Export submit-addon via package.json

[kewisch]

Fixes #3241

[kewisch]

Test failure is blocking sec issues, I didn't add any deps so I don't think I can fix this.

Note that locally the test I added runs as "pending", both with and without my changes. Might be something up with that one?

[Rob--W]

The npm audit issues are pre-existing. I think that @rpl or @willdurand was going to address that.

[rpl]

The npm audit issues are pre-existing. I think that @rpl or @willdurand was going to address that.

yes, I was the one that was meant to followup on that.

The transitive dependency that was making us hitting the npm audit failure is part of sinon dependencies and despite the fact that the previous PR that was updating sinon to 18.0.1 was still failing (which was what I was going to take a look into), the new PR for sinon 19.0.0 (#3251) did actually pass the npm audit CI job step and so I proceeded with merging it.

@kewisch would you mind to rebase this PR to confirm that the CI job failure is gone as expected?

[kewisch]

Looks like we're good :)

[rpl]

We discussed about this in the triage meeting and we agreed to move forward with merging this PR but also update the README.md file to clarify what Note: There is limited support for this API. means (in particular that there is no guarantees about backward compatibility in new web-ext versions).

[kewisch]

I added a note to the readme, does that look good?

[rpl]

I added a note to the readme, does that look good?

In comment #3250 (comment) I was referring to expanding/rewording the existing **Note:** There is limited support for this API that we have at the start of the section here:

web-ext/README.md

Line 126 in cde10a8

**Note:** There is limited support for this API.

Nonetheless, I think the note you added may also be worth keeping (because the sign command entrypoint is more likely to stay stable then the internal signAddon module).

In the meantime, I'm going to approving and merging this version, we can followup to tweak that other note in a separate PR.

[rpl]

@kewisch I've added one more review comment related to a just small nit/thought that I wanted to mention you explicitly before proceeding with merging this PR.

[rpl]

@kewisch I think it may be worth to tweak this example to suggest using a userAgentString that makes it clear which web-ext version they are using and maybe include a custom part to highlight this was sent by using signAddon internal method programmatically