release: v0.44.0-beta.2 promotion evidence (do not merge)

.githooks/pre-commit

@@ -1,13 +1,15 @@
 #!/bin/sh
 #
-# openElement pre-commit hook.
-# AutoFlow3 is the single local gate controller; this tier stays fast and
-# delegates gate policy to tools/autoflow/policy.ts.
+# openElement pre-commit hook. Format/lint are owned by the Deno toolchain
+# directly (ADR-0144, #1229); AutoFlow3 keeps only OE-specific dev-tier gates.
 #
 # Install: deno task hooks:install
 
 set -e
 
+deno fmt --check
+deno lint
+
 echo "[autoflow:dev] pre-commit"
 deno task autoflow:dev || {
   echo ""

.githooks/pre-push

@@ -1,13 +1,20 @@
 #!/bin/sh
 #
-# openElement pre-push hook.
-# AutoFlow3 owns the push tier gate selection.
+# openElement pre-push hook. Format/lint/type-graph/Markdown are owned by the
+# pinned OSS tools directly (ADR-0144, #1229); AutoFlow3 owns only the
+# OE-specific push-tier gate selection.
 #
 # Install: deno task hooks:install
 
 set -e
 
 BRANCH=$(git rev-parse --abbrev-ref HEAD)
+
+deno fmt --check
+deno lint
+deno task lint:markdown
+deno task typecheck
+
 echo "=== pre-push: autoflow:push for '$BRANCH' ==="
 
 deno task autoflow:push || {

.github/dependabot.yml

@@ -4,4 +4,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      # zizmor dependabot-cooldown (#1156 B2.6): let fresh action releases
+      # bake for a week before Dependabot proposes them.
+      default-days: 7
     open-pull-requests-limit: 5

.github/workflows/autoflow-ci.yml

@@ -40,13 +40,62 @@ jobs:
           # never checkout's default synthetic merge ref.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
+          persist-credentials: false
+      # #1156 (B2.6): mature OSS governance gates (ADR-0144) — fail fast,
+      # before the heavy matrix. Binaries pinned by version + SHA-256;
+      # zizmor-action pinned in tools/check-action-pins.ts.
+      - name: actionlint (workflow lint)
+        run: |
+          curl -sSfL -o /tmp/actionlint.tar.gz \
+            https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
+          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  /tmp/actionlint.tar.gz" | sha256sum -c -
+          tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint
+          /tmp/actionlint -color
+      # v0.6.3
+      - uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99
+        with:
+          # Offline audits only: this gate must be deterministic and
+          # reproducible locally (`zizmor --offline .github/workflows
+          # .github/actions`); network-dependent audits stay out of CI.
+          online-audits: false
+          advanced-security: false
+          version: '1.30.0'
+      - name: gitleaks (secret scan)
+        run: |
+          curl -sSfL -o /tmp/gitleaks.tar.gz \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
+          /tmp/gitleaks git --redact --verbose .
       - uses: ./.github/actions/setup-deno-workspace
+      # ADR-0144 / #1229 (B2.7): generic toolchain gates are pinned OSS tool steps, not AutoFlow gates.
+      - run: deno fmt --check
+      - run: deno lint
+      - run: deno task lint:markdown
+      - run: deno task typecheck
       - name: Install Playwright browsers
         # All three engines up front: the gate's fixture:request-time:gate
         # runs the request-time fixture suite on Chromium, Firefox and WebKit.
         run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit
       - name: AutoFlow3 CI gate
         run: deno task autoflow:ci
+      # #1232 (B2.10): e2e failures must be inspectable — the 'github'
+      # reporter annotates the run inline, and this step publishes the
+      # Playwright HTML report + per-test traces/screenshots on failure.
+      - name: Upload Playwright failure artifacts
+        if: failure()
+        # v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: playwright-failure-artifacts-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            www/e2e/test-results
+            www/e2e/playwright-report
+            e2e/starter-smoke/test-results
+            packages/adapter-vite/__fixtures__/request-time/e2e/test-results
+            packages/adapter-vite/__fixtures__/ui-dogfood/e2e/test-results
+          if-no-files-found: ignore
+          retention-days: 14
 
   # Issue #628 (first slice): the generated dist/server artifact must boot
   # under plain Node, not just under the Deno CLI (#969). The runtime floor
@@ -66,6 +115,7 @@ jobs:
         with:
           # #1156 R11: same exact-SHA expression as every required job.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-deno-workspace
       # v7.0.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
@@ -96,7 +146,7 @@ jobs:
             OPEN_ELEMENT_PORT=4891 OPEN_ELEMENT_HOST=127.0.0.1 node dist/server/serve.mjs &
             server_pid=$!
             trap 'kill $server_pid 2>/dev/null || true' EXIT
-            for i in $(seq 1 50); do
+            for _ in $(seq 1 50); do
               curl -sf -o /dev/null http://127.0.0.1:4891/ && break
               sleep 0.2
             done
@@ -127,6 +177,7 @@ jobs:
         with:
           # #1156 R11: same exact-SHA expression as every required job.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-deno-workspace
       # v7.0.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
@@ -135,6 +186,45 @@ jobs:
       - name: Workspace runtime qualification (Node 24 + workerd)
         run: deno task fullstack:workspace-qualification
 
+  # #1228 (B2.5): the deployment guide and PACKAGE_SURFACE.md claim the
+  # generated dist/server artifacts run on Bun. A claim that survives only on
+  # local evidence is an overclaim, so the same fixture the Node legs serve is
+  # booted under a pinned Bun here: real server, real HTTP probes.
+  bun-serve-smoke:
+    name: dist/server Bun smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          # #1156 R11: same exact-SHA expression as every required job.
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: ./.github/actions/setup-deno-workspace
+      - name: Install Bun 1.4.1 (version + SHA-256 pinned)
+        run: |
+          curl -sSfL -o /tmp/bun.zip \
+            https://github.com/oven-sh/bun/releases/download/bun-v1.4.1/bun-linux-x64.zip
+          echo "74c1c3bee7cd998500c8f969cd8972355ac6a07207e94a39eece1999b56ffabf  /tmp/bun.zip" | sha256sum -c -
+          unzip -q /tmp/bun.zip -d /tmp/bun
+          echo "/tmp/bun/bun-linux-x64" >> "$GITHUB_PATH"
+      - name: Build the request-time fixture
+        run: deno task fixture:request-time:build
+      - name: Boot dist/server/serve.mjs under Bun
+        working-directory: packages/adapter-vite/__fixtures__/request-time
+        run: |
+          set -u
+          OPEN_ELEMENT_PORT=4893 OPEN_ELEMENT_HOST=127.0.0.1 bun dist/server/serve.mjs &
+          server_pid=$!
+          trap 'kill $server_pid 2>/dev/null || true' EXIT
+          for _ in $(seq 1 50); do
+            curl -sf -o /dev/null http://127.0.0.1:4893/ && break
+            sleep 0.2
+          done
+          curl -sf http://127.0.0.1:4893/ | grep -q 'request-time fixture home'
+          curl -sf http://127.0.0.1:4893/live | grep -q 'request-time live'
+
   # #1156 (ADR-0146): one deterministic exact-SHA PR full-CI evidence artifact.
   # This job runs only for pull requests and only after every required
   # full-matrix job succeeded (default needs gating — no `if: always()`), so a
@@ -145,7 +235,13 @@ jobs:
   pr-full-ci-evidence:
     name: pr-full-ci-evidence
     if: github.event_name == 'pull_request'
-    needs: [dependency-review, autoflow-ci, node-serve-smoke, workspace-qualification]
+    needs: [
+      dependency-review,
+      autoflow-ci,
+      node-serve-smoke,
+      bun-serve-smoke,
+      workspace-qualification,
+    ]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
@@ -156,6 +252,7 @@ jobs:
         with:
           # #1156 R11: the aggregation job checks out the exact SHA it attests.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-deno-workspace
       - name: Write exact-SHA PR CI evidence record
         env:

.github/workflows/autoflow-release.yml

@@ -26,6 +26,9 @@ jobs:
     timeout-minutes: 120
     permissions:
       contents: write
+      # npm Trusted Publishing/OIDC (#1187): id-token is the ONLY npm
+      # credential. Requires per-package trusted-publisher registration on
+      # npmjs.com first — see docs/runbooks/npm-trusted-publishing.md.
       id-token: write
       # #997 / ADR-0134: the release-tier fullstack:evidence-freshness gate
       # reads the run history (scheduled and workflow_dispatch) of the
@@ -34,7 +37,7 @@ jobs:
       actions: read
     steps:
       # v7.0.1
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # zizmor: ignore[artipacked] the release lane pushes the immutable release tag with this credential (tools/autoflow/release.ts); every other workflow sets persist-credentials: false
         with:
           ref: main
           fetch-depth: 0
@@ -44,7 +47,25 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: '22'
+          # Registry config only (provenance + publish target); auth comes
+          # exclusively from npm Trusted Publishing/OIDC (#1187).
           registry-url: 'https://registry.npmjs.org'
+      - name: Upgrade npm CLI for Trusted Publishing
+        # #1187 (Beta.2 slice, B2.12): publication authenticates via npm
+        # Trusted Publishing. The npm CLI performs the GitHub Actions OIDC
+        # exchange natively only from 11.5.1; Node 22's bundled npm is older,
+        # and switching the whole release lane to Node 24 would still leave
+        # the floor to whatever npm that image bundles, so the floor is
+        # pinned explicitly here and verified before publish runs.
+        run: | # zizmor: ignore[adhoc-packages] the npm floor is pinned and asserted immediately below; trusted publishing requires it
+          npm install -g "npm@^11.5.1"
+          actual="$(npm --version)"
+          minimum="11.5.1"
+          if [ "$(printf '%s\n%s\n' "$minimum" "$actual" | sort -V | head -n1)" != "$minimum" ]; then
+            echo "npm CLI $actual is below the Trusted Publishing floor $minimum"
+            exit 1
+          fi
+          echo "npm CLI $actual satisfies the Trusted Publishing floor ($minimum)"
       - name: Install Playwright browsers
         # All three engines: the release tier includes fixture:request-time:gate,
         # which runs the request-time fixture suite on Chromium, Firefox and
@@ -54,12 +75,6 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-      - name: Configure npm auth
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > "$HOME/.npmrc"
-          echo "registry=https://registry.npmjs.org/" >> "$HOME/.npmrc"
       - name: Download the exact named PR CI evidence artifact
         # #1156 (ADR-0146): publication fails closed unless the exact-SHA PR
         # full-CI record, produced by the named source run for the exact HEAD
@@ -82,12 +97,20 @@ jobs:
             exit 1
           fi
       - name: Publish version already merged to main
+        # PRECONDITION (#1187, maintainer web action, cannot be done in-repo):
+        # each of the five @openelement packages (element, app, adapter-vite,
+        # create, ui) must have this repo's GitHub Actions trusted publisher
+        # registered on npmjs.com — repo open-element/openelement, workflow
+        # filename autoflow-release.yml, no environment. See
+        # docs/runbooks/npm-trusted-publishing.md. Until that registration
+        # exists, this step fails at npm with an auth error; there is NO
+        # token fallback by design (the long-lived npm token path is removed).
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_VERSION: ${{ inputs.version }}
           RELEASE_DRY_RUN: ${{ inputs.dry_run && '--dry-run' || '' }}
           PR_CI_EVIDENCE: .artifacts/pr-ci/pr-full-ci-evidence.json
         run: |
+          # shellcheck disable=SC2086 # RELEASE_DRY_RUN is intentionally
+          # word-split: it is either empty or the single flag --dry-run.
           deno task autoflow:publish-existing --to "$RELEASE_VERSION" --pr-ci "$PR_CI_EVIDENCE" $RELEASE_DRY_RUN

.github/workflows/codeql.yml

@@ -36,18 +36,20 @@ jobs:
       - name: Checkout repository
         # v7.0.1
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        # v4.37.6
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3
+        # v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938
         with:
           languages: ${{ matrix.language }}
           # Deno project: no build step needed for TS source analysis
           # CodeQL JS/TS extractor works on raw source files
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        # v4.37.6
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3
+        # v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/fullstack-deploy-smoke.yml

@@ -62,6 +62,8 @@ jobs:
     steps:
       # v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-deno-workspace
 
       - name: Build the Workers bundle
@@ -187,7 +189,7 @@ jobs:
           set -e
           mkdir -p .smoke
           record() { echo "{\"check\":\"$1\",\"result\":\"$2\"}" >> .smoke/results.jsonl; }
-          for i in 1 2 3 4 5 6; do
+          for _ in 1 2 3 4 5 6; do
             code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 "$WORKER_URL/" || true)
             [ "$code" = "200" ] && break
             sleep 10
@@ -336,6 +338,8 @@ jobs:
           eicar_name="scanner-eicar-$suffix.txt"
           printf 'OpenElement scanner qualification clean fixture.\n' > "$clean_file"
           # Standard EICAR test string, generated only in the ephemeral runner.
+          # shellcheck disable=SC2016 # the single-quoted EICAR signature must
+          # not expand its $ sequences.
           printf '%s' 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > "$eicar_file"
           for fixture in clean eicar; do
             name_var="${fixture}_name"; file_var="${fixture}_file"
@@ -415,6 +419,10 @@ jobs:
         if: always()
         env:
           WORKER_URL: https://openelement-ref-starter.freemanzheng.workers.dev
+        # zizmor: ignore[template-injection] every expansion below is
+        # GitHub-controlled context (job.status, github.run_id,
+        # steps.*.outcome) — no attacker-controllable input reaches this
+        # report writer.
         run: |
           checks='[]'
           if [ -f .smoke/results.jsonl ]; then

.github/workflows/nightly-stress.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
       # v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-deno-workspace
       - name: Run representative 30-minute workload
         env:

.github/workflows/published-consumers.yml

@@ -22,6 +22,8 @@ jobs:
     steps:
       # v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-deno-workspace
       - name: Generate and exercise the published starter
         env:
@@ -45,6 +47,8 @@ jobs:
     steps:
       # v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-deno-workspace
       - name: Install Chromium for browser-backed consumer smoke
         run: ./node_modules/.bin/playwright install --with-deps chromium