Require the submission confirmations

[Hannah-PortSwigger]

Why

A new extension submission records two agreements from its author: permission to publish under the EULA, and acceptance of the BApp Store submission requirements. 01-submit-extension.yml in extension-portal marks both required: true, so the web form enforces them.

A submission raised through the API bypasses the form entirely — increasingly common now that authors are using AI agents to submit — and could omit both boxes. Nothing enforced them, so such a submission reached the review queue with no agreement on record.

Shape

The confirmations are checkboxes in the issue body, which this action never sees — it takes extracted values, not the body. So the caller extracts them and passes the keys it found, exactly as it already does for product_compatibility, which is also body checkboxes:

confirmations: '["eula","acceptance-criteria"]'

What exists, what each one records, and which types require them are declared here alongside the other required fields:

const CONFIRMATION_RECORDS = {
  'eula': "the author's permission to publish under the EULA",
  'acceptance-criteria': "the author's agreement to the BApp Store submission requirements",
};

'extension-submission': {
  requiredFields: ['title', 'author', 'url', 'version_number'],
  applicableFields: [..., 'product_compatibility', 'confirmations'],
  requiredConfirmations: ['eula', 'acceptance-criteria'],
},

Only extension-submission declares any. extension-update, bcheck and bambda don't have confirmations in applicableFields, so the whole block is skipped for them and a value passed by mistake is ignored — same as version_number for bambda today.

The absent-confirmations message names what is missing in words rather than by key, since it reaches the submitter:

This submission did not record: the author's permission to publish under the EULA. Tick every box under "I confirm that the following is true", worded exactly as the submission form writes it.

It carries no markdown — the portal's comment poster escapes *, _, `, [, ] in this value, so emphasis would arrive as literal backslashes.

A malformed value (bad JSON, not an array, unknown key) is reported once and skips the absent check, following the urlValidationFailed / versionValidationFailed pattern.

No output

confirmations is input-only. Nothing downstream consumes the sanitized value, and adding an unused output invites someone to wire it up. Say the word if you'd rather it mirror product_compatibility exactly.

Tests

Five new jobs (21 → 26):

• both confirmations accepted
• one missing confirmation names only the absent one
• absent confirmations name both
• unknown key is not also reported as absent
• extension-update: confirmations are not required

Two existing tests needed updating. extension-submission: valid inputs and URL with trailing slash accepted both assert error_message = "" and did not supply confirmations, so they would have failed. I also added confirmations to invalid url is not also reported as missing to keep it single-purpose — without them it emitted a second unrelated error alongside the one it is asserting about.

I extracted the action's script and ran all 26 jobs' inputs and assertions locally: 26 passed, 0 failed.

Caller

extension-portal currently does this check itself in extract_issue_fields.py. Once this is tagged, it swaps to passing confirmations and drops its own error handling in the same commit as the pin bump — so there is no window where the check is unenforced. Its own parsing of the checkbox labels stays put, next to the issue form template it mirrors.

🤖 Generated with Claude Code