Configure read-only Chrome Web Store status credentials

[lamemustafa]

The Chrome Web Store Status workflow is enabled, but the dedicated chrome-web-store-status environment is not fully configured. Manual dispatch for expected_version=0.3.2 failed before calling the CWS API.

Evidence:

• Run 28716740360 failed with missing CWS_PUBLISHER_ID and CWS_SERVICE_ACCOUNT_JSON.
• I set CWS_PUBLISHER_ID on chrome-web-store-status to ba722f9f-8447-450b-a01a-38907907e3cd.
• Run 28716803447 then failed only with: Missing Chrome Web Store credentials. Provide CWS_SERVICE_ACCOUNT_JSON or OAuth CWS_CLIENT_ID, CWS_CLIENT_SECRET, and CWS_REFRESH_TOKEN.

Acceptance criteria:

• Add a read-only service-account CWS_SERVICE_ACCOUNT_JSON secret to the chrome-web-store-status GitHub environment.
• Re-run Chrome Web Store Status with expected_version=0.3.2 and require_published=false; it should report submitted/pending or published state instead of credential failure.
• When the Chrome Web Store listing goes live, re-run with require_published=true and record the successful run.

Do not copy the publish workflow OAuth client secret or refresh token into this read-only environment unless the release/security policy is changed deliberately.

[lamemustafa]

Update: the release-side gate is now configured.

• Set repository variable CWS_SUBMIT_ENABLED=true, so future Pack Release runs that create a GitHub release will enter the Chrome Web Store submit job instead of silently skipping it.
• Added required reviewer protection to the chrome-web-store environment with lamemustafa as the required reviewer before publishing credentials are exposed.
• Verified chrome-web-store still has CWS_PUBLISHER_ID plus OAuth credential secret names.

This issue remains open for the separate read-only status environment: chrome-web-store-status still has no CWS_SERVICE_ACCOUNT_JSON secret, so Chrome Web Store Status cannot call fetchStatus yet.

[lamemustafa]

Live evidence refresh:

• Public CWS listing still shows the old published package: ComplyEaze Pack: GST GSTR-3B Downloader, manifest version 0.2.1, and GSTR-3B-only copy.
• https://pack.complyeaze.com/status still reports v0.3.2 as PENDING_REVIEW and the read-only Chrome Web Store status monitor as todo.
• Remaining action for this issue is unchanged: configure CWS_SERVICE_ACCOUNT_JSON in the chrome-web-store-status environment so the scheduled read-only monitor can prove publication/review state without write-capable CWS credentials.

[lamemustafa]

Fresh status-monitor check after the latest Pack/public-site closeout work:

Recent Chrome Web Store Status runs are still failing:

• 28736100206 | schedule | master | ef8d2c09... | completed/failure | 2026-07-05T09:22:11Z
• 28729276778 | schedule | master | b207d620... | completed/failure | 2026-07-05T04:18:47Z
• 28716803447 | workflow_dispatch | master | b207d620... | completed/failure | 2026-07-04T19:13:26Z
• 28716740360 | workflow_dispatch | master | b207d620... | completed/failure | 2026-07-04T19:10:57Z

This still looks blocked on status environment credentials/access rather than source code. Expected next step remains configuring the read-only chrome-web-store-status environment with CWS_PUBLISHER_ID and read-only CWS_SERVICE_ACCOUNT_JSON, then dispatching the workflow with expected_version=0.3.2 and require_published=false.