fix(sign): Excluded the artifacts directory from the signed package - #3834

Fixes #1640.

web-ext build leaves the artifacts directory out of the package it creates, but web-ext sign puts it in. Anything under web-ext-artifacts/ that is not a .zip or .xpi ends up inside the archive that is uploaded to AMO: .crx and .nex files from Chrome or Opera builds, unpacked copies of the extension, screenshots. Previously built .zip and .xpi packages are already dropped by the base ignore patterns, so those are not the problem, but everything else is shipped and signed.

The cause is the temporary build directory. sign() builds into a temp dir (artifactsDir: tmpDir.path(), src/cmd/sign.js:59 on master), and build() creates its default file filter from whatever artifacts directory it was given (src/cmd/build.js:210-214). FileFilter only adds ignore rules for the artifacts directory when that directory is inside the source directory (src/util/file-filter.js:53). A temp dir is never a subpath of the source dir, so the rule is never added and the real web-ext-artifacts/ is packaged.

The fix is to build the filter where the real artifacts directory is known. Sign now calls createFileFilter({ sourceDir, ignoreFiles, artifactsDir }) itself and passes the result to build() as its fileFilter option, which is a default parameter, so no signature change is needed. That is the same call-site pattern lint.js and the extension runners already use. Those ignoreFiles go into the filter sign constructs, so --ignore-files behaves exactly as before, and the isSubPath guard added in #790 is untouched, so behaviour is also unchanged when --artifacts-dir points outside the source directory. Only the extension package is affected. The source bundle for --upload-source-code is a user supplied path.

Two tests were added to tests/unit/test-cmd/test.sign.js. The first runs the real sign command over a source directory that has a web-ext-artifacts/previous-build.crx in it, with only the submission call stubbed, and asserts the zip contains manifest.json and not the artifacts file. The zip is read inside that stub because sign removes its temporary directory as soon as it returns. The second injects a spy createFileFilter and asserts it is called with the real artifacts directory and that the resulting filter reaches build().

The one existing test that runs the real build signs a source directory with no artifacts directory inside it, so nothing leaked; every other sign test stubs build. Both new tests fail before the change, with AssertionError: expected [ 'web-ext-artifacts/', …(3) ] to not include 'web-ext-artifacts/previous-build.crx'. With the change, tests/unit/test-cmd/test.sign.js gives 16 passing, test.build.js 28 passing and tests/unit/test-util/test.file-filter.js 18 passing.