# Automate Chrome Web Store Releases Safely

Chrome extension publishing requires careful OAuth setup, secret storage, version checks, and status tracking. This skill provides a guided workflow for configuring and verifying those release steps.

## Install

```bash
npx skillstore add brianlovin/chrome-webstore-release-blueprint
```

## Metadata

- Status: approved
- Slug: brianlovin-chrome-webstore-release-blueprint
- Skillstore revision: r1
- Version status: missing
- Tree hash: 97e24413fbfa572ce8918626fa63720338f542cead02e5b871a56a49cfd8434c
- Author: brianlovin
- GitHub username: brianlovin
- License: MIT
- Repository: https://github.com/brianlovin/agent-config/tree/1a9819ebf3fee811150fc76cbe177ea4e5f747ff/skills/chrome-webstore-release-blueprint
- Ref: 367c7bb3962eb92a1b87fc08b2947aeda00cd51d
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/brianlovin-chrome-webstore-release-blueprint
- Manifest: https://skillstore.pages.dev/api/skills/brianlovin-chrome-webstore-release-blueprint/manifest

## Capabilities

- Guide Google Cloud API enablement and OAuth consent configuration.
- Walk through creating Chrome Web Store OAuth credentials and refresh tokens.
- Define local and CI secret names for Chrome Web Store publishing.
- Design version comparison, package upload, publish, and polling workflows.
- Specify a submission status checker with normalized release fields.

## Use Cases

- Set Up First-Time Publishing: Follow a guided checklist for enabling the API, configuring OAuth, capturing store identifiers, and preparing secrets.
- Add Version-Gated CI Releases: Design a workflow that compares versions, packages the extension, uploads changes, and avoids redundant submissions.
- Diagnose Submission Status: Plan a status checker that reports published and submitted versions, review state, and common authentication failures.

## Prompt Templates

### Beginner Setup Checklist

```
Guide me through setting up Chrome Web Store API publishing for my extension. Ask for one detail at a time, explain where each value comes from, and pause before every credential step.
```

### Prepare CI Secrets

```
Create a secret-management checklist for my GitHub Actions release workflow. Use placeholders only, identify which values belong in repository secrets, and include a dry-run verification plan.
```

### Design Version-Gated Publishing

```
Design a Chrome Web Store release workflow that reads the manifest version, compares the published version, builds the package, uploads only when needed, polls asynchronous state, and reports submission results.
```

### Audit a Release Blueprint

```
Review this proposed Chrome Web Store release process for credential exposure, excessive workflow permissions, version mismatches, unsafe secret handling, and incomplete failure reporting. Return prioritized findings and concrete fixes.
```

## Limitations

- It cannot access Google dashboards or complete OAuth actions on the user’s behalf.
- It does not create repository files unless the user requests implementation in an available repository.
- It cannot verify publisher permissions, account ownership, or API responses without user-provided results.
- It does not replace review of secret storage, workflow permissions, or packaged extension contents.

## Best Practices

- Use placeholders in documentation and store real credentials only in approved local or CI secret storage.
- Compare extension versions before packaging or publishing to prevent duplicate submissions.
- Require explicit confirmation for dashboard actions and report authentication or permission failures clearly.

## Anti Patterns

- Do not paste client secrets or refresh tokens into an agent conversation.
- Do not commit environment files, credentials, or hardcoded secrets to the repository.
- Do not publish every push without version checks, dry-run support, and permission review.

## Security Audit

- Audited at: 2026-09-09T12:38:51.647\+00:00
- Summary: The static matches are false positives because they identify Markdown examples, official documentation URLs, and a stated secret-file convention rather than executable behavior. The guide contains one confirmed high-severity credential-handling issue because it asks users to paste OAuth secrets into the agent conversation.

## Stats

- Views: 0
- Downloads: 2
- Favorites: 0
- Popularity score: 0