Stamp release version into package.json during release build

[jonathanKingston]

Asana Task/Github Issue: N/A

Description

• update the release workflow build step to write the computed release tag version into the root package.json
• use npm pkg set version="${{ steps.version.outputs.version }}" immediately before npm run build

Testing Steps

• Trigger the Release workflow via workflow_dispatch
• Verify the Build release step runs npm pkg set version=...
• Confirm the commit on releases contains package.json with the same version as the generated release tag

Checklist

Please tick all that apply:

• I have tested this change locally
• I have tested this change locally in all supported browsers
• This change will be visible to users
• I have added automated tests that cover this change
• I have ensured the change is gated by config
• This change was covered by a ship review
• This change was covered by a tech design
• Any dependent config has been merged

  

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[github-actions]

[Beta] Generated file diff

Time updated: Fri, 22 May 2026 10:13:35 GMT

[cursor]

Web Compatibility Assessment

No findings. The only changed line is .github/workflows/build.yml line 114, adding npm pkg set version=... during the manual release build. This does not touch injected/src, browser API wrappers/shims, DOM behavior, messaging, or platform entry points.

Security Assessment

No findings. The stamped value is derived from the workflow's calculated numeric semver output, and the diff does not change runtime code, captured globals, message bridge checks, origin validation, or data-flow from web pages.

Risk Level

Low Risk: release-workflow metadata stamping only, with no injected runtime or security-sensitive surface changed.

Recommendations

No changes requested for web compatibility or security. I also ran git diff --check on the PR diff; no whitespace issues were reported.

  

_{Sent by Cursor Automation: Web compat and sec}

[github-actions]

⚠️ Cursor assessed this PR as unknown Risk (only Low Risk is auto-approved).

This PR requires a manual review and approval from a member of one of the following teams:

• @duckduckgo/content-scope-scripts-owners
• @duckduckgo/apple-devs
• @duckduckgo/android-devs
• @duckduckgo/team-windows-development
• @duckduckgo/extension-owners
• @duckduckgo/config-aor
• @duckduckgo/breakage-aor
• @duckduckgo/breakage

[github-actions]

Build Branch

Branch	pr-releases/jkt/auto/stamp-tag-version-package-json-0cc5
Commit	4fdf0826ef
Updated	May 22, 2026 at 10:12:58 AM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/jkt/auto/stamp-tag-version-package-json-0cc5

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/jkt/auto/stamp-tag-version-package-json-0cc5")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/jkt/auto/stamp-tag-version-package-json-0cc5
git -C submodules/content-scope-scripts checkout origin/pr-releases/jkt/auto/stamp-tag-version-package-json-0cc5

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#4fdf0826ef171f988f77d9ce112f1a692aff3e2e

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "4fdf0826ef171f988f77d9ce112f1a692aff3e2e")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/jkt/auto/stamp-tag-version-package-json-0cc5
git -C submodules/content-scope-scripts checkout 4fdf0826ef171f988f77d9ce112f1a692aff3e2e