Skip to content

RELEASE_CHECKLIST.md

Latest commit

 

History

History
118 lines (95 loc) · 6.07 KB

RELEASE_CHECKLIST.md

File metadata and controls

118 lines (95 loc) · 6.07 KB
Raw

Release Checklist

Versioning

FavGrove follows Semantic Versioning while the product is below 1.0.0.

Current version: 0.3.0 (multi-provider AI beta candidate). The published 0.1.0 Markora beta must not be rewritten or retagged.

Release stages:

  • 0.1.0: historical Markora public beta
  • 0.2.x: FavGrove rebrand and beta stabilization
  • 0.3.x: opt-in multi-provider AI analysis
  • 0.9.x: release candidates after performance, manual browser, privacy, and store checks pass
  • 1.0.0: first stable Chrome and Edge store release

Rules:

  • Increment PATCH for compatible bug fixes; MINOR for new features or meaningful workflow changes.
  • Keep package.json, manifest.json, the UI footer, and release package filename synchronized.
  • Use Git tags in the form v<version>; mark GitHub releases as pre-release until 1.0.0.
  • Do not publish 1.0.0 while required items below remain incomplete.

Quality Gates

  • npm install
  • npm run lint
  • npm run typecheck
  • npm run test
  • npm run audit:dependencies reports zero production vulnerabilities.
  • npm run benchmark:performance
  • npm run test:e2e
  • npm run build
  • npm run validate:extension
  • npm run audit:permissions
  • npm run check:browsers
  • npm run check:browser-data-safety
  • npm run capture:store-screenshots
  • npm run package:release
  • Release packaging creates a SHA-256 checksum file beside the ZIP.
  • Release ZIP generation is deterministic for identical production content.
  • Generated ZIP entries are verified against dist/chrome-mv3/ before the checksum is written.
  • Windows GitHub Actions quality workflow is configured for the release gates.
  • The quality workflow passes on the pushed 0.3.0 beta commit; local verification must pass before pushing.

Localization

  • English and Chinese locale key sets match.
  • Production React markup rejects static English JSX copy through an AST regression test.
  • Recent Activity and error messages follow locale keys.
  • Recent Activity generated in the current session follows live language changes.
  • English primary route smoke checks pass.
  • Chinese primary route smoke checks pass.
  • Local English and Chinese desktop/390px visual QA has no page-level horizontal overflow.
  • Final human visual copy review is complete in both languages.

Manifest Review

  • Manifest version is 3.
  • package.json and manifest.json versions match.
  • Build and package gates enforce matching x.y.z versions in package metadata, source Manifest, and built Manifest.
  • No popup page is configured.
  • Options page opens in a full browser tab.
  • Required permissions have a documented user-facing purpose.
  • tabs permission was removed after source audit confirmed no chrome.tabs usage.
  • npm run audit:permissions verifies manifest and privacy-copy alignment.
  • <all_urls> remains optional and is requested only for broken-link scanning or an explicitly confirmed user-selected AI endpoint.
  • Store update notifications use the browser-managed update lifecycle without new permissions or remote version polling.

Privacy And Security

  • PRIVACY.md matches current behavior.
  • No analytics, telemetry, remote tracking, developer-operated AI proxy, or automatic cloud upload was introduced.
  • Vite development and preview servers bind to loopback and restrict CORS origins.
  • Imported files and URLs are validated.
  • Destructive operations create backups where currently implemented.
  • No bookmark data is sent to a developer-controlled FavGrove server; optional AI requests go directly to the user-selected endpoint after preview and confirmation.

Manual Extension Checks

  • Isolated installed Chrome and Edge profiles load dist/chrome-mv3/ through the supported DevTools extension API with the MV3 service worker, all primary routes, AI disabled, and no pre-confirmation external requests.
  • Visible Chrome and Edge click-through checklist is prepared in docs/release/browser-clickthrough.md.
  • Load dist/chrome-mv3/ as an unpacked extension without manifest warnings in visible Chrome and Edge.
  • Clicking the extension action opens the full-screen options page.
  • Dashboard, Scanner, Manager, Import / Export, AI Analysis, and Settings routes open.
  • Broken-link permission is requested only after starting a scan.
  • AI endpoint permission is requested only after opt-in, local preview, and explicit confirmation.
  • AI domain-only mode sends no bookmark titles, paths, tags, URL queries, or URL fragments.
  • Isolated Chrome automation verifies real rename, move, delete, bookmark/empty-folder undo with new IDs, tag migration, nested import, and reload consistency.
  • Visible Chrome/Edge checks confirm folder merge, export, backup, and missing-bookmark restore flows without deleting current bookmarks.
  • Light, dark, English, and Chinese settings persist after restart.

Store Submission

  • Store description is current.
  • Store portal submission field worksheet is prepared in store/submission-fields.md.
  • Prepare and publish 0.3.0 GitHub pre-release metadata from docs/release/github-prerelease-v0.3.0.md.
  • Privacy policy URL is publicly accessible.
  • 1280x800 or 640x400 screenshots are prepared.
  • 440x280 promotional tile is prepared if required.
  • 128x128 store icon is prepared.
  • Support URL and contact information are current.
  • Release ZIP contains only production extension files.
  • Release ZIP includes the repository GPL license text.
  • Repository license file is present and matches the README.
  • Release is marked as beta or pre-release while the version is below 1.0.0.

Release Artifacts

The packaging command creates artifacts beside the unpacked build:

dist/chrome-mv3/                    # load unpacked
dist/favgrove-v<version>-chrome.zip
dist/favgrove-v<version>-chrome.sha256

Upload the generated ZIP to the Chrome Web Store or Microsoft Edge Add-ons portal. Attach both files to the matching GitHub pre-release.