Capture the reviewed implementation and manual rehearsal for draft PR review. Master source prerequisites, full clean verification and coordinated Windows CI remain open; production rollout is separate.
The notify-slack job checked only check, e2e, and publish-npm but
missed version and github-release from its needs list. A failure in
either would show a green notification and skip #alerting.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- .github/workflows/ci.yml: add e2e + e2e-windows jobs with Resend secrets,
extend check-windows with build:binary + smoke tests
- docs/reference/platform-support.md: update CI testing table to match reality
- context/changes/e2e/plan.md: mark phase 5 automated steps complete
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Switch Windows CI job to native PowerShell with Get-ChildItem for test
file enumeration (no glob expansion needed). Add platform-support
reference doc for learners.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PowerShell does not expand glob patterns — use Git Bash (available on
all GitHub Actions Windows runners) so tests/*.test.ts resolves.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PowerShell does not expand bare globs — bun test needs ./tests/*.test.ts
to resolve the path on Windows runners.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move version bump, binary builds, npm publish, and GitHub release from a
separate workflow_run-triggered release.yml into ci.yml gated behind
`github.ref == 'refs/heads/master'`. All jobs now appear in a single
workflow run on the commit in the GitHub UI.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The release workflow silently skipped every release because auto-version.mjs
imported conventional-recommended-bump which was never in devDependencies.
The error handler treated the import crash as "no bump needed." Now the
dependency is installed and the bump step distinguishes expected skip (exit 1)
from real crashes (any other non-zero exit).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Auto-version from conventional commits (auto-version.mjs) with git-diff
gate: only releases when src/ or package.json actually changed
- 5-platform binary builds (linux x64/arm64, macOS x64/arm64, windows)
- npm publish with auth token wiring
- GitHub Release with auto-generated notes and binary attachments
- Smoke tests for package tarball and auto-version script
- Hardened: top-level permissions: {}, env bindings (no expression injection),
persist-credentials only where needed for git push
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Pin GitHub Actions by full SHA to prevent tag-swapping attacks
- Add .npmrc with ignore-scripts and 7-day minimum-release-age quarantine
- Add 30s default request timeout for API calls without caller signal
- Remove unused `open` dependency to reduce attack surface
- Strip OpenAPI source URL from generated types header
- Add SECURITY.md documenting threat model (T1–T8), review history, and
design decisions
- Add persist-credentials: false to checkout action
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Claude