Harden runtime recovery, development checks and automated releases

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# Explicit ownership for credentials, distribution and extension trust boundaries.
+/.github/ @mimalef70
+/tasks/*release* @mimalef70
+/tasks/publish-*-store.js @mimalef70
+/tasks/sync-store-assets.js @mimalef70
+/src/manifest*.json @mimalef70
+/src/background/messenger.ts @mimalef70
+/src/utils/*font*storage.ts @mimalef70
+/SECURITY.md @mimalef70

.github/actions/setup-actionlint/action.yml

@@ -0,0 +1,24 @@
+name: Set up actionlint
+description: Install checksum-verified actionlint for Linux x64 CI
+runs:
+  using: composite
+  steps:
+    - name: Install actionlint 1.7.12
+      shell: bash
+      run: |
+        set -euo pipefail
+        if [[ "${RUNNER_OS}/${RUNNER_ARCH}" != "Linux/X64" ]]; then
+          echo 'This actionlint package requires Linux x64.' >&2
+          exit 1
+        fi
+        fontara_lint_dir="${RUNNER_TEMP}/fontara-actionlint"
+        mkdir -p "$fontara_lint_dir"
+        curl --fail --silent --show-error --location --retry 3 \
+          https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz \
+          --output "$fontara_lint_dir/actionlint.tar.gz"
+        printf '%s  %s\n' \
+          8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 \
+          "$fontara_lint_dir/actionlint.tar.gz" | sha256sum --check --status
+        tar -xzf "$fontara_lint_dir/actionlint.tar.gz" -C "$fontara_lint_dir" actionlint
+        "$fontara_lint_dir/actionlint" --version
+        printf '%s\n' "$fontara_lint_dir" >> "$GITHUB_PATH"

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tehran
+    open-pull-requests-limit: 5
+    groups:
+      compatible-dependencies:
+        update-types: [minor, patch]
+      security-fixes:
+        applies-to: security-updates
+        patterns: ["*"]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tehran
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/browser-tests.yml

@@ -17,6 +17,8 @@ jobs:
     name: ${{ matrix.label }}
     runs-on: ubuntu-latest
     timeout-minutes: 25
+    env:
+      FONTARA_BROWSER_ARTIFACT_DIR: browser-artifacts
     strategy:
       fail-fast: false
       matrix:
@@ -39,16 +41,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           version: 11.5.0
           run_install: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.x
           cache: pnpm
@@ -59,7 +60,7 @@ jobs:
       - name: Set up Chrome
         if: matrix.browser == 'chrome'
         id: setup-chrome
-        uses: browser-actions/setup-chrome@v2
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2
         with:
           chrome-version: ${{ matrix.version }}
           install-dependencies: true
@@ -71,7 +72,7 @@ jobs:
       - name: Set up Firefox
         if: matrix.browser == 'firefox'
         id: setup-firefox
-        uses: browser-actions/setup-firefox@v1
+        uses: browser-actions/setup-firefox@0bc507ddf224827e3b1af68e014d5e42ab93e795 # v1
         with:
           firefox-version: ${{ matrix.version }}
 
@@ -93,3 +94,11 @@ jobs:
           FONTARA_FIREFOX_BROWSER_TESTS: "1"
           FONTARA_FIREFOX_HEADLESS: "1"
         run: pnpm test:browser:firefox
+      - name: Preserve browser failure diagnostics
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: nightly-browser-failure-${{ matrix.browser }}-${{ matrix.version }}
+          path: browser-artifacts
+          if-no-files-found: ignore
+          retention-days: 14

.github/workflows/ci.yml

@@ -10,6 +10,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   verification:
     uses: ./.github/workflows/verify.yml

.github/workflows/firefox-release.yml

@@ -19,14 +19,15 @@ on:
 permissions:
   contents: read
   actions: read
+  attestations: read
 
 jobs:
   firefox-store:
     if: >-
       github.repository == 'mimalef70/fontara' && github.ref == 'refs/heads/master' &&
       (github.event_name == 'workflow_dispatch' ||
-       (github.event.workflow_run.conclusion == 'success' &&
-        github.event.workflow_run.event == 'push' &&
+       (contains(fromJSON('["success","failure"]'), github.event.workflow_run.conclusion) &&
+        contains(fromJSON('["push","workflow_dispatch"]'), github.event.workflow_run.event) &&
         startsWith(github.event.workflow_run.head_branch, 'v')))
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -39,38 +40,44 @@ jobs:
       AMO_ACTION: ${{ inputs.action || 'submit' }}
     steps:
       - name: Check out trusted publisher code from master
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: master
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.x
       - name: Resolve the verified tag and original release artifact
         id: release
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: node tasks/publish-firefox-store.js --action prepare --metadata "$RUNNER_TEMP/firefox-release.json"
-      - name: Download exact packages from the successful release
-        uses: actions/download-artifact@v8
+      - name: Download exact packages from the verified release milestone
+        if: steps.release.outputs.eligible == 'true' && steps.release.outputs.package_source == 'artifact' && env.AMO_ACTION != 'status'
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           artifact-ids: ${{ steps.release.outputs.artifact_id }}
           path: verified-firefox
           merge-multiple: true
           run-id: ${{ steps.release.outputs.run_id }}
           github-token: ${{ github.token }}
+      - name: Download packages using durable attested release provenance
+        if: steps.release.outputs.eligible == 'true' && steps.release.outputs.package_source == 'release-assets' && env.AMO_ACTION != 'status'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node tasks/publish-firefox-store.js --action download --metadata "$RUNNER_TEMP/firefox-release.json" --directory verified-firefox
       - name: Download the pinned reviewer source supplement when required
-        if: env.AMO_ACTION != 'status' && steps.release.outputs.source_supplement != ''
+        if: steps.release.outputs.eligible == 'true' && env.AMO_ACTION != 'status' && steps.release.outputs.source_supplement != ''
         env:
           GH_TOKEN: ${{ github.token }}
           SOURCE_SUPPLEMENT: ${{ steps.release.outputs.source_supplement }}
         run: gh release download "$AMO_RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --pattern "$SOURCE_SUPPLEMENT" --dir verified-firefox
       - name: Validate production and source archives before authentication
-        if: env.AMO_ACTION != 'status'
+        if: steps.release.outputs.eligible == 'true' && env.AMO_ACTION != 'status'
         run: node tasks/publish-firefox-store.js --action validate --metadata "$RUNNER_TEMP/firefox-release.json" --directory verified-firefox
       - name: Run Mozilla Add-ons operation
         if: >-
-          env.AMO_ACTION != 'validate' &&
+          steps.release.outputs.eligible == 'true' && env.AMO_ACTION != 'validate' &&
           (github.event_name == 'workflow_dispatch' || vars.AMO_AUTO_SUBMIT_ENABLED == 'true')
         env:
           AMO_API_KEY: ${{ secrets.AMO_API_KEY }}

.github/workflows/release.yml

@@ -23,6 +23,37 @@ jobs:
     if: github.event_name == 'push' || inputs.action == 'verify' || inputs.action == 'submit'
     uses: ./.github/workflows/verify.yml
 
+  provenance-check:
+    name: Verify live attestation service without publishing
+    needs: verification
+    if: github.repository == 'mimalef70/fontara' && github.ref == 'refs/heads/master' && github.event_name == 'workflow_dispatch' && inputs.action == 'verify'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        with:
+          node-version: 24.x
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: fontara-verified-packages
+          path: build
+      - name: Prepare a branch-only verification subject
+        run: node tasks/check-release-provenance.js --action prepare
+      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-path: provenance-check.json
+      - name: Verify attestation identity and rejection by production tag policy
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node tasks/check-release-provenance.js --action verify
+
   publish:
     name: Publish verified packages
     needs: verification
@@ -31,27 +62,37 @@ jobs:
     timeout-minutes: 5
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     concurrency:
       group: fontara-release-assets-${{ github.ref_name }}
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.x
       - name: Download the packages tested by verification
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: fontara-verified-packages
           path: build
+      - name: Verify release tag belongs to trusted master
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node tasks/publish-firefox-store.js --action check-tag --tag "$GITHUB_REF_NAME"
       - name: Prepare versioned downloads, integrity checks, and release notes
         env:
           GH_TOKEN: ${{ github.token }}
         run: node tasks/prepare-release-assets.js --tag "$GITHUB_REF_NAME" --commit "$GITHUB_SHA" --directory build --output release-assets --check-existing
+      - name: Attest durable release provenance after all verification gates
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-path: release-assets/release-provenance.json
       - name: Publish GitHub release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           fail_on_unmatched_files: true
           overwrite_files: false
@@ -60,14 +101,16 @@ jobs:
           files: |
             release-assets/*.zip
             release-assets/build-info.json
+            release-assets/fontara-production-dependencies.cdx.json
+            release-assets/release-provenance.json
             release-assets/SHA256SUMS
 
   chrome-store:
     name: Publish to Chrome Web Store
-    needs: verification
+    needs: [verification, publish]
     if: >-
       always() && !cancelled() &&
-      ((needs.verification.result == 'success' &&
+      ((needs.verification.result == 'success' && needs.publish.result == 'success' &&
         (github.event_name == 'push' || inputs.action == 'submit')) ||
        inputs.action == 'status' || inputs.action == 'rollout')
     runs-on: ubuntu-latest
@@ -88,10 +131,10 @@ jobs:
       CWS_DEPLOY_PERCENTAGE: ${{ inputs.deploy_percentage || vars.CWS_DEPLOY_PERCENTAGE || '10' }}
       REQUESTED_DEPLOY_PERCENTAGE: ${{ inputs.deploy_percentage }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.x
       - name: Validate release action and publishing configuration
@@ -114,10 +157,15 @@ jobs:
           done
       - name: Download the exact Chrome package tested by verification
         if: env.CWS_ACTION == 'submit'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: fontara-verified-packages
           path: build
+      - name: Verify publishing tag belongs to trusted master
+        if: env.CWS_ACTION != 'status'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node tasks/publish-firefox-store.js --action check-tag --tag "$GITHUB_REF_NAME"
       - name: Validate the verified ZIP and release tag before authentication
         if: env.CWS_ACTION == 'submit'
         run: node tasks/publish-chrome-store.js --action validate