CI: check what npm receives, keep the tree stable, stop the VPS1 deploy

- pr-any: after each step the tree must be unchanged (yarn lint runs
  eslint --fix, yarn build rewrites packageInfo.ts), and after build
  scripts/check-built-manifests.py checks the package.json of each
  package in scripts/published-packages.txt: entry points exist, no
  ./build/ or ./cjs/cjs/ paths, no workspace: ranges.
- push-main bumped the patch version on every push, pushed that commit
  to main as a bot, and copied the zips as root to 37.60.230.9, a host
  that has been retired; js.pezkuwichain.io no longer serves them and
  the extension is distributed through the stores. It now builds,
  checks the manifests and keeps the Chrome and Firefox packages as
  artifacts of the commit. The version is set in the release PR.
- The auto-approve and auto-merge bots are removed.
- ff-diff/, the output of yarn diff, is ignored by git and eslint.

.github/workflows/auto-approve.yml

@@ -1,16 +0,0 @@
-name: bot
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  approve:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jacogr/action-approve@795afd1dd096a2071d7ec98740661af4e853b7da
-        with:
-          authors: jacogr, TarikGul
-          labels: -auto
-          token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/auto-merge.yml

@@ -1,16 +0,0 @@
-name: bot
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  merge:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jacogr/action-merge@d2d64b4545acd93b0a9575177d3d215ae3f92029
-        with:
-          checks: pr (build),pr (lint),pr (test)
-          labels: -auto
-          strategy: squash
-          token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/pr-any.yml

@@ -21,3 +21,14 @@ jobs:
         corepack enable
         yarn install --immutable
         yarn ${{ matrix.step }}
+    # `yarn lint` runs eslint --fix and `yarn build` rewrites packageInfo.ts and
+    # the i18n catalogue, so both pass on a tree they changed. The committed
+    # tree must already be what they produce.
+    - name: tree unchanged
+      run: git diff --exit-code --stat
+    # The package.json each published package's build/ holds is what npm
+    # receives: entry points must exist, no ./build/ or ./cjs/cjs/ paths, no
+    # workspace: ranges (extension-base 0.62.19 went out with workspace:*).
+    - name: check built manifests
+      if: matrix.step == 'build'
+      run: python3 scripts/check-built-manifests.py . $(cat scripts/published-packages.txt)

.github/workflows/push-main.yml

@@ -5,97 +5,45 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
-  build-and-deploy:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]')"
+  # Builds the store packages from what was merged. Publishing to the Chrome
+  # Web Store and Firefox Add-ons is a manual release step: the version in
+  # package.json and both manifests is set in the release PR, not here.
+  build:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-        token: ${{ secrets.GITHUB_TOKEN }}
 
     - uses: actions/setup-node@v4
       with:
         node-version: 'lts/*'
 
-    - name: Bump Version
-      id: version
-      run: |
-        # Get current version from manifest
-        CURRENT_VERSION=$(grep -oP '"version":\s*"\K[^"]+' packages/extension/manifest_chrome.json | head -1)
-        echo "Current version: $CURRENT_VERSION"
-
-        # Parse version parts
-        MAJOR=$(echo $CURRENT_VERSION | cut -d. -f1)
-        MINOR=$(echo $CURRENT_VERSION | cut -d. -f2)
-        PATCH=$(echo $CURRENT_VERSION | cut -d. -f3)
-
-        # Increment patch version
-        NEW_PATCH=$((PATCH + 1))
-        NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
-        echo "New version: $NEW_VERSION"
-
-        # Update manifest files
-        sed -i "s/\"version\": \"$CURRENT_VERSION\"/\"version\": \"$NEW_VERSION\"/" packages/extension/manifest_chrome.json
-        sed -i "s/\"version\": \"$CURRENT_VERSION\"/\"version\": \"$NEW_VERSION\"/" packages/extension/manifest_firefox.json
-
-        echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-
-    - name: Commit Version Bump
-      run: |
-        git config --local user.email "action@github.com"
-        git config --local user.name "GitHub Action"
-        git add packages/extension/manifest_chrome.json packages/extension/manifest_firefox.json
-        git diff --staged --quiet || git commit -m "[CI Skip] Bump version to ${{ steps.version.outputs.version }}"
-        git push || echo "Nothing to push"
-
-    - name: Build Chrome
+    - name: Build
       run: |
         corepack enable
         yarn install --immutable
-        yarn build:chrome
+        yarn build
 
-    - name: Build Firefox
-      run: |
-        yarn build:ff
+    - name: Check built manifests
+      run: python3 scripts/check-built-manifests.py . $(cat scripts/published-packages.txt)
 
-    - name: Upload Chrome Build
+    - name: Upload Chrome package
       uses: actions/upload-artifact@v4
       with:
-        name: chrome-build
-        path: master-chrome-build.zip
-        if-no-files-found: ignore
+        name: chrome-${{ github.sha }}
+        path: |
+          master-chrome-build.zip
+          master-chrome-src.zip
+        if-no-files-found: error
 
-    - name: Upload Firefox Build
+    - name: Upload Firefox package
       uses: actions/upload-artifact@v4
       with:
-        name: firefox-build
-        path: master-ff-build.zip
-        if-no-files-found: ignore
-
-    - name: Setup SSH
-      run: |
-        mkdir -p ~/.ssh
-        echo "${{ secrets.VPS1_SSH_KEY }}" > ~/.ssh/id_rsa
-        chmod 600 ~/.ssh/id_rsa
-        ssh-keyscan -H 37.60.230.9 >> ~/.ssh/known_hosts
-
-    - name: Deploy to VPS1
-      run: |
-        # Upload zip files
-        scp master-chrome-build.zip master-ff-build.zip root@37.60.230.9:/var/www/subdomains/js/download/
-
-        # Rename and extract on server
-        ssh root@37.60.230.9 << 'EOF'
-          cd /var/www/subdomains/js/download
-          mv master-chrome-build.zip pezkuwi-extension-chrome.zip
-          mv master-ff-build.zip pezkuwi-extension-firefox.zip
-
-          cd /var/www/subdomains/js
-          rm -rf extension/*
-          unzip -o download/pezkuwi-extension-chrome.zip -d extension/
-
-          echo "Deployed version:"
-          grep '"version"' extension/manifest.json
-        EOF
+        name: firefox-${{ github.sha }}
+        path: |
+          master-ff-build.zip
+          master-ff-src.zip
+        if-no-files-found: error