Harden planning, evidence handling and release verification

.github/dependabot.yml

@@ -21,6 +21,24 @@ updates:
       - dependency-name: "@types/node"
         update-types:
           - version-update:semver-major
+  - package-ecosystem: npm
+    directory: /tools/npm-toolchain
+    versioning-strategy: lockfile-only
+    schedule:
+      interval: weekly
+      day: monday
+      time: "20:00"
+      timezone: Australia/Melbourne
+    open-pull-requests-limit: 2
+    groups:
+      package-manager-runtime:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/ci.yml

@@ -26,7 +26,11 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
-          cache: npm
+          package-manager-cache: false
+
+      - name: Restore the reviewed package-manager toolchain
+        id: toolchain
+        run: node tools/bootstrap-npm.ts
 
       - name: Install locked dependencies
         run: npm ci
@@ -73,7 +77,11 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
-          cache: npm
+          package-manager-cache: false
+
+      - name: Restore the reviewed package-manager toolchain
+        id: toolchain
+        run: node tools/bootstrap-npm.ts
 
       - name: Install locked dependencies
         run: npm ci

.github/workflows/codeql.yml

@@ -24,9 +24,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialise CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: javascript-typescript
 
       - name: Analyse source
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

.github/workflows/pages.yml

@@ -19,35 +19,69 @@ concurrency:
 
 jobs:
   build:
-    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main')
+    if: (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main')
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
     env:
       CONTROLCURRENT_DEPLOY_TARGET: github-pages
     permissions:
       contents: read
       pages: read
+      actions: read
+    outputs:
+      release_sha: ${{ steps.release.outputs.sha }}
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
-          cache: npm
+          package-manager-cache: false
+
+      - name: Require current verified release
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_SHA: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+          GATE_WAIT_SECONDS: "600"
+        run: node tools/publication-gate.ts
 
       - name: Configure Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
+      - name: Restore the reviewed package-manager toolchain
+        id: toolchain
+        run: node tools/bootstrap-npm.ts
+
       - name: Install locked dependencies
         run: npm ci
 
       - name: Verify and build
         run: npm run verify
 
+      - name: Audit dependencies for manual publication
+        if: github.event_name == 'workflow_dispatch'
+        run: npm audit --audit-level=high
+
+      - name: Install the locked Chromium browser for manual publication
+        if: github.event_name == 'workflow_dispatch'
+        run: npm run test:e2e:install:ci
+
+      - name: Run browser and accessibility tests for manual publication
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          CONTROLCURRENT_DEPLOY_TARGET: ""
+        run: npm run test:e2e
+
+      - name: Restore and audit the publication build after browser fixtures
+        if: github.event_name == 'workflow_dispatch'
+        run: npm run build && npm run audit:public
+
       - name: Upload Pages artifact
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
@@ -61,9 +95,32 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
+      contents: read
+      actions: read
       pages: write
       id-token: write
     steps:
+      - name: Check out the release guard only
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.build.outputs.release_sha }}
+          persist-credentials: false
+          sparse-checkout: tools/publication-gate.ts
+          sparse-checkout-cone-mode: false
+
+      - name: Set up the guard runtime without dependency caching
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          package-manager-cache: false
+
+      - name: Recheck current release immediately before deployment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_SHA: ${{ needs.build.outputs.release_sha }}
+          GATE_WAIT_SECONDS: "0"
+        run: node tools/publication-gate.ts
+
       - name: Deploy Pages artifact
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/source-review.yml

@@ -24,9 +24,13 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
-          cache: npm
+          package-manager-cache: false
           registry-url: https://registry.npmjs.org
 
+      - name: Restore the reviewed package-manager toolchain
+        id: toolchain
+        run: node tools/bootstrap-npm.ts
+
       - name: Install locked dependencies
         run: npm ci
 
@@ -39,7 +43,7 @@ jobs:
         run: npm outdated @mdn/browser-compat-data web-features --json > source-review.json
 
       - name: Summarise source review
-        if: always()
+        if: always() && steps.toolchain.outcome == 'success'
         run: npm run source-review:summary -- source-review.json >> "$GITHUB_STEP_SUMMARY"
 
       - name: Require review when an update is available

.github/workflows/update-dry-run.yml

@@ -22,9 +22,13 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
-          cache: npm
+          package-manager-cache: false
           registry-url: https://registry.npmjs.org
 
+      - name: Restore the reviewed package-manager toolchain
+        id: toolchain
+        run: node tools/bootstrap-npm.ts
+
       - name: Install locked dependencies
         run: npm ci
 

README.md

@@ -55,6 +55,8 @@ checker or certification service.
 - Save a browser plan locally or export it as JSON.
 - Opt in to remembering one result so a later data update can be compared.
 - Compare an exported result with a newer result from the same source version.
+- Read exact source versions, package timestamps and local package age beside
+  both planning workflows.
 
 ### Record an engineering decision
 
@@ -130,8 +132,8 @@ boundary.
 
 The current selected dataset is generated from:
 
-- `@mdn/browser-compat-data` 8.0.8;
-- `web-features` 3.34.2; and
+- `@mdn/browser-compat-data` 8.1.4;
+- `web-features` 3.40.1; and
 - exact Web Platform Tests suite paths pinned to revision
   `af38980d2fcd74af19a226f5f651051cc15940ed`.
 
@@ -149,10 +151,12 @@ third-party notices for attribution and licence details.
 Requirements:
 
 - Node.js 24.15 or a compatible later supported release;
-- npm 11.17–12; and
+- the reviewed npm 12.2.0 runtime reconstructed from its separate lock; and
 - dependencies installed from the committed lockfile.
 
 ```bash
+node tools/bootstrap-npm.ts
+# Apply the PATH export printed after a successful bootstrap.
 npm ci
 npm run dev
 ```
@@ -164,6 +168,13 @@ npm run build
 npm run preview
 ```
 
+The bootstrap downloads only reviewed registry archives and checks integrity,
+the toolchain audit and registry signatures before activation. It does not
+modify global npm or execute the upstream bundled dependencies. Ordinary tests
+remain fixture-only; bootstrap and signature checks require registry access.
+See [dependency policy](docs/dependency-policy.md) for the separate runtime lock
+and host trust assumptions.
+
 ## Verification
 
 The main local verification command runs linting, formatting checks, strict
@@ -209,7 +220,13 @@ edit the lockfile, selected data, source history, repository or deployment.
 
 The public site is suitable for static GitHub Pages hosting. It needs no
 runtime secret, server or database. Changes to `main` deploy only after the
-complete CI workflow succeeds.
+complete CI and CodeQL workflows succeed for the exact current `main` commit.
+Both automatic and manual publication recheck that commit immediately before
+deployment. The [dependency policy](docs/dependency-policy.md) records the
+reviewed, separately locked package-manager reconstruction and its trust
+assumptions. Complete checks on the corrected revision and eventual exact-main
+release remain required; a clean application dependency audit or verified
+signatures do not prove that build-tool code is benign or vulnerability-free.
 
 GitHub Pages does not apply the generated `_headers` file, so the current public
 site relies on its restrictive meta Content Security Policy and framing guard.
@@ -218,6 +235,8 @@ with organisation-specific evidence.
 
 ## Documentation
 
+- [PR32 optional follow-up and local validation](docs/pr32-optional-follow-up.md)
+
 - [Architecture](docs/architecture.md)
 - [Data contract](docs/data-contract.md)
 - [Methodology](docs/methodology.md)