ci: harden releases and lockfiles

.github/workflows/ci.yml

@@ -1,16 +1,84 @@
 name: CI
-on: [push, pull_request]
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   check:
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-      - run: bun install
-      - run: bun run typecheck
-      - run: bun test
-      - name: Smoke test
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.11
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Test
+        run: bun test
+
+      - name: Build release artifacts
+        run: bun run build
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '18'
+
+      - name: Verify npm package contents
+        run: |
+          npm pack --dry-run --json > npm-pack.json
+          node --input-type=module <<'NODE'
+          import { readFileSync } from 'node:fs';
+
+          const [{ files }] = JSON.parse(readFileSync('npm-pack.json', 'utf8'));
+          const packagedFiles = new Set(files.map(({ path }) => path));
+          const requiredFiles = [
+            'dist/index.d.ts',
+            'dist/mmx.mjs',
+            'dist/sdk.mjs',
+            'package.json',
+          ];
+          const missingFiles = requiredFiles.filter((path) => !packagedFiles.has(path));
+
+          if (missingFiles.length > 0) {
+            throw new Error(`npm package is missing: ${missingFiles.join(', ')}`);
+          }
+          NODE
+
+      - name: Smoke test with Node 18
         run: |
-          bun build src/main.ts --compile --outfile dist/mmx
-          ./dist/mmx --version
+          node dist/mmx.mjs --version
+          node --input-type=module -e "await import('./dist/sdk.mjs')"
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 'lts/*'
+
+      - name: Smoke test with current Node LTS
+        run: |
+          node dist/mmx.mjs --version
+          node --input-type=module -e "await import('./dist/sdk.mjs')"
+
+      - name: Verify npm lockfile
+        run: npm ci --ignore-scripts

.github/workflows/release.yml

@@ -8,31 +8,98 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   release:
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.11
 
-      - uses: oven-sh/setup-bun@v2
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
 
-      - run: bun install
+      - name: Verify tag matches package version
+        run: |
+          package_version=$(bun -e "console.log(require('./package.json').version)")
+          tag_version=${GITHUB_REF_NAME#v}
+          if [[ "$tag_version" != "$package_version" ]]; then
+            echo "Tag version $tag_version does not match package version $package_version" >&2
+            exit 1
+          fi
 
-      - run: bun run build
+      - name: Typecheck
+        run: bun run typecheck
 
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+      - name: Lint
+        run: bun run lint
+
+      - name: Test
+        run: bun test
+
+      - name: Build release artifacts
+        run: bun run build
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          generate_release_notes: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          node-version: '18'
+
+      - name: Pack and verify npm artifact
+        id: package
+        run: |
+          npm pack --json > npm-pack.json
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from 'node:fs';
 
-      - uses: actions/setup-node@v4
+          const [{ filename, files }] = JSON.parse(readFileSync('npm-pack.json', 'utf8'));
+          const packagedFiles = new Set(files.map(({ path }) => path));
+          const requiredFiles = [
+            'dist/index.d.ts',
+            'dist/mmx.mjs',
+            'dist/sdk.mjs',
+            'package.json',
+          ];
+          const missingFiles = requiredFiles.filter((path) => !packagedFiles.has(path));
+
+          if (missingFiles.length > 0) {
+            throw new Error(`npm package is missing: ${missingFiles.join(', ')}`);
+          }
+
+          appendFileSync(process.env.GITHUB_OUTPUT, `filename=${filename}\n`);
+          NODE
+
+      - name: Smoke test with Node 18
+        run: |
+          node dist/mmx.mjs --version
+          node --input-type=module -e "await import('./dist/sdk.mjs')"
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: 'lts/*'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Smoke test with current Node LTS
+        run: |
+          node dist/mmx.mjs --version
+          node --input-type=module -e "await import('./dist/sdk.mjs')"
+
       - name: Publish to npm
-        run: npm publish
+        run: npm publish "${{ steps.package.outputs.filename }}" --ignore-scripts
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+        with:
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}