feat(ci): #28 — CWS publish step (arms once secrets land)

[ivndev001]

What

Enables the Chrome Web Store publish step in release.yml, guarded by a repo variable CWS_PUBLISH_ENABLED so a tag build only publishes once the operator arms it. Draft — do not merge until the human preconditions below are done.

Why

#28 (Web Store submission + secret-guarded publish in CI). The workflow half is fully automatable and is here; the store-account half is human-only (a Google account owns the item; an interactive OAuth consent mints the refresh token).

Human preconditions (Ivan)

1. Create the store item in the Chrome Web Store dashboard (the account owner you named) — paste from store/listing-copy.md, upload store/icons/icon-128.png, the 5 store/screenshots/*.png, store/promo/promo-440x280.png (marquee optional), pick Developer Tools, paste the permission justifications. First submission is manual; the upload API can only UPDATE an existing item.
2. Mint the OAuth pieces for the upload API (Google Cloud console → Chrome Web Store API enabled → OAuth client; consent flow → refresh token).
3. Set repo secrets (Settings → Secrets and variables → Actions → Secrets): CWS_EXTENSION_ID (the item's id from the dashboard), CWS_CLIENT_ID, CWS_CLIENT_SECRET, CWS_REFRESH_TOKEN.
4. Set the repo variable CWS_PUBLISH_ENABLED=true (same settings page, Variables tab).
5. Merge this PR. The next v* tag build then uploads + auto-publishes after the GitHub Release.

Verification

• YAML parses; the step is inert until the variable is set (if: vars.CWS_PUBLISH_ENABLED == 'true' — variables and secrets are independent, so an accidental secret-alone can't publish).
• actionlint runs on this PR.

Refs #28

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 267bdeb1-6498-417f-88cf-aca5712ca4a5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

💥 Parsing errors (1)

Validation error: Too big: expected string to have <=250 characters at "tone_instructions"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/28-cws-publish

---

_{Comment @coderabbitai help to get the list of available commands.}

[sebyx07]

Superseded by #193 (merged): the CWS publish step is now live in release.yml behind the same CWS_* secrets, together with the dry-run/rollback docs (STORE-SETUP.md §5–6), the paste-ready listing (docs/store/LISTING.md), and the rendered 1280×800 screenshots + promo tile (docs/store/assets/). Closing to keep #28's trail in one place — thank you for the groundwork, the secret-guard shape came from here.

🤖 Generated with Claude Code