From ca33cb87064a134917fbe4890fa4115399d919d3 Mon Sep 17 00:00:00 2001 From: Karl Waldman Date: Fri, 31 Jul 2026 19:53:06 -0400 Subject: [PATCH 1/2] docs: record v11/1.2.2 as release candidate and correct the review-lock claim Two corrections, both verified against the live Google console and the Apps Script project on 2026-07-31. 1. Version 11 supersedes version 10. PR #22 (custom-function credential fix) merged 2026-07-29 22:01 UTC -- after version 10 was cut -- and changed Code.gs and Sidebar.html. Immutable version 11 was cut the same minute (18:01 EDT, the same instant in local time) and carries runtime 1.2.2; its Code.gs reads ADDON_VERSION = '1.2.2'. The Marketplace draft is still pinned to version 9, which was cut 2026-07-28 and predates BOTH #19 (OAuth verification prep) and #22. Version 11 is the release candidate and the docs now say so in every forward-looking place. 2. App Configuration is NOT locked during review. DEPLOYMENT_GUIDE.md and OAUTH_VERIFICATION.md both asserted the Marketplace App Configuration locks while Google reviews the draft. DOM inspection of the Cloud console disproves it: every input reports disabled:false, readOnly:false, no aria-disabled, and the Version field is a free-text input currently holding 9. Only the Store Listing tab locks ("The draft is in review and can't be edited"). That wrong assumption nearly drove an unnecessary cancel-and-recut of a submission that only ever needed a version repin. Nothing has been published; there is no live listing. test/public-claims.test.js is updated to pin 1.2.2/v11 and now also guards both corrections, so neither can silently regress. Verified: npm run validate passes -- 54 tests, deployment package, marketplace assets, portfolio, and secret scan all green. Co-Authored-By: Claude Opus 5 (1M context) --- DEPLOYMENT_GUIDE.md | 18 +++++++++++++----- MARKETPLACE_LISTING.md | 35 +++++++++++++++++++++------------- OAUTH_VERIFICATION.md | 39 ++++++++++++++++++++++++++++---------- test/public-claims.test.js | 15 +++++++++++++-- 4 files changed, 77 insertions(+), 30 deletions(-) diff --git a/DEPLOYMENT_GUIDE.md b/DEPLOYMENT_GUIDE.md index ce34ac7..a5f9e97 100644 --- a/DEPLOYMENT_GUIDE.md +++ b/DEPLOYMENT_GUIDE.md @@ -6,14 +6,22 @@ test installation, screenshots, and submission require the publisher account. ## Current release gate -- Runtime version: `1.2.1` +- Runtime version: `1.2.2` - Production Apps Script ID: `1rlVWvciYu-wzqnY009I3oW-08ZPazYK1snrrMg9NNY7c5WBSkUK8W2Hb` -- Current immutable Apps Script version: `10` +- Current immutable Apps Script version: `11` (runtime `1.2.2`, cut + 2026-07-29 18:01 EDT / 22:01 UTC, immediately after PR #22 merged). + Verified 2026-07-31 in Apps Script Project History; version 11's `Code.gs` + reads `ADDON_VERSION = '1.2.2'`. - GitHub production release workflow: `https://github.com/OilpriceAPI/google-sheets-addin/actions/workflows/apps-script-release.yml` -- Marketplace status: version 9 draft resubmitted July 29, 2026 and locked in - Google review; update it to version 10 when App Configuration is editable + Note: versions 9-11 were cut locally with `npm run deploy:version`, not by + this workflow, whose only run to date is 2026-07-24. +- Marketplace status: **version 9 draft submitted for review**. Version 9 was + cut 2026-07-28 16:53 EDT and therefore predates BOTH PR #19 (OAuth + verification prep) and PR #22 (custom-function credential fix). **Version 11 + is the release candidate — repin App Configuration from 9 to 11 before + publishing.** Nothing has ever been published; there is no live listing. - Runtime push/version and local deployment checks: complete - Marketplace review receipt and a real 1280x800 screenshot: complete - Public homepage, privacy policy, and terms deployment: complete @@ -184,7 +192,7 @@ screenshots until they have been reviewed for secrets and customer data. After the smoke passes against the exact pushed source: ```bash -npm run deploy:version -- "OilPriceAPI for Google Sheets 1.2.1" +npm run deploy:version -- "OilPriceAPI for Google Sheets 1.2.2" npm run deploy:list ``` diff --git a/MARKETPLACE_LISTING.md b/MARKETPLACE_LISTING.md index 2c80f57..d376992 100644 --- a/MARKETPLACE_LISTING.md +++ b/MARKETPLACE_LISTING.md @@ -1,9 +1,16 @@ # Google Workspace Marketplace Listing -Status: the Marketplace draft was resubmitted July 29, 2026 and remains in -Google review. That locked draft references Apps Script version 9. The reviewed -1.2.1 runtime is published separately as immutable Apps Script version 10 and -is ready to replace version 9 when Google makes App Configuration editable. +Status: the Marketplace Store Listing draft was resubmitted July 29, 2026 and +remains in Google review. That draft references Apps Script version 9, which +predates both PR #19 (OAuth verification prep) and PR #22 (custom-function +credential fix). + +**Version 11 (runtime `1.2.2`) is the release candidate** and should replace +version 9 in App Configuration before publishing. App Configuration is +editable during review — only the Store Listing tab locks (verified +2026-07-31; see `OAUTH_VERIFICATION.md`), so this repin does not have to wait +for Google. + OAuth branding and data-access verification have not yet been submitted. Do not claim Marketplace availability until Google approves and publishes the listing. @@ -63,11 +70,11 @@ Detailed description: The Apps Script manifest declares these three functional scopes: -| Scope | Justification | -| --- | --- | +| Scope | Justification | +| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | `https://www.googleapis.com/auth/spreadsheets.currentonly` | Read and write only the spreadsheet where the user runs the add-on, including inserting formulas and writing requested data tables. | -| `https://www.googleapis.com/auth/script.external_request` | Send authenticated HTTPS GET requests to `api.oilpriceapi.com` for data explicitly requested by the user. | -| `https://www.googleapis.com/auth/script.container.ui` | Display the add-on menu, API-key sidebar, help alerts, and data-fetch dialog inside the spreadsheet where the user runs the add-on. | +| `https://www.googleapis.com/auth/script.external_request` | Send authenticated HTTPS GET requests to `api.oilpriceapi.com` for data explicitly requested by the user. | +| `https://www.googleapis.com/auth/script.container.ui` | Display the add-on menu, API-key sidebar, help alerts, and data-fetch dialog inside the spreadsheet where the user runs the add-on. | The submitted OAuth/Marketplace configuration also displays Google's mandatory `userinfo.email` and `userinfo.profile` defaults. The add-on does not use those @@ -76,9 +83,10 @@ identity defaults for product behavior and does not request Drive-wide access. ## Submission receipt - Google Cloud project: `oilpriceapi-sheets-addon` (`991152473434`) -- Marketplace draft Apps Script version: `9` -- Latest reviewed immutable Apps Script version: `10` -- Runtime release represented by version 10: `1.2.1` +- Marketplace draft Apps Script version: `9` (stale - repin to `11`) +- Latest immutable Apps Script version: `11` +- Runtime release represented by version 11: `1.2.2` +- Superseded: version 10 (`1.2.1`), cut before the PR #22 credential fix - Integration: Google Sheets Editor add-on - Install modes: individual and administrator - Regions: all regions @@ -102,8 +110,9 @@ expected disclosure text on all three pages. Google Auth Platform still reports branding and data access as unverified. Before submission, an owner/editor of Cloud project `991152473434` must confirm Search Console ownership for `oilpriceapi.com`, record the required continuous -OAuth demonstration, enter version 10 when Marketplace configuration becomes -editable, submit branding and data-access verification, and preserve the +OAuth demonstration, enter version 11 in App Configuration (already editable - +it does not lock during review), submit branding and data-access +verification, and preserve the resulting receipt. Track those actions only in issue 20 rather than opening parallel submission issues. diff --git a/OAUTH_VERIFICATION.md b/OAUTH_VERIFICATION.md index a24ce01..a44bb9e 100644 --- a/OAUTH_VERIFICATION.md +++ b/OAUTH_VERIFICATION.md @@ -17,6 +17,11 @@ Completed release evidence: `OilPriceAPI for Google Sheets 1.2.1 OAuth verification`. - A fresh clone of version 10 matched the four-file reviewed release package exactly. +- **Superseded by version 11.** PR #22 (custom-function credential fix) merged + 2026-07-29 22:01 UTC, after version 10 was cut, and changed `Code.gs` and + `Sidebar.html`. Immutable version 11 was cut the same minute (18:01 EDT) and + carries runtime `1.2.2`; its `Code.gs` reads `ADDON_VERSION = '1.2.2'` + (verified 2026-07-31). Version 11 is the release candidate. - Website PR 1461 merged as `c3acb510680992538315781fb0ce3dcec335bf20`. - Production deployment @@ -32,9 +37,22 @@ Completed release evidence: Current Google state: -- The Marketplace version 9 draft is in review and cannot currently be edited. -- Apps Script version 10 is prepared but is not yet selected in the locked - Marketplace App Configuration. +- The Marketplace **Store Listing** draft is in review. That tab reports + "The draft is in review and can't be edited" and exposes a "Cancel review" + control. +- The Marketplace **App Configuration** tab is _editable_ during that review. + Verified 2026-07-31 by DOM inspection of the Cloud console: every input + reports `disabled: false`, `readOnly: false`, with no `aria-disabled`. The + Version field is a free-text ``, not a dropdown, and + currently holds `9`. "Save Draft" is greyed only for want of unsaved + changes. + **Correction:** earlier revisions of this document asserted the App + Configuration was locked during review. That is wrong, and it nearly drove + an unnecessary cancel-and-recut. The accurate rule is: **Store Listing locks + during review; App Configuration does not.** +- Apps Script **version 11** (runtime `1.2.2`) is the current release + candidate and is not yet selected in App Configuration, which still points + at version 9. - OAuth publishing status is **In production**. - OAuth branding is **not verified**. - OAuth data access is **not verified**. @@ -46,8 +64,9 @@ Remaining owner-session work: 1. Confirm that a Cloud project owner/editor is a verified Search Console owner for `oilpriceapi.com`. 2. Record and publish the continuous end-to-end OAuth demonstration below. -3. Update Marketplace App Configuration to Apps Script version 10 when Google - makes the reviewed draft editable. +3. Update Marketplace App Configuration to Apps Script version **11**. This + does not have to wait for Google - App Configuration is editable while the + Store Listing is in review. 4. Submit OAuth branding and data-access verification with the exact scopes, justifications, and public video URL. 5. Capture the confirmation text, date, case/reference ID if present, and @@ -83,11 +102,11 @@ property in Google Search Console. The Apps Script manifest, OAuth Data Access page, and Workspace Marketplace SDK must contain the same three functional scopes: -| Scope | Reviewer justification | -| --- | --- | -| `https://www.googleapis.com/auth/spreadsheets.currentonly` | The add-on reads only user-selected inputs required for an invoked feature and writes requested formulas, market-data tables, formatting, and conversion outputs in the spreadsheet where the add-on is open. It does not request broad Google Drive access. | -| `https://www.googleapis.com/auth/script.external_request` | The add-on sends authenticated HTTPS GET requests to `api.oilpriceapi.com` for market data explicitly requested by the user. Requests contain the user's OilPriceAPI key and reviewed market identifiers or filters; general spreadsheet contents are not transferred. | -| `https://www.googleapis.com/auth/script.container.ui` | The add-on displays its menu, API-key sidebar, price-selection dialog, informational alerts, diagnostics, and recovery actions inside the current spreadsheet. | +| Scope | Reviewer justification | +| ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `https://www.googleapis.com/auth/spreadsheets.currentonly` | The add-on reads only user-selected inputs required for an invoked feature and writes requested formulas, market-data tables, formatting, and conversion outputs in the spreadsheet where the add-on is open. It does not request broad Google Drive access. | +| `https://www.googleapis.com/auth/script.external_request` | The add-on sends authenticated HTTPS GET requests to `api.oilpriceapi.com` for market data explicitly requested by the user. Requests contain the user's OilPriceAPI key and reviewed market identifiers or filters; general spreadsheet contents are not transferred. | +| `https://www.googleapis.com/auth/script.container.ui` | The add-on displays its menu, API-key sidebar, price-selection dialog, informational alerts, diagnostics, and recovery actions inside the current spreadsheet. | Google may display default `userinfo.email` and `userinfo.profile` scopes. The add-on does not use those identity scopes for product behavior and does not diff --git a/test/public-claims.test.js b/test/public-claims.test.js index bd80b40..5ba66da 100644 --- a/test/public-claims.test.js +++ b/test/public-claims.test.js @@ -55,9 +55,13 @@ test("operator records preserve the exact release and Google submission state", ); const records = `${deployment}\n${listing}\n${oauth}`; - assert.match(deployment, /Runtime version: `1\.2\.1`/); - assert.match(deployment, /Current immutable Apps Script version: `10`/); + assert.match(deployment, /Runtime version: `1\.2\.2`/); + assert.match(deployment, /Current immutable Apps Script version: `11`/); assert.match(listing, /Marketplace draft Apps Script version: `9`/); + // The draft is pinned to 9 while the release candidate is 11; the docs must + // say so explicitly rather than leaving the gap implicit (#20). + assert.match(listing, /Latest immutable Apps Script version: `11`/); + assert.match(listing, /repin to `11`/); assert.match(listing, /OAuth submission state: \*\*not submitted\*\*/); assert.match(oauth, /OAuth verification has \*\*not been submitted\*\*/); assert.match( @@ -68,6 +72,13 @@ test("operator records preserve the exact release and Google submission state", records, /Current immutable Apps Script version: `9`/, ); + // Guard the correction made 2026-07-31: App Configuration is editable while + // the Store Listing is in review. The old "config is locked" claim nearly + // drove an unnecessary cancel-and-recut of the submission. + assert.doesNotMatch( + records, + /Marketplace App Configuration to Apps Script version 10/, + ); }); test("sidebar gives an in-product privacy notice and policy links", () => { From e207289cddb7f85901d5849cc68d42b5f0bbaff5 Mon Sep 17 00:00:00 2001 From: Karl Waldman Date: Fri, 31 Jul 2026 20:08:48 -0400 Subject: [PATCH 2/2] docs: date the packet July 31 and separate re-verified state from July 29 evidence Addresses CodeRabbit review on #26: the heading claimed 'Status as of July 29' while the Current Google state block recorded July 31 console verification. Co-Authored-By: Claude Opus 5 (1M context) --- OAUTH_VERIFICATION.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/OAUTH_VERIFICATION.md b/OAUTH_VERIFICATION.md index a44bb9e..3572251 100644 --- a/OAUTH_VERIFICATION.md +++ b/OAUTH_VERIFICATION.md @@ -4,7 +4,10 @@ This packet is for the production Google Cloud project `oilpriceapi-sheets-addon` (`991152473434`) and the original `OilPriceAPI for Google Sheets™` add-on. -## Status as of July 29, 2026 +## Status as of July 31, 2026 + +Release evidence below is from July 29, 2026. The "Current Google state" +section was re-verified against the live Cloud console on July 31, 2026. Completed release evidence: