WEB-32: harden CI and release gates

.changeset/strict-cli-tests.md

@@ -0,0 +1,5 @@
+---
+"@bridgent/cli": patch
+---
+
+Require the CLI test command to execute at least one test file.

.github/RELEASE_TEMPLATE.md

@@ -11,7 +11,9 @@
 
 ## Changelog
 
-<!-- changesets/action will populate this — leave the marker below intact -->
+<!-- github-release.yml normally extracts this package version's CHANGELOG.md
+section automatically. When using this template manually, paste that section
+here. -->
 
 {{changelog}}
 

.github/workflows/ci.yml

@@ -9,6 +9,9 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: Node ${{ matrix.node }} on ${{ matrix.os }}
@@ -25,52 +28,40 @@ jobs:
       NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+        with:
+          cache: true
 
       - name: Setup Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: ${{ matrix.node }}
 
-      - name: Activate pnpm via Corepack
-        run: |
-          npm install -g corepack@latest
-          corepack enable
-          corepack prepare --activate
-          pnpm --version
-
-      - name: Cache pnpm store
-        uses: actions/cache@v5
-        with:
-          path: ~/.local/share/pnpm/store
-          key: pnpm-store-${{ runner.os }}-${{ matrix.node }}-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            pnpm-store-${{ runner.os }}-${{ matrix.node }}-
+      - name: Report toolchain
+        run: pnpm --version
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Audit production dependencies
+        run: pnpm audit:prod
+
       - name: Cache turbo
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ matrix.node }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}-${{ matrix.node }}-
 
-      - name: Lint
-        run: pnpm turbo run lint
-
-      - name: Typecheck
-        run: pnpm turbo run typecheck
-
-      # Build before Test so the @bridgent/host-test cli-smoke case can find
-      # the freshly built `bridgent` binary at packages/cli/dist/cli.mjs.
-      - name: Build
-        run: pnpm turbo run build
-
-      - name: Test
-        run: pnpm turbo run test
+      # Turbo's ^build edges build the CLI before host-test runs.
+      - name: Build, test, typecheck, and lint
+        run: pnpm check
 
   # PR-only: every PR that touches a publishable package must ship a changeset.
   # Skipped on the auto-generated "chore(release): version packages" PR (it
@@ -86,21 +77,19 @@ jobs:
       NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '24'
 
-      - name: Activate pnpm via Corepack
-        run: |
-          npm install -g corepack@latest
-          corepack enable
-          corepack prepare --activate
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 

.github/workflows/docs.yml

@@ -39,26 +39,19 @@ jobs:
       DOCS_BASE: /Bridgent/
 
     steps:
-      - uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          node-version: '24'
+          persist-credentials: false
 
-      - name: Activate pnpm via Corepack
-        run: |
-          npm install -g corepack@latest
-          corepack enable
-          corepack prepare --activate
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+        with:
+          cache: true
 
-      - name: Cache pnpm store
-        uses: actions/cache@v5
+      - name: Setup Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          path: ~/.local/share/pnpm/store
-          key: pnpm-store-${{ runner.os }}-docs-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            pnpm-store-${{ runner.os }}-docs-
+          node-version: '24'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -67,10 +60,10 @@ jobs:
         run: pnpm --filter @bridgent/docs build
 
       - name: Configure Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: apps/docs/.vitepress/dist
 
@@ -85,4 +78,4 @@ jobs:
     steps:
       - name: Deploy
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/github-release.yml

@@ -26,9 +26,10 @@ jobs:
     name: Create GitHub Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Parse tag
         id: parse

docs/release-checklist.md

@@ -11,7 +11,9 @@ authenticator app is just simpler and more reliable.
 ## Pre-flight
 
 - [ ] `main` is green (CI all checks pass)
-- [ ] `pnpm turbo run lint typecheck test build` passes locally on Node 24
+- [ ] `pnpm check` passes locally on Node 24 (the same build, test, typecheck,
+      and lint gate used by CI)
+- [ ] `pnpm audit:prod` reports no high-severity production dependency advisories
 - [ ] `pnpm --filter @bridgent/host-test test` passes (cross-host protocol harness)
 - [ ] Before running `pnpm changeset version`, `pnpm changeset status` shows
       the changeset(s) you expect. After versioning, this command is expected
@@ -35,15 +37,10 @@ will prompt for an OTP because the npm account has 2FA scope set to
 
 ## Release flow
 
-For the current v0.3 metadata + inspect hints line, publish the six packages
-that changed:
-
-- `@bridgent/core@0.3.0`
-- `@bridgent/cli@0.3.0`
-- `@bridgent/source-openapi@0.3.0`
-- `@bridgent/source-prisma@0.3.0`
-- `@bridgent/source-drizzle@0.3.0`
-- `@bridgent/source-trpc@0.3.1`
+Bridgent uses independent package versions (`fixed` and `linked` are empty in
+`.changeset/config.json`), so version skew between packages is expected. Treat
+`pnpm changeset status` as the source of truth for the packages and versions in
+each release; do not reuse a package list from an earlier release.
 
 ```bash
 # 1) If there are pending changesets, bump versions + regenerate CHANGELOGs.
@@ -55,9 +52,10 @@ git add .
 git commit -m "chore(release): version packages"
 git push
 
-# 3) Build everything fresh — `changeset publish` does NOT build for you
-pnpm install
-pnpm turbo run build
+# 3) Reinstall from the committed lockfile and run the same full gate as CI.
+#    `changeset publish` does not build or test for you.
+pnpm install --frozen-lockfile
+pnpm check
 
 # 4) Publish unpublished package versions — will prompt for OTP per package
 pnpm changeset publish
@@ -68,32 +66,35 @@ pnpm changeset publish
 git push --follow-tags
 ```
 
-Expected during step 4 for the current release:
+Expected during step 4 (the exact package names and versions come from
+`pnpm changeset status`):
 
 ```
-🦋  info Publishing "@bridgent/core" at "0.3.0"
-🦋  info Publishing "@bridgent/cli" at "0.3.0"
-🦋  info Publishing "@bridgent/source-openapi" at "0.3.0"
-🦋  info Publishing "@bridgent/source-prisma" at "0.3.0"
-🦋  info Publishing "@bridgent/source-drizzle" at "0.3.0"
-🦋  info Publishing "@bridgent/source-trpc" at "0.3.1"
+🦋  info Publishing "@bridgent/<package>" at "<version>"
 Enter OTP: ______
 ```
 
+## GitHub Actions configuration
+
+The current manual npm publishing flow requires no repository secret to be
+configured. `GITHUB_TOKEN` is supplied automatically by GitHub and is used only
+by `github-release.yml` after a maintainer pushes package tags. `DOCS_BASE` and
+`NPM_CONFIG_REGISTRY` are non-secret workflow configuration values.
+
+If CI publishing is reintroduced, configure exactly one of these authentication
+paths manually under repository Settings → Secrets and variables → Actions:
+
+- OIDC trusted publishing: no npm token; grant the release job
+  `id-token: write` and configure each package's trusted publisher on npm.
+- Token publishing: add `NPM_TOKEN` as a repository or environment secret.
+
+Never commit either credentials or one-time passwords.
+
 ## Post-release
 
-- [ ] Verify packages on npm:
-      `npm view @bridgent/core version --registry=https://registry.npmjs.org/` → `0.3.0`
-- [ ] Verify packages on npm:
-      `npm view @bridgent/cli version --registry=https://registry.npmjs.org/` → `0.3.0`
-- [ ] Verify packages on npm:
-      `npm view @bridgent/source-openapi version --registry=https://registry.npmjs.org/` → `0.3.0`
-- [ ] Verify packages on npm:
-      `npm view @bridgent/source-prisma version --registry=https://registry.npmjs.org/` → `0.3.0`
-- [ ] Verify packages on npm:
-      `npm view @bridgent/source-drizzle version --registry=https://registry.npmjs.org/` → `0.3.0`
-- [ ] Verify packages on npm:
-      `npm view @bridgent/source-trpc version --registry=https://registry.npmjs.org/` → `0.3.1`
+- [ ] For every package reported by `pnpm changeset status`, verify the published
+      version with
+      `npm view @bridgent/<package> version --registry=https://registry.npmjs.org/`
 - [ ] Smoke test the installed CLI, metadata probe, and changed source adapters from a clean temp project
 - [ ] Confirm <https://github.com/JS-mark/Bridgent/releases> auto-created one Release per package tag (the `github-release.yml` workflow handles it). Tweak titles or add highlights at the top of any Release if the auto-extracted CHANGELOG section needs polish.
 - [ ] Re-record demo GIF if the headline UX changed (`docs/recording.md`)

package.json

@@ -14,11 +14,13 @@
     "test": "turbo run test",
     "lint": "turbo run lint",
     "typecheck": "turbo run typecheck",
+    "check": "turbo run build test typecheck lint",
+    "audit:prod": "pnpm audit --prod --audit-level high",
     "docs:dev": "pnpm --filter @bridgent/docs dev",
     "docs:build": "pnpm --filter @bridgent/docs build",
     "changeset": "changeset",
     "version-packages": "changeset version",
-    "release": "pnpm turbo run build && changeset publish",
+    "release": "pnpm check && changeset publish",
     "clean": "rm -rf packages/*/dist packages/*/.turbo apps/*/dist apps/*/.turbo .turbo node_modules/.cache"
   },
   "devDependencies": {

packages/cli/package.json

@@ -38,7 +38,7 @@
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch",
-    "test": "vitest run --passWithNoTests",
+    "test": "vitest run",
     "typecheck": "tsc --noEmit",
     "lint": "eslint ."
   },