gh-14651: Change event listeners to not be inlined (gh-14700)

.github/workflows/build.yml

@@ -500,10 +500,24 @@ jobs:
           path: updates-server
           token: ${{ secrets.DEPLOY_KEY }}
 
-      - name: Download object files
+      - name: Download signed windows objects
         if: ${{ inputs.update_branch == 'release' }}
+        env:
+          GH_TOKEN: ${{ secrets.DEPLOY_KEY }}
         run: |
-          git clone https://github.com/zen-browser/windows-binaries.git .github/workflows/object --depth 1
+          mkdir -p .github/workflows/object
+          gh release download "windows-signed-${{ github.run_id }}" \
+            --repo zen-browser/windows-binaries \
+            --pattern 'windows-x64-signed-*.tar.gz' \
+            --dir .github/workflows/object
+
+          for arch in x86_64 arm64; do
+            archive=".github/workflows/object/windows-x64-signed-$arch.tar.gz"
+            dest=".github/workflows/object/windows-x64-signed-$arch"
+            echo "Expanding $archive"
+            mkdir -p "$dest"
+            tar -xvf "$archive" -C "$dest"
+          done
 
       - name: Sign MAR files
         env:
@@ -616,6 +630,17 @@ jobs:
             ./.github/workflows/object/windows-x64-signed-arm64/zen.installer-arm64.exe
             ./zen.macos-universal.dmg/*
 
+      - name: Clean up signed windows staging release
+        if: ${{ inputs.update_branch == 'release' }}
+        env:
+          GH_TOKEN: ${{ secrets.DEPLOY_KEY }}
+        run: |
+          # The per-run staging prerelease on windows-binaries has served its purpose
+          # now that the signed bundles are published in the real release. Never fail
+          # the release over this cleanup.
+          gh release delete "windows-signed-${{ github.run_id }}" \
+            --repo zen-browser/windows-binaries --cleanup-tag --yes || true
+
   prepare-flatpak:
     if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
     permissions: write-all

.github/workflows/windows-profile-build.yml

@@ -61,7 +61,6 @@ jobs:
         if: ${{ matrix.arch == 'x86_64' }}
         run: |
           cd C:\artifact
-          ls
           Expand-Archive -Path .\${{ inputs.profile-data-path-archive }} -DestinationPath C:\artifact
           ls
 

.github/workflows/windows-release-build.yml

@@ -261,7 +261,7 @@ jobs:
           export ZEN_RELEASE=1
           npm run package
           ls ./dist
-          mv ./dist/*.zip zen.win64.zip
+          mv ./dist/zen-$(npm run --silent surfer -- get version | xargs).en-US.win64${{ matrix.arch == 'aarch64' && '-aarch64' || '' }}.zip zen.win64.zip
           ls .
 
       - name: Move package for PGO upload

.rust-toolchain

@@ -1 +1 @@
-1.90
+1.94.1

build/windows/sign.ps1

@@ -170,14 +170,16 @@ function SignAndPackage($name) {
     echo "Packaging $name"
     npm run package -- --verbose
 
-    # In the release script, we do the following:
+    # We assemble the signed bundle as a plain folder here (with no top-level
+    # directory inside it) and compress it into windows-x64-signed-$name.tar.gz
+    # at the end of the script, once every .exe has been signed. The release
+    # workflow expands it back with:
     #  tar -xvf .github/workflows/object/windows-x64-signed-x86_64.tar.gz -C windows-x64-signed-x86_64
-    # We need to create a tar with the same structure and no top-level directory
-    # Inside, we need:
+    # Inside the bundle we need:
     #  - update_manifest/*
     #  - windows.mar
     #  - zen.installer.exe
-    echo "Creating tar for $name"
+    echo "Preparing signed bundle for $name"
     rm .\windsign-temp\windows-x64-signed-$name -Recurse -ErrorAction SilentlyContinue
     mkdir windsign-temp\windows-x64-signed-$name
 
@@ -200,9 +202,8 @@ function SignAndPackage($name) {
     # Move the manifest
     mv .\dist\update\. windsign-temp\windows-x64-signed-$name\update_manifest
 
-    # note: We need to sign it into a parent folder, called windows-x64-signed-$name
-    rmdir .\windsign-temp\windows-binaries\windows-x64-signed-$name -Recurse -ErrorAction SilentlyContinue
-    mv windsign-temp\windows-x64-signed-$name .\windsign-temp\windows-binaries -Force
+    # The signed bundle stays in windsign-temp\windows-x64-signed-$name; it is
+    # compressed and uploaded to the staging release once every .exe is signed.
     rmdir engine\obj-$objName-pc-windows-msvc\ -Recurse -ErrorAction SilentlyContinue
 
     echo "Finished $name"
@@ -211,16 +212,42 @@ function SignAndPackage($name) {
 SignAndPackage arm64
 SignAndPackage x86_64
 
-$files = Get-ChildItem .\windsign-temp\windows-binaries -Recurse -Include *.exe
+$files = Get-ChildItem .\windsign-temp\windows-x64-signed-x86_64, .\windsign-temp\windows-x64-signed-arm64 -Recurse -Include *.exe
 signtool.exe sign /n "$SignIdentity" /t http://time.certum.pl/ /fd sha256 /v $files
 
-echo "All artifacts signed and packaged, ready for release!"
-echo "Commiting the changes to the repository"
-cd windsign-temp\windows-binaries
-git add .
-git commit -m "Sign and package windows artifacts"
-git push
-cd ..\..
+# Compress each signed bundle into a single gzip tarball (`-C <dir> .` so it has
+# no top-level directory) and upload it as a release asset on the windows-binaries
+# repo, keyed to this build's run id. Release assets keep the bundles out of git
+# (they were too large to commit) while still living in the windows-binaries repo.
+# The gated release job downloads and expands these from that repo's releases.
+$binariesRepo = "zen-browser/windows-binaries"
+$stagingTag = "windows-signed-$GithubRunId"
+echo "Ensuring staging release $stagingTag exists on $binariesRepo"
+gh release view $stagingTag --repo $binariesRepo *> $null
+if ($LASTEXITCODE -ne 0) {
+    gh release create $stagingTag --repo $binariesRepo --prerelease --title "Windows signed bundles ($GithubRunId)" --notes "Signed Windows bundles for run $GithubRunId, consumed by the release workflow. Safe to delete."
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed to create staging release $stagingTag on $binariesRepo"
+    }
+}
+
+foreach ($name in @("x86_64", "arm64")) {
+    $signedDir = ".\windsign-temp\windows-x64-signed-$name"
+    $archive = ".\windsign-temp\windows-x64-signed-$name.tar.gz"
+    echo "Creating compressed tar for $name"
+    Remove-Item $archive -ErrorAction SilentlyContinue
+    tar -czvf $archive -C $signedDir .
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed to create tar archive for $name"
+    }
+    echo "Uploading $archive to $binariesRepo release $stagingTag"
+    gh release upload $stagingTag $archive --repo $binariesRepo --clobber
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed to upload $archive to release $stagingTag"
+    }
+}
+
+echo "All artifacts signed, packaged, and uploaded to $binariesRepo release $stagingTag!"
 
 # Cleaning up
 

configs/windows/mozconfig

@@ -10,7 +10,6 @@ if test "$ZEN_CROSS_COMPILING"; then
   export WINEDEBUG=-all
 
   export MOZ_STUB_INSTALLER=1
-  export MOZ_PKG_FORMAT=TAR
 
   export CROSS_BUILD=1
   CROSS_COMPILE=1

src/zen/boosts/ZenBoostsEditor.mjs

@@ -138,6 +138,18 @@ export class nsZenBoostEditor {
       .getElementById("zen-boost-css-inspector")
       .addEventListener("click", this.onInspectorButtonPressed.bind(this));
 
+    const commandActions = {
+      cmd_zenBoostEditName: () => this.editBoostName(),
+      cmd_zenBoostShuffle: () => this.shuffleBoost(),
+      cmd_zenBoostReset: () => this.resetBoost(),
+      cmd_zenBoostLoad: () => this.onLoadBoostClick(),
+      cmd_zenBoostSave: () => this.onSaveBoostClick(),
+      cmd_zenBoostDelete: () => this.deleteBoost(),
+    };
+    for (const [id, action] of Object.entries(commandActions)) {
+      this.doc.getElementById(id).addEventListener("command", action);
+    }
+
     this.doc.addEventListener("keydown", event => {
       if (
         event.key === "Escape" ||

src/zen/boosts/jar.inc.mn

@@ -9,6 +9,7 @@
 
         # Windows
 *       content/browser/zen-components/windows/zen-boost-editor.xhtml           (../../zen/boosts/zen-boost-editor.inc.xhtml)
+        content/browser/zen-components/windows/zen-boost-editor.js              (../../zen/boosts/zen-boost-editor.js)
 
         # Images
         content/browser/zen-images/boost-indicator.svg                          (../../zen/images/boost-indicator.svg)

src/zen/boosts/zen-boost-editor.inc.xhtml

@@ -138,28 +138,14 @@
   </popupset>
 
   <commandset id="zenBoostCommandSet">
-    <command id="cmd_zenBoostEditName"
-            oncommand="window.boostEditor.editBoostName();" />
-
-    <command id="cmd_zenBoostShuffle"
-            oncommand="window.boostEditor.shuffleBoost();" />
-
-    <command id="cmd_zenBoostReset"
-            oncommand="window.boostEditor.resetBoost();" />
-
-    <command id="cmd_zenBoostLoad"
-      oncommand="window.boostEditor.onLoadBoostClick();" />
-
-    <command id="cmd_zenBoostSave"
-            oncommand="window.boostEditor.onSaveBoostClick();" />
-
-    <command id="cmd_zenBoostDelete"
-            oncommand="window.boostEditor.deleteBoost();" />
+    <command id="cmd_zenBoostEditName" />
+    <command id="cmd_zenBoostShuffle" />
+    <command id="cmd_zenBoostReset" />
+    <command id="cmd_zenBoostLoad" />
+    <command id="cmd_zenBoostSave" />
+    <command id="cmd_zenBoostDelete" />
   </commandset>
 
-  <script>
-    const { nsZenBoostEditor } = ChromeUtils.importESModule( "resource:///modules/zen/boosts/ZenBoostsEditor.mjs" );
-    window.boostEditor = new nsZenBoostEditor(document, window.domain, window, window.openerWindow);
-  </script>
+  <script src="chrome://browser/content/zen-components/windows/zen-boost-editor.js"></script>
 </html:body>
 </html>

src/zen/boosts/zen-boost-editor.js

@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const { nsZenBoostEditor } = ChromeUtils.importESModule(
+  "resource:///modules/zen/boosts/ZenBoostsEditor.mjs"
+);
+
+window.boostEditor = new nsZenBoostEditor(
+  document,
+  window.domain,
+  window,
+  window.openerWindow
+);

src/zen/space-routing/jar.inc.mn

@@ -7,3 +7,4 @@
 
         # Windows
 *       content/browser/zen-components/windows/zen-space-routing.xhtml            (../../zen/space-routing/zen-space-routing.inc.xhtml)
+        content/browser/zen-components/windows/zen-space-routing.js              (../../zen/space-routing/zen-space-routing.js)

src/zen/space-routing/zen-space-routing.inc.xhtml

@@ -82,15 +82,5 @@
     </hbox>
   </vbox>
 
-  <script>
-    const { nsZenSpaceRoutingDialog } = ChromeUtils.importESModule(
-      "resource:///modules/zen/spacerouting/ZenSpaceRoutingDialog.mjs",
-    );
-    const args = window.arguments?.[0] || {};
-    window.spaceroutingDialog = new nsZenSpaceRoutingDialog(
-      document,
-      window,
-      args.parentWindow,
-    );
-  </script>
+  <script src="chrome://browser/content/zen-components/windows/zen-space-routing.js"></script>
 </window>

src/zen/space-routing/zen-space-routing.js

@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const { nsZenSpaceRoutingDialog } = ChromeUtils.importESModule(
+  "resource:///modules/zen/spacerouting/ZenSpaceRoutingDialog.mjs"
+);
+
+const args = window.arguments?.[0] || {};
+window.spaceroutingDialog = new nsZenSpaceRoutingDialog(
+  document,
+  window,
+  args.parentWindow
+);

surfer.json

@@ -20,7 +20,7 @@
       "brandShortName": "Zen",
       "brandFullName": "Zen Browser",
       "release": {
-        "displayVersion": "1.21.8b",
+        "displayVersion": "1.21.9b",
         "github": {
           "repo": "zen-browser/desktop"
         },