Help our source code review process: add a build-for-amo script

Hi, wonderful developers,

As part of our work to make source code review faster and more reliable, AMO now automatically attempts to build extensions from submitted source code and compares the result against the package you uploaded. When the two match, your submission can move through review much more quickly.

For now, this applies only if you submit source code that includes a package.json file to build your extension. If your extension has no build step, or you use a different build system, nothing changes for you. Our builder will keep its zero-config approach.

What to do

If your extension’s source code uses a package.json file, add an npm script named build-for-amo that runs the commands needed to build your extension for Firefox:

{
  "scripts": {
    "fx-build": "some commands to build your add-on for Firefox",
    "build-for-amo": "npm run fx-build"
  }
}

If you already have a Firefox-specific build command, just point build-for-amo at it. When present, our builder will invoke this script instead of guessing how to build your extension. And while you are at it, please make sure all your dev dependencies are listed in the package.json file.

Thanks for helping us make reviews faster for everyone!

This is an amazing idea!

One question though - what’s the expected output of this script?

For example my Webpack script creates two folders:

  1. firefox_dev folder with built extension files
  2. dist folder with firefox_prod.zip file - which I’m uploading to AMO

I guess you could write a script that runs git diff and then looks for matching folder, so no need to force us to create specific folder, right?

And I’m guessing you are using LTS version of Node.js, right?

Hi. We have a few heuristics, and one of them is to look for zip files that have been generated and/or a folder (like dist/) with a manifest.json file. Also, yes, it’s running Node.js LTS.

Surprisingly, we can infer a lot of things ourselves, but that command should help build an extension for the right platform. Some developers share the same codebase and the Firefox variant is just not the default one, or we can’t infer the build script to use.

Hey William,
Hope your week is going great!

Our Extension UUID: info@streamkey.ru

We followed the recommendation, but it had no impact on the review process or its timeline.

In total, we are approaching six months of trying to pass the Mozilla team’s review process. This is having a significant impact on our project and is causing frustration among our users.

What else can we do to get our extension back on Firefox?

Best regards,
Sergei from STREAM KEY

Hi there, and thanks for reaching out.

I had the chance to see your latest submissions and the feedback the reviewers left. To have your add-on reinstated in Firefox, you will need to fully comply with our policies and address the reviewers’ feedback.

Please refer to their messages and make sure your changes address the reviewers’ feedback. If you want more details please reach out to me directly, thank you.

Hello,
Thank you for reviewing and looking into our difficult situation.

Yes, you are absolutely right: the review team informed us of the requirements that must be met for publication. We addressed all of them and submitted a new version for review on June 16. Unfortunately, a month later, we are still waiting in the review queue.

The previous review also took 3.5 months. Unfortunately, this has led to distrust among our users and suspicions that the extension was blocked because of malicious code, as they find it difficult to believe that the review process can take so long when we explain that this is the reason for our continued absence from Firefox.

Our team fully supports the goal of ensuring the safety of all users, and we are actively working to follow every recommendation. At the same time, we are concerned that we remain unable to develop our project for an important part of our user base that relies on Firefox.

We sincerely hope that the previous 3.5-month wait will not be repeated, although the current situation unfortunately appears to be heading in the same direction.

With gratitude and respect for your work.

Quick question: does adding an npm package script like this serve a purpose if one is using web-ext, and if one’s build/deploy pipeline is simply `web-ext sign` after a checkout?