[afrojun]

Summary

 docs/development.md
   ## Build and test
+  ## Go back to the release app        # separate rules files, remove dev extension first, Identify profiles
   ## Submit a change
   ...
   ## Publish a release                  # app
+  ## Publish the extension
+  ### Set up publishing                 # API, WIF provider + tag condition, shared service account, env tag rule, variables
+  ### Release the extension             # bump, merge, tag; manual upload fallback
 extension/AGENTS.md
-  provider "must allow" extension-v refs
+  provider condition AND environment tag rule both enforce extension-v only; link to the steps

Evidence

• Before: the extension's release section named the four variables but not how to create them. It said only extension-v tags may publish, but nothing enforced that.
• After: the provider condition is assertion.repository=='afrojun/profilebar' && assertion.ref.startsWith('refs/tags/extension-v'), and the chrome-web-store environment only accepts extension-v* tags. Re-running extension-v1.2.0 with both in place passed Google sign-in. The store then rejected the duplicate upload with HTTP 400, as expected, and nothing was submitted.
• The pre-push review (gpt-6.1-sol) found that the steps didn't say to enable the Chrome Web Store API. That step is now added. Links resolve and git diff --check is clean.

Merge Danger

Door: two-way

Blast Radius: none (docs only)

🤖 Generated with Claude Code