extension/scripts/packaging.sh

@@ -25,7 +25,14 @@ set -euf
 # Split by whether git tracks them: node_modules and web-ext-artifacts are
 # build/dependency output that never appears in a commit, so they belong in
 # web-ext's ignore list but would be meaningless in a git pathspec.
-NOT_PACKAGED_TRACKED='package.json package-lock.json README.md .gitignore vitest.config.js scripts/** test/**'
+#
+# Directories need BOTH forms. `test/**` matches the files inside, but not the
+# directory entry itself — web-ext writes an entry for the directory too, so
+# with only the glob the XPI ends up carrying empty `test/` and `scripts/`
+# entries (caught by the XPI-content check on 2026-08-03). The bare name alone
+# is not enough either: minimatch's `test` does not match `test/url.spec.js`,
+# so dropping the glob would ship the contents. Keep both.
+NOT_PACKAGED_TRACKED='package.json package-lock.json README.md .gitignore vitest.config.js scripts scripts/** test test/**'
 NOT_PACKAGED_BUILD='web-ext-artifacts node_modules'
 
 usage() {

extension/test/version.spec.js

@@ -54,9 +54,14 @@ describe('packaging.sh — the single definition of what ships', () => {
     // omitting either would ship dev tooling to users -- and `test/**` in
     // particular only survives because callers `set -f` before substituting it.
     const ignore = packaging('ignore')
-    expect(ignore).toContain('test/**')
-    expect(ignore).toContain('scripts/**')
     expect(ignore).toContain('vitest.config.js')
+    // Both forms per directory. The glob covers the contents; the bare name
+    // covers the directory ENTRY, which web-ext writes separately — with only
+    // the glob, the XPI carries an empty `test/` and `scripts/`.
+    for (const dir of ['test', 'scripts']) {
+      expect(ignore, `${dir} contents`).toContain(`${dir}/**`)
+      expect(ignore, `${dir} directory entry`).toContain(dir)
+    }
   })
 })