Docs

CI and releases ​

This runs unattended; unattended operation is the paid plan. Connect a repository once and the loop holds without you: builds run when you push, releases ship while you sleep.

Where builds run ​

Every project gets a mirror repository in the platform's org. All CI minutes burn there, never in your repository. Your repository stays the source; the platform reads it and writes back only the footprint below.

The trigger chain ​

The extensiondev GitHub App on the source repository sends push and pull_request webhooks. The platform debounces for 75 seconds and resolves each webhook to one of three decisions: dispatch, debounce, or drop-duplicate. A dispatch checks quota, then starts the build workflow on the mirror.

Build concurrency is per ref with cancel-in-progress. A new push cancels the older build instead of billing both.

What you configure ​

You never edit workflow YAML. The console holds the whole build configuration:

  • Install command, build command, and output directory, per browser
  • Environment variables, per environment
  • Channels
  • Store credentials

Change any of these in project settings and the next dispatch chooses them up.

Auth inside the run ​

The runner trades a GitHub Actions OIDC assertion for a 1-hour platform token with audience extension-dev-registry, via POST /api/oidc/exchange. The exchange degrades open: public registry paths keep working without it. No long-lived token is stored anywhere in CI. See Access tokens.

What appears in your repository ​

The full write footprint, and nothing else:

  • GitHub Deployments, one per browser, each with an environment URL to the public build page
  • Check runs, one per preview
  • One pull request comment, upserted in place, with a build results table
  • Version-bump release PRs from the cut flow

A release PR can arrive armed: merging it promotes automatically the moment the build goes green.

When it fails ​

  • A build starts up to 75 seconds after the push. That is the debounce window, not a hang.
  • Two pushes in a row produce one billed build. The older run on the same ref is cancelled by design.
  • A push with no build at all means the decision was drop-duplicate or the quota check refused the dispatch. Check usage in the console.
  • Private registry reads failing in CI mean the OIDC exchange did not run. Public paths still work; the 1-hour token gates only the private ones.

Next ​