chore(release): 1.4.0

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/docs.yml

@@ -24,7 +24,7 @@ jobs:
       changed: ${{ github.event_name == 'workflow_dispatch' || steps.version.outputs.changed == 'true' }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
@@ -49,10 +49,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
@@ -66,7 +66,7 @@ jobs:
         run: npm run docs
 
       - name: Upload pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: docs
 
@@ -81,4 +81,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/issue-auto-label.yml

@@ -10,7 +10,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const body = context.payload.issue.body || '';

.github/workflows/issue-notify.yml

@@ -10,11 +10,11 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: .github/CODEOWNERS
           sparse-checkout-cone-mode: false
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');

.github/workflows/needs-author-feedback-followup.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Remind or close issues waiting for author feedback
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const owner = context.repo.owner;

.github/workflows/needs-author-feedback.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify issue author
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const issue = context.payload.issue;
@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Remove label when issue author replies
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const issue = context.payload.issue;

.github/workflows/performance.yml

@@ -0,0 +1,105 @@
+name: Performance
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: perf-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  benchmark:
+    name: Benchmark distro overhead
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      PERF_REGRESSION_THRESHOLD: "15"
+
+    steps:
+      - name: Check out PR branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: pr
+          fetch-depth: 0
+
+      - name: Check out base branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.sha || github.event.repository.default_branch }}
+          path: base
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: pr/package-lock.json
+
+      - name: Install and build candidate
+        working-directory: pr
+        run: |
+          npm ci
+          npm run build
+
+      - name: Install and build baseline
+        working-directory: base
+        run: |
+          npm ci
+          npm run build
+
+      - name: Run alternating benchmark trials
+        working-directory: pr
+        run: |
+          run_benchmark() {
+            node --expose-gc perf/benchmark.mjs \
+              --package-root "$1" \
+              --iterations 100000 \
+              --rounds 8 \
+              --output "$2"
+          }
+
+          for trial in 1 2 3 4; do
+            if (( trial % 2 == 1 )); then
+              run_benchmark "$GITHUB_WORKSPACE/base" "$GITHUB_WORKSPACE/base-$trial.json"
+              run_benchmark "$GITHUB_WORKSPACE/pr" "$GITHUB_WORKSPACE/pr-$trial.json"
+            else
+              run_benchmark "$GITHUB_WORKSPACE/pr" "$GITHUB_WORKSPACE/pr-$trial.json"
+              run_benchmark "$GITHUB_WORKSPACE/base" "$GITHUB_WORKSPACE/base-$trial.json"
+            fi
+          done
+
+      - name: Compare results
+        working-directory: pr
+        run: |
+          node perf/compare.mjs \
+            --baseline "$GITHUB_WORKSPACE/base-1.json" \
+            --baseline "$GITHUB_WORKSPACE/base-2.json" \
+            --baseline "$GITHUB_WORKSPACE/base-3.json" \
+            --baseline "$GITHUB_WORKSPACE/base-4.json" \
+            --candidate "$GITHUB_WORKSPACE/pr-1.json" \
+            --candidate "$GITHUB_WORKSPACE/pr-2.json" \
+            --candidate "$GITHUB_WORKSPACE/pr-3.json" \
+            --candidate "$GITHUB_WORKSPACE/pr-4.json" \
+            --threshold "$PERF_REGRESSION_THRESHOLD" \
+            --output "$GITHUB_WORKSPACE/report.md"
+
+      - name: Record PR number
+        if: always() && github.event_name == 'pull_request'
+        run: echo "${{ github.event.pull_request.number }}" > "$GITHUB_WORKSPACE/pr-number.txt"
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: perf-results
+          path: |
+            base-*.json
+            pr-*.json
+            report.md
+            pr-number.txt
+          if-no-files-found: ignore

.github/workflows/pr-validation.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
@@ -46,10 +46,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -67,3 +67,52 @@ jobs:
 
       - name: Run ESM build import regression test
         run: npm run test:esm-build
+
+  integration-tests:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build package
+        run: npm run build
+
+      - name: Run integration tests
+        run: npm run test:integration
+
+  changelog:
+    name: CHANGELOG updated
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'pull_request' &&
+      !contains(github.event.pull_request.labels.*.name, 'skip-changelog')
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+
+      - name: Verify CHANGELOG.md was updated
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if git diff --name-only "$BASE_SHA...$HEAD_SHA" | grep -qx 'CHANGELOG.md'; then
+            echo "CHANGELOG.md was updated."
+          else
+            echo "::error::CHANGELOG.md was not updated in this PR."
+            echo "Add an entry to CHANGELOG.md, or apply the 'skip-changelog' label if this change does not warrant one."
+            exit 1
+          fi

.gitignore

@@ -21,8 +21,8 @@ dist-*/
 .DS_Store
 Thumbs.db
 
-# Generated docs
-docs/
+# Generated planning docs
+docs/superpowers/
 
 # Test coverage
 coverage/
@@ -33,3 +33,4 @@ npm-debug.log*
 
 # Temp
 tmp/
+.worktrees/