From 0c1f473436ea9faef0426ea6b7c140e599848581 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Sun, 30 Aug 2026 00:47:56 +0200
Subject: [PATCH] Gate releases on the complete Windows quality suite

---
 .gitea/workflows/release.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index d8986a1..35f093c 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -79,11 +79,17 @@ jobs:
           if ($LASTEXITCODE -ne 0) { throw "npm ci failed." }
           & cmd.exe /d /s /c "npx electron --version"
           if ($LASTEXITCODE -ne 0) { throw "Electron preflight failed." }
-          & cmd.exe /d /s /c "npm run check"
+          & cmd.exe /d /s /c "npm run quality"
           if ($LASTEXITCODE -ne 0) { throw "ForgeFlow release quality gate failed." }
+          & cmd.exe /d /s /c "npx playwright install chromium"
+          if ($LASTEXITCODE -ne 0) { throw "Playwright Chromium installation failed." }
+          & cmd.exe /d /s /c "npm run test:browser:ci"
+          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow browser acceptance suite failed." }
+          & cmd.exe /d /s /c "npm audit --omit=dev --audit-level=high"
+          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow production dependency audit failed." }
           & cmd.exe /d /s /c "npm run dist:win"
           if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Windows build/signing failed." }
           & cmd.exe /d /s /c "npm run release:binary"
           if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Gitea release publication failed." }
 
-          Write-Host "ForgeFlow $version was built, signed and published from exact main HEAD $env:GITEA_SHA."
+          Write-Host "ForgeFlow $version was fully validated, built, signed and published from exact main HEAD $env:GITEA_SHA."