ci: add release workflow

.forgejo/workflows/release.yml

@@ -0,0 +1,42 @@
+name: Build and Sign Extension
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build-sign-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install Mozilla web-ext CLI
+        run: npm install -g web-ext
+
+      - name: Build and Sign with Mozilla
+        id: sign_extension
+        # web-ext will automatically zip the directory, upload it to Mozilla, 
+        # wait for the cryptographic signature, and download the resulting .xpi
+        run: |
+          web-ext sign \
+            --source-dir . \
+            --channel unlisted \
+            --api-key ${{ secrets.AMO_JWT_ISSUER }} \
+            --api-secret ${{ secrets.AMO_JWT_SECRET }} \
+            --artifacts-dir ./web-ext-artifacts \
+            --ignore-files ".forgejo" ".git" "updates.json" "*.md"
+
+      - name: Upload signed XPI to Forgejo Release
+        uses: softprops/action-gh-release@v2
+        with:
+          # web-ext puts the downloaded file in the artifacts directory
+          files: ./web-ext-artifacts/*.xpi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}