feat(v1.4.0): exports + smart year level + progress + encrypted passwords

v1.4.0: CSV/Excel/JSON/NextUp exports, units-first smart year standing, live export progress bar, AES-GCM at-rest password encryption.

.gitea/workflows/build.yml

@@ -1,10 +1,9 @@
 name: build-extension
 
+# Build + release only on version tags. Daily dev/test runs live in ci.yml.
 on:
   push:
-    branches: [feat/ismis-helper, prod]
     tags: ['v*']
-  pull_request:
 
 # Ensure the job token can create releases and upload assets.
 permissions:
@@ -26,27 +25,37 @@ jobs:
       - name: Install dev dependencies
         run: npm ci || npm install
 
-      - name: Install PyMuPDF (PDF text assertions)
+      - name: Install PyMuPDF + openpyxl (PDF text + XLSX validation)
         run: |
           python3 -m venv /tmp/venv
-          /tmp/venv/bin/pip install --quiet pymupdf
+          /tmp/venv/bin/pip install --quiet pymupdf openpyxl
           echo "/tmp/venv/bin" >> "$GITHUB_PATH"
 
       - name: Run tests
         run: npm test
 
+      - name: Validate exports open in real readers
+        run: node scripts/validate-exports.js
+
       - name: Build both variants
         run: node scripts/build.js all
 
-      - name: Upload zip artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: ismis-helper-zips
-          path: dist/*.zip
-          if-no-files-found: error
+      - name: Sign Firefox build (xpi for permanent install)
+        # Optional: only runs when the AMO credentials exist as repo secrets.
+        # Signing requires a version AMO has not seen before — bump
+        # manifest.json before tagging (1.2.0 and 1.3.0 are already on AMO).
+        if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != ''
+        env:
+          AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }}
+          AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }}
+        run: |
+          set -euo pipefail
+          npm run sign
+          XPI=$(ls dist/*.xpi | head -1)
+          VERSION=$(node -p "require('./dist/firefox/manifest.json').version")
+          mv "$XPI" "dist/ismis-helper-${VERSION}-an+fx.xpi"
 
-      - name: Publish release on version tag
-        if: startsWith(github.ref, 'refs/tags/v')
+      - name: Publish release
         # Gitea-native release: softprops/action-gh-release targets GitHub's API
         # and fails on Gitea (405). Instead we call the Gitea API directly with
         # the runner-provided GITHUB_TOKEN and GITHUB_API_URL.
@@ -64,10 +73,11 @@ jobs:
             -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"body\":\"ISMIS Helper ${TAG}\"}" \
             "${API}/repos/${REPO}/releases")
           RELEASE_ID=$(echo "${RELEASE_JSON}" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
-          # Attach both zips as release assets
-          for f in dist/*.zip; do
+          # Attach zips and the signed xpi (if present) as release assets
+          for f in dist/*.zip dist/*.xpi; do
+            [ -f "$f" ] || continue
             curl -sS -X POST \
               -H "Authorization: token ${GITHUB_TOKEN}" \
               -F "attachment=@${f}" \
               "${API}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=$(basename "${f}")"
-          done
+          done