review. A new required permission with an install-time warning disables the extension for existing users until they re-approve, so prefer optional_permissions requested at runtime.