Build and publish safari browser extension by Siedlerchr · Pull Request #681 · JabRef/JabRef-Browser-Extension

Siedlerchr · 2026-06-21T18:34:58Z

Create and publish and sign + notarize safari browser extensio
Safari extensions require some native code wrapper around the extension and need to be notarized + signed
native messaging happens via a Safari WebExtension Swift Bridge
After converting the browser code to an Xcode project, replace the Swift content and make sure our stuff is correctly added
Safari requires a background.html page and does not support all manifest JSON entries
Locally tested with Safari 26.5.2 on macOS Sequoia
Native messaging requires a signed and ideally notarized version of JabRef
Native messaging works best when JabRef is started, it can start JabRef and then will try to pass the command arguments (due to sandboxing)
Consolidated CI pipelines

TODO: Setup browser extension project in Apple developer

tobiasdiez

Thanks a lot!

Looks like this PR contains a few unrelated/unnecessary or otherwise strange changes (AI generated??). Can you please revise this, or at least explain the need for the changes.

The main issue is the whole scripts/makefile setup. In the wxt world, you solve this by "modules" that hook into the build progress and modify/postprocess the output. You might be able to reuse https://github.com/rxliuli/wxt-module-safari-xcode or at least get inspiration how its done.

tobiasdiez · 2026-06-22T21:30:01Z

TODO: Deployment to Apple developer/registering of the extension

Can you do this please, and then configure the securities in the gh actions to actually be able to test the publish/notarize workflow.

Add workflow for maual safari tests

* origin/main: Add workflow for maual tests

set unique safari build number

* origin/main: set unique safari build number

Siedlerchr · 2026-06-26T20:48:44Z

Uploading to apple app store connect works now.
Manual publishing the artifact requires some addtional setup now

# Conflicts: # .github/workflows/test.yml # README.md # pnpm-lock.yaml

* origin/main: fix: limit Chrome-only permissions to non-Firefox browsers (#696) # Conflicts: # wxt.config.ts

Siedlerchr · 2026-08-28T19:20:27Z

@tobiasdiez I streamlined the code, refactored it, reviewed and tested the changes again, and verified the keys against manifest v3 once more. All these changes to the keys here are done deliberately to follow v3.
I merged the PR from Ryan and then adapted the pattern here as well where it made sense for all browsers.

This PR now also enables distribution and notarization of the app outside the app store without having to wait for Apple review. On Mac, installing a browser extension is basically a separate app you install.

Would be great to have this in and then a new release across all browser

tobiasdiez · 2026-08-31T11:04:47Z

Can you please paste the links to for the test runs for the CI workflows? Thanks!

Siedlerchr · 2026-08-31T17:09:03Z

@tobiasdiez Packaging.: https://github.com/JabRef/JabRef-Browser-Extension/actions/runs/33417738312/job/99572341682?pr=681 Building the extension and the app

Manual notarizing workflow which upload it to app store connect
https://github.com/JabRef/JabRef-Browser-Extension/actions/runs/33417304774

# Conflicts: # wxt.config.ts

tobiasdiez · 2026-08-31T20:03:19Z

Thanks, but I still don't get how these jobs are supposed to work / what purpose they have. It looks like:

https://github.com/JabRef/JabRef-Browser-Extension/actions/runs/33417304774/job/99570942700 is all we need to do (it build the extension & uploads it to the store)
- but pnpm build:safari actually runs xcodebuild, and safari-webext-publish-action is doing the same again for some reason
and then we have a bunch of other CI runs that seem to do the same but just slightly different ?!

Why can't we just have a simple matrix in the release workflow (with browser = [firefox, safari]) that runs pnpm zip (or zip:firefox) and then uses wxt submit or safari-webext-publish-action to publish?

Siedlerchr · 2026-08-31T20:26:35Z

I tried to unify it a bit more:
Xcode project generation is show shared, but then the distribution differs:

Safari App Store: Xcode build -> Xcode archive/sign/package with certs for App Store → App Store Connect -> (notarization or whatever security checks happen in appstore)
Safari extension direct download: Xcode build → Developer ID signing → notarization → GitHub Release ZIP

Different distribution requires different certs and entitlements (sandboxing etc)

safari-signing-test.yml (just a simple manual/smoke test for uploading testing )

tobiasdiez · 2026-09-02T07:05:54Z

Do I talk again to Claude?

Safari extension direct download: Xcode build → Developer ID signing → notarization → GitHub Release ZIP

Why do we need this? So far we don't publish any build artifacts in the GH release, and nobody asked for it. Also why not simply use the build mode of safari-webext-publish-action?

Siedlerchr · 2026-09-02T20:16:18Z

As I wrote earlier, these are two different things. And no, we cannot reuse the build mode of the safari-wxt-extension because it's explicit only for the app store (different entitlements, signing stuff, certs, etc.) .

Direct distribution is for downloading the app-file outside the app store (JabRef itself is also not available in the app store). It's explicit for users who don't want to use the Apple App Store or cannot use the App Store due to restrictions.
And for an easy way of testing changes. Also, Apple App Store reviews can take several days and are very strict.

Only because the other extensions are not published doesn't mean we cannot publish it as a release artifact. Does no harm, but rather improves the user experience for users who want to try out the extension with safari
run: gh release upload "${{ needs.release-pr.outputs.tag_name }}" dist/safari/jabref-browser-extension-safari.zip --clobber

* origin/main: chore(deps): update dependency oxlint to v1.80.0 (#730) chore(deps): update dependency oxfmt to v0.65.0 (#729) chore(deps): update dependency node to v24.20.0 (#728) chore(deps): update dependency globals to v17.11.0 (#727) chore(deps): lock file maintenance (#722) chore(deps): update dependency wxt to v0.21.4 (#726) chore(deps): update dependency vue-tsc to v3.3.11 (#725) chore(deps): update dependency vue to v3.5.42 (#724) chore(deps): update dependency vitest to v4.1.11 (#723) # Conflicts: # .github/workflows/release.yml # .github/workflows/test.yml # package.json # pnpm-lock.yaml

* origin/main: chore(deps): update pnpm/action-setup action to v6.1.0 (#734) chore(deps): update dependency oxlint to v1.81.0 (#733) chore(deps): update dependency oxfmt to v0.66.0 (#732) chore(deps): update dependency globals to v17.12.0 (#731) chore(deps): update pnpm to v11 (#676) Co-authored-by: Junie <junie@jetbrains.com> # Conflicts: # .github/workflows/release.yml # .github/workflows/test.yml # pnpm-lock.yaml

ryan-carpenter · 2026-09-06T15:12:25Z

Why do we need this? So far we don't publish any build artifacts in the GH release, and nobody asked for it.

Ideally, browser extensions would be included or offered during JabRef installation for a smooth user experience. JabRef is distributed outside the app store so it seems reasonable to offer the extension the same way (like 1Password, for example, I believe). Distribution outside the app store would allow installation without an Apple ID, which is how I use macOS. I don't suppose this is a common use case.
If the Safari extension is like the Chrome/Firefox one, then building from source involves a few steps and is not very convenient.

# Conflicts: # .github/workflows/release.yml

Siedlerchr added 5 commits June 21, 2026 19:36

Adapt config to use

67588a4

warnigns

a131530

Add safari support

42ca35c

TODO: Setup browser extension project in Apple developer

prepare native messaging support

a9ddea7

native messaging works for safari as well

72fd466

Siedlerchr requested a review from tobiasdiez June 21, 2026 19:19

tobiasdiez requested changes Jun 22, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

Comment thread .github/workflows/test.yml Outdated

Comment thread src/entrypoints/options/index.html Outdated

Comment thread wxt.config.ts Outdated

Comment thread wxt.config.ts

Comment thread wxt.config.ts Outdated

Siedlerchr added 18 commits June 24, 2026 20:32

use oxt publisher

cf51a7b

use wxt safari

c08fdbd

run scripts

a230de8

patch project again

31bd780

reduce timeout

27f80c9

revert config changes fix build on ci

ecd9a19

remove al urls

3445e4b

fix commands

1acd263

safari needs background html, patch it into the xcode bundle

d87f557

add manual test

d7650eb

Add workflow for maual tests

ca2a184

Merge pull request #684 from JabRef/signingWorfklow

02fbfc4

Add workflow for maual safari tests

Merge remote-tracking branch 'origin/main' into safari

05a3e10

* origin/main: Add workflow for maual tests

set unique safari build number

b9e9425

set unique safari build number

251b02b

Merge pull request #685 from JabRef/pathBuildNr

a3a3dd4

set unique safari build number

Merge remote-tracking branch 'origin/main' into safari

01acfdb

* origin/main: set unique safari build number

run linter

4d9af13

tobiasdiez force-pushed the main branch from a3a3dd4 to a1d75c9 Compare June 28, 2026 22:35

Siedlerchr added 2 commits July 6, 2026 18:52

unify matrix stratgy

fadf3a8

unify matrix stratgy for test

a6b1019

Siedlerchr added 4 commits August 12, 2026 22:28

remove merge queue

1cc4eb1

add comments, simplify

9660c05

fix: harden Safari native bridge

f490649

remove redundant Safari verification steps

c7d9aac

koppor mentioned this pull request Aug 23, 2026

Add security hardening to HTTP server for browser extension communication JabRef/jabref#15295

Closed

6 tasks

koppor added a commit to JabRef/JabRef-Browser-Extension-experimental that referenced this pull request Aug 28, 2026

Merge JabRef/JabRef-Browser-Extension#681 into experimental

b099aee

# Conflicts: # .github/workflows/test.yml # README.md # pnpm-lock.yaml

Siedlerchr added 3 commits August 28, 2026 21:02

Merge remote-tracking branch 'origin/main' into safari

4011e97

* origin/main: fix: limit Chrome-only permissions to non-Firefox browsers (#696) # Conflicts: # wxt.config.ts

add required header modificaiton

c1c6541

streamline contribution

4621078

Siedlerchr added 3 commits August 31, 2026 18:37

readd developer for firefox

9322bf7

rename test job name

f95e5eb

target mac 15

54c2273

koppor added a commit to JabRef/JabRef-Browser-Extension-experimental that referenced this pull request Aug 31, 2026

Merge JabRef/JabRef-Browser-Extension#681 into experimental

93d8560

# Conflicts: # wxt.config.ts

unify workflows a bit

0ced62a

koppor pushed a commit to JabRef/JabRef-Browser-Extension-experimental that referenced this pull request Sep 1, 2026

Merge JabRef/JabRef-Browser-Extension#681 into experimental

c04de12

koppor pushed a commit to JabRef/JabRef-Browser-Extension-experimental that referenced this pull request Sep 3, 2026

Merge JabRef/JabRef-Browser-Extension#681 into experimental

371f0a3

Siedlerchr added 4 commits September 5, 2026 14:03

fix merge

0a7c524

fix workflow not running

2b16793

add action

1a5c65e

koppor added a commit to JabRef/JabRef-Browser-Extension-experimental that referenced this pull request Sep 13, 2026

Merge JabRef/JabRef-Browser-Extension#681 into experimental

99044cb

# Conflicts: # .github/workflows/release.yml

Uh oh!

Conversation

Siedlerchr commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tobiasdiez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tobiasdiez commented Jun 22, 2026

Uh oh!

Siedlerchr commented Jun 26, 2026

Uh oh!

Siedlerchr commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tobiasdiez commented Aug 31, 2026

Uh oh!

Siedlerchr commented Aug 31, 2026

Uh oh!

tobiasdiez commented Aug 31, 2026

Uh oh!

Siedlerchr commented Aug 31, 2026

Uh oh!

tobiasdiez commented Sep 2, 2026

Uh oh!

Siedlerchr commented Sep 2, 2026

Uh oh!

ryan-carpenter commented Sep 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Siedlerchr commented Jun 21, 2026 •

edited

Loading

Siedlerchr commented Aug 28, 2026 •

edited

Loading