Build and publish safari browser extension by Siedlerchr · Pull Request #681 · JabRef/JabRef-Browser-Extension

Siedlerchr · 2026-06-21T18:34:58Z

Create and publish and sign + notarize safari browser extensio
Safari extensions require some native code wrapper around the extension and need to be notarized + signed
native messaging happens via a Safari WebExtension Swift Bridge
After converting the browser code to an Xcode project, replace the Swift content and make sure our stuff is correctly added
Safari requires a background.html page and does not support all manifest JSON entries
Locally tested with Safari 26.5.2 on macOS Sequoia
Native messaging requires a signed and ideally notarized version of JabRef
Native messaging works best when JabRef is started, it can start JabRef and then will try to pass the command arguments (due to sandboxing)

TODO: Setup browser extension project in Apple developer

tobiasdiez

Thanks a lot!

Looks like this PR contains a few unrelated/unnecessary or otherwise strange changes (AI generated??). Can you please revise this, or at least explain the need for the changes.

The main issue is the whole scripts/makefile setup. In the wxt world, you solve this by "modules" that hook into the build progress and modify/postprocess the output. You might be able to reuse https://github.com/rxliuli/wxt-module-safari-xcode or at least get inspiration how its done.

tobiasdiez · 2026-06-22T21:23:51Z

    },
    commands: {
-      _execute_page_action: {
+      _execute_action: {


please revert

Chrome was giving me warnings about this

safari is giving me errors with this

There is a conceptual difference between an action and a page action...

Maybe but it's not working in safari. I tested all other browsers, they work

tobiasdiez · 2026-06-22T21:24:03Z

    },
    description:
      "The JabRef browser extension imports new bibliographic information directly from the browser into JabRef.",
-    developer: {


why this change?

Not supportes

for safari maybe... did you tested the other browsers?

tobiasdiez · 2026-06-22T21:30:01Z

TODO: Deployment to Apple developer/registering of the extension

Can you do this please, and then configure the securities in the gh actions to actually be able to test the publish/notarize workflow.

Add workflow for maual safari tests

* origin/main: Add workflow for maual tests

set unique safari build number

* origin/main: set unique safari build number

Siedlerchr · 2026-06-26T20:48:44Z

Uploading to apple app store connect works now.
Manual publishing the artifact requires some addtional setup now

tobiasdiez · 2026-07-18T19:46:16Z

So you went through the code and reviewed/agreed with all those changes yourself? I don't want to invest a lot of time in reviewing AI created nonsense.

Siedlerchr · 2026-07-21T19:25:25Z

I reviewed and tested all generated code. I added some more explanations to the Swift Bridge and its purpose

Safari build/publish. The PR merges cleanly upstream; the conflicts are sibling collisions on this integration branch, resolved as unions: - release.yml, test.yml: #681 turns publish into a matrix over browser-stores/safari/safari-distribution, so the experimental artifact upload is now gated on the browser-stores target - it is the only one producing .output/*.zip. build-bridge, attach-bridge, bridge-smoke and experimental-prerelease keep their own jobs. - package.json: experimental's newer vue/vue-tsc/wxt over #681's older base, plus its esbuild, spawn-sync and wxt-module-safari-xcode. - pnpm-lock.yaml: regenerated with pnpm 10.34.1 rather than hand-merged. - README.md: both new sections kept. - safari-signing-test.yml: new in #681; git's modify/delete was rename detection, the file exists at neither the merge base nor experimental. Verified: pnpm install --frozen-lockfile and vitest (1420 passed). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AiaGjSfwh9uqDGtbW8tLfU

Conflicts were the version bumps main made to the pnpm/setup-node steps this branch replaced with the setup-browser-extension composite action: kept the composite action and moved the bumps into it, so it matches lint.yml. package.json takes main's vue, typescript, vitest and wxt and keeps this branch's esbuild, spawn-sync and wxt-module-safari-xcode; pnpm-lock.yaml regenerated. One fix beyond the conflicts, needed because main is now on wxt 0.21: wxt 0.21 resolves `modules` entries with Node's import.meta.resolve, whose importer argument is ignored, so the relative module paths resolved inside wxt itself and `wxt prepare` failed. Absolute file URLs work in both versions. Verified: pnpm install, pnpm lint, pnpm test (1420 passed), pnpm build. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DK61Z1E3cKxFbEun5UdD6

Copilot

🟡 Changes recommended

The Safari native bridge currently relies on launching /Applications/JabRef.app/... from a sandboxed app/extension, which is likely to fail under App Sandbox constraints and break native messaging in production.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR adds a Safari build pipeline for the JabRef Browser Extension, including WXT Safari/Xcode project generation, local signing/notarization helpers, and GitHub Actions workflows to package and publish the Safari app.

Changes:

Add Safari as a WXT target and generate an Xcode project/app bundle via wxt-module-safari-xcode, with post-processing hooks.
Introduce local scripts + entitlements for signing and notarization, plus documentation for Safari build/release steps.
Extend CI/release workflows to build, package, notarize, and publish the Safari extension (and upload a direct-distribution artifact).

File summaries

File	Description
`wxt.config.ts`	Adds Safari target, Safari Xcode configuration, and WXT module pipeline for Safari build/project patching.
`scripts/sign_safari_local.sh`	Adds local Developer ID signing script for the generated Safari `.app`.
`scripts/notarize_safari_local.sh`	Adds local notarization + stapling + zip packaging script for the signed Safari `.app`.
`scripts/SafariWebExtensionHandler.swift`	Adds a Swift native-message bridge handler for Safari WebExtension native messaging.
`scripts/JabRef Browser Extension.entitlements`	Adds app entitlements used during signing.
`scripts/JabRef Browser Extension Extension.entitlements`	Adds extension entitlements used during signing.
`README.md`	Documents Safari dev/build/sign/notarize flows and CI/release secret requirements.
`CONTRIBUTING.md`	Adds Safari dev/build instructions plus CI/notarization notes.
`modules/jabref-safari-prepare.module.ts`	Post-processes Safari build output (manifest cleanup + background page generation + staging).
`modules/jabref-safari-xcode.module.ts`	Copies the Swift handler into the generated Xcode project after build.
`package.json`	Adds Safari scripts (dev/build/app packaging/sign/notarize/zip) and adds Safari module dependency.
`pnpm-workspace.yaml`	Allows pnpm build scripts for `esbuild` and `spawn-sync`.
`pnpm-lock.yaml`	Locks new dependencies (notably `wxt-module-safari-xcode`, `esbuild`, `spawn-sync`).
`.github/workflows/test.yml`	Adds a macOS matrix job to validate `pnpm safari:build-app`.
`.github/workflows/release.yml`	Adds Safari packaging, signing, notarization, App Store Connect publishing, and release asset upload.
`.github/workflows/safari-signing-test.yml`	Adds a manual workflow to test Safari signing/publish without modifying releases.
`.github/actions/setup-browser-extension/action.yml`	Adds a composite action to standardize Node/pnpm setup across workflows.

Review details

Suppressed comments (1)

.github/workflows/release.yml:205

This checkout step pins actions/checkout to v6.0.3, but the workflow also uses v7.0.1 in other jobs. Prefer a single pinned SHA/version across the workflow for consistency and security updates.

        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

Files reviewed: 16/17 changed files
Comments generated: 3
Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

Siedlerchr · 2026-08-11T21:08:00Z

+        let process = Process()
+        process.executableURL = executableURL
+        process.arguments = arguments
+
+        let stdout = Pipe()
+        let stderr = Pipe()
+        process.standardOutput = stdout
+        process.standardError = stderr
+
+        do {
+            try process.run()
+        } catch {
+            throw JabRefBridgeError.processLaunchFailed(error.localizedDescription)


Apple App Store does not accept extensions without sandbox, only locally it is possible. so the extension can still use the http endpoint
@koppor Maybe we can solve this with the bridge in future ?

tobiasdiez

Sorry that it took me so long to review, but honestly speaking it's AI slop at its finest. I never understood why you guys were so annoyed by AI-created PRs in the JabRef repo, but now I better understand the pain.

My comments are perhaps formulated a bit meaner/more direct than if I were to address a person. I hope Claude can look over this.

tobiasdiez · 2026-08-05T22:04:32Z

+      - name: Build Safari app
+        if: ${{ matrix.target == 'safari' && github.event_name != 'pull_request' }}
+        run: pnpm safari:build-app
+


Can you please walk me through how this works together with the step "Download signed Safari distribution artifact" and the safari-webext-publish-action action in the next step.

We first build the *.app which is the foundation for both local distribution and app store distribution
However, they require different notarization and entitlements
And we separet notarization as its own job so it can be requeue when it fails for some reason. Can happen when apple is having issues

tobiasdiez · 2026-08-05T22:07:38Z

+
+      - name: Build Safari app
+        if: ${{ matrix.target == 'safari-build' }}
+        run: pnpm safari:build-app


Always a good idea to have 3 workflows to run the same command...

Different workflows serve different purpose

tobiasdiez · 2026-08-05T22:19:44Z

 Normally, you simply install the extension from the browser store and are ready to go.

-> [Firefox](https://addons.mozilla.org/en-US/firefox/addon/jabref/?src=external-github) - [Chrome](https://chrome.google.com/webstore/detail/jabref-browser-extension/bifehkofibaamoeaopjglfkddgkijdlh) - [Edge](https://microsoftedge.microsoft.com/addons/detail/pgkajmkfgbehiomipedjhoddkejohfna) - [Vivaldi](https://chrome.google.com/webstore/detail/jabref-browser-extension/bifehkofibaamoeaopjglfkddgkijdlh)
+> [Firefox](https://addons.mozilla.org/en-US/firefox/addon/jabref/?src=external-github) - [Chrome](https://chrome.google.com/webstore/detail/jabref-browser-extension/bifehkofibaamoeaopjglfkddgkijdlh) - [Edge](https://microsoftedge.microsoft.com/addons/detail/pgkajmkfgbehiomipedjhoddkejohfna) - [Vivaldi](https://chrome.google.com/webstore/detail/jabref-browser-extension/bifehkofibaamoeaopjglfkddgkijdlh) - Safari (build from source)


I thought you have publishing to the apple store now working?

Publishing to the apple store will require review from apple. This is an alternative way to provide the extension for download as a simple app

tobiasdiez · 2026-08-05T22:23:11Z

    },
    commands: {
-      _execute_page_action: {
+      _execute_action: {


There is a conceptual difference between an action and a page action...

tobiasdiez · 2026-08-05T22:23:47Z

    },
    description:
      "The JabRef browser extension imports new bibliographic information directly from the browser into JabRef.",
-    developer: {


for safari maybe... did you tested the other browsers?

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* origin/safari: Potential fix for pull request finding Potential fix for pull request finding

Siedlerchr · 2026-08-11T21:05:49Z

First of all, thanks for the review, but you are still talking to a human.

Sorry that the PR quality is not the best; my focus was on getting it working first. I reviewed and tested the changes and also verified with firefox/chrome.
And I used AI assistance to help me get it working because I am not an expert in JS/wxt config browser stuff. And it after trying out stuff based on your feedback, it seems the approach was not that bad.

Regarding page browser actions, seems like your knowledge regarding manifestv3 is not up to date
https://developer.chrome.com/blog/mv3-actions
Same applies for the developer key entry

* origin/main: docs: add git submodule hint (#697) chore: add .idea to .gitignore (#698) chore(deps): update dependency oxfmt to v0.61.0 (#709) chore(deps): update dependency vue-tsc to v3.3.8 (#705) chore(deps): update tailwindcss monorepo to v4.3.3 (#707) chore(deps): update dependency globals to v17.9.0 (#719) # Conflicts: # CONTRIBUTING.md # package.json # pnpm-lock.yaml

* main: fix: Chrome native messaging (#700)

Siedlerchr added 5 commits June 21, 2026 19:36

Adapt config to use

67588a4

warnigns

a131530

Add safari support

42ca35c

TODO: Setup browser extension project in Apple developer

prepare native messaging support

a9ddea7

native messaging works for safari as well

72fd466

Siedlerchr requested a review from tobiasdiez June 21, 2026 19:19

tobiasdiez requested changes Jun 22, 2026

View reviewed changes

Siedlerchr added 18 commits June 24, 2026 20:32

use oxt publisher

cf51a7b

use wxt safari

c08fdbd

run scripts

a230de8

patch project again

31bd780

reduce timeout

27f80c9

revert config changes fix build on ci

ecd9a19

remove al urls

3445e4b

fix commands

1acd263

safari needs background html, patch it into the xcode bundle

d87f557

add manual test

d7650eb

Add workflow for maual tests

ca2a184

Merge pull request #684 from JabRef/signingWorfklow

02fbfc4

Add workflow for maual safari tests

Merge remote-tracking branch 'origin/main' into safari

05a3e10

* origin/main: Add workflow for maual tests

set unique safari build number

b9e9425

set unique safari build number

251b02b

Merge pull request #685 from JabRef/pathBuildNr

a3a3dd4

set unique safari build number

Merge remote-tracking branch 'origin/main' into safari

01acfdb

* origin/main: set unique safari build number

run linter

4d9af13

tobiasdiez force-pushed the main branch from a3a3dd4 to a1d75c9 Compare June 28, 2026 22:35

Siedlerchr added 2 commits July 6, 2026 18:52

unify matrix stratgy

fadf3a8

unify matrix stratgy for test

a6b1019

remove duplicate

8826e96

improve swift bridge

29200a9

Siedlerchr added the status:ready-for-review label Jul 26, 2026

Siedlerchr and others added 2 commits August 2, 2026 20:32

Merge main into safari

b3743d0

koppor pushed a commit to JabRef/JabRef-Browser-Extension-experimental that referenced this pull request Aug 5, 2026

Merge JabRef/JabRef-Browser-Extension#681 into experimental

f8426fb

tobiasdiez requested a lite review from Copilot August 5, 2026 21:57

Copilot started reviewing on behalf of tobiasdiez August 5, 2026 21:57 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

tobiasdiez requested changes Aug 5, 2026

View reviewed changes

Siedlerchr and others added 7 commits August 11, 2026 22:28

simplify CI

8a58cda

Potential fix for pull request finding

fbf2630

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

5c0dc6d

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

clarify CI

9d86051

Merge remote-tracking branch 'origin/safari' into safari

c8260c2

* origin/safari: Potential fix for pull request finding Potential fix for pull request finding

adddress feedback

e4e1281

refactor: organize Safari build support

7caf06c

Siedlerchr added 8 commits August 11, 2026 23:12

use relative path

8c29119

restore url helper

2d8a8ac

Merge branch 'main' into safari

006804f

* main: fix: Chrome native messaging (#700)

remove merge queue

1cc4eb1

add comments, simplify

9660c05

fix: harden Safari native bridge

f490649

remove redundant Safari verification steps

c7d9aac

koppor mentioned this pull request Aug 23, 2026

Add security hardening to HTTP server for browser extension communication JabRef/jabref#15295

Closed

6 tasks

Uh oh!

Uh oh!

Conversation

Siedlerchr commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tobiasdiez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tobiasdiez commented Jun 22, 2026

Uh oh!

Siedlerchr commented Jun 26, 2026

Uh oh!

tobiasdiez commented Jul 18, 2026

Uh oh!

Siedlerchr commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

Siedlerchr Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tobiasdiez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Siedlerchr Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Siedlerchr commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Siedlerchr commented Jun 21, 2026 •

edited

Loading

Siedlerchr Aug 11, 2026 •

edited

Loading

Siedlerchr Aug 6, 2026 •

edited

Loading

Siedlerchr commented Aug 11, 2026 •

edited

Loading