Version Packages

.changeset/config.json

@@ -1,11 +1,28 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
-  "fixed": [],
+  "fixed": [
+    [
+      "@webblackbox/cdp-router",
+      "@webblackbox/extension",
+      "@webblackbox/mcp-server",
+      "@webblackbox/pipeline",
+      "@webblackbox/player",
+      "@webblackbox/player-sdk",
+      "@webblackbox/protocol",
+      "@webblackbox/recorder",
+      "@webblackbox/share-server",
+      "webblackbox"
+    ]
+  ],
   "linked": [],
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": []
+  "ignore": [],
+  "privatePackages": {
+    "version": true,
+    "tag": false
+  }
 }

.github/workflows/changesets.yml

@@ -19,15 +19,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: pnpm
@@ -36,7 +36,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Create or update version PR
-        uses: changesets/action@v1
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           version: pnpm version-packages
           title: Version Packages

.github/workflows/ci.yml

@@ -16,20 +16,23 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Dependency audit
+        run: pnpm audit --audit-level=high
+
       - name: Format Check
         run: pnpm format:check
 
@@ -39,14 +42,17 @@ jobs:
       - name: Typecheck
         run: pnpm typecheck
 
+      - name: API Documentation Drift Check
+        run: pnpm docs:api:check
+
       - name: Test
         run: pnpm test
 
       - name: Benchmark Regression Gate
         run: pnpm bench:ci
 
       - name: Upload Benchmark Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: benchmark-report
@@ -94,13 +100,13 @@ jobs:
             needsChrome: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: pnpm
@@ -109,7 +115,7 @@ jobs:
         if: ${{ matrix.needsChrome }}
         timeout-minutes: 5
         id: setup-chrome
-        uses: browser-actions/setup-chrome@v2
+        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
         with:
           chrome-version: stable
           install-dependencies: true

.github/workflows/release-assets.yml

@@ -11,40 +11,100 @@ on:
         required: true
         type: string
 
-permissions:
-  contents: write
+permissions: {}
+
+concurrency:
+  group: release-assets-stable
+  queue: max
+  cancel-in-progress: false
 
 jobs:
-  chrome-extension:
+  verify-release:
     runs-on: ubuntu-latest
+    outputs:
+      verified_sha: ${{ steps.verified_source.outputs.sha }}
+    permissions:
+      actions: read
+      contents: read
     env:
       RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}
     steps:
       - name: Checkout released ref
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}
 
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Verify immutable release source
+        run: |
+          git fetch --force --tags origin main:refs/remotes/origin/main
+          node scripts/verify-release-ref.mjs "$RELEASE_TAG" origin/main
+
+      - name: Verify successful CI for release commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          release_sha=$(git rev-parse HEAD)
+          successful_runs=$(gh run list \
+            --repo "$GITHUB_REPOSITORY" \
+            --workflow ci.yml \
+            --commit "$release_sha" \
+            --branch main \
+            --event push \
+            --status success \
+            --limit 1 \
+            --json databaseId \
+            --jq 'length')
+          if [ "$successful_runs" -ne 1 ]; then
+            echo "No successful CI workflow found for $release_sha." >&2
+            exit 1
+          fi
+
+      - name: Export verified release commit
+        id: verified_source
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  chrome-extension:
+    runs-on: ubuntu-latest
+    needs: verify-release
+    permissions:
+      contents: write
+    env:
+      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}
+    steps:
+      - name: Checkout verified release commit
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.verify-release.outputs.verified_sha }}
+
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Package Chrome extension
+      - name: Package and verify store-safe Chrome extension
         run: pnpm --filter @webblackbox/extension package:chrome
 
       - name: Resolve Chrome extension archive
         id: archive
         run: |
-          archive_path=$(ls -t apps/extension/dist/*-chrome.zip | head -n 1)
+          archive_path=$(find apps/extension/dist -maxdepth 1 -type f \
+            -name 'webblackbox-*-chrome.zip' \
+            ! -name '*-enterprise-chrome.zip' \
+            -print | head -n 1)
           if [ -z "$archive_path" ]; then
             echo "Could not find packaged Chrome extension archive." >&2
             exit 1
@@ -76,21 +136,24 @@ jobs:
 
   player-pages:
     runs-on: ubuntu-latest
+    needs: verify-release
+    permissions:
+      contents: write
     env:
       RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}
       PLAYER_SITE_URL: https://webllm.github.io/webblackbox/
     steps:
-      - name: Checkout released ref
-        uses: actions/checkout@v4
+      - name: Checkout verified release commit
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}
+          ref: ${{ needs.verify-release.outputs.verified_sha }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: pnpm

.github/workflows/release.yml

@@ -6,59 +6,93 @@ on:
       - published
   workflow_dispatch:
     inputs:
-      ref:
-        description: Git ref, tag, or SHA to publish from (defaults to the selected branch/ref)
-        required: false
+      tag:
+        description: Exact semantic version tag to publish (for example v1.2.3)
+        required: true
         type: string
 
 permissions:
+  actions: read
   contents: read
   id-token: write
 
 concurrency:
-  group: release-${{ github.event_name == 'workflow_dispatch' && (inputs.ref || github.ref) || github.event.release.tag_name }}
+  group: release-stable-publish
+  queue: max
   cancel-in-progress: false
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    env:
+      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
-          ref: ${{ github.event_name == 'workflow_dispatch' && (inputs.ref || github.ref) || github.event.release.tag_name }}
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}
+
+      - name: Verify immutable release source
+        run: |
+          git fetch --force --tags origin main:refs/remotes/origin/main
+          node scripts/verify-release-ref.mjs "$RELEASE_TAG" origin/main
+
+      - name: Verify successful CI for release commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          release_sha=$(git rev-parse HEAD)
+          successful_runs=$(gh run list \
+            --repo "$GITHUB_REPOSITORY" \
+            --workflow ci.yml \
+            --commit "$release_sha" \
+            --branch main \
+            --event push \
+            --status success \
+            --limit 1 \
+            --json databaseId \
+            --jq 'length')
+          if [ "$successful_runs" -ne 1 ]; then
+            echo "No successful CI workflow found for $release_sha." >&2
+            exit 1
+          fi
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
 
       - name: Ensure npm supports trusted publishing
-        run: npm install -g npm@latest
+        run: npm install -g npm@12.0.0
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Production dependency audit
+        run: pnpm audit --prod --audit-level=high
+
+      - name: Verify source quality
+        run: |
+          pnpm format:check
+          pnpm lint
+          pnpm typecheck
+          pnpm docs:api:check
+          pnpm test
+
       - name: Build workspace
         run: pnpm build
 
+      - name: Verify bundle budgets
+        run: pnpm bundle:size
+
       - name: Verify publish artifacts
-        run: >
-          pnpm
-          --filter @webblackbox/mcp-server
-          --filter @webblackbox/cdp-router
-          --filter @webblackbox/pipeline
-          --filter @webblackbox/player-sdk
-          --filter @webblackbox/protocol
-          --filter @webblackbox/recorder
-          --filter webblackbox
-          exec npm pack --dry-run --json
+        run: pnpm release:verify-artifacts
 
       - name: Publish packages to npm
         env:
@@ -71,5 +105,5 @@ jobs:
             echo "## NPM Publish Triggered"
             echo ""
             echo "- Source: \`${{ github.event_name }}\`"
-            echo "- Ref: \`${{ github.event_name == 'workflow_dispatch' && (inputs.ref || github.ref) || github.event.release.tag_name }}\`"
+            echo "- Ref: \`$RELEASE_TAG\`"
           } >> "$GITHUB_STEP_SUMMARY"