Prepare ForgeFlow for public release

.gitea/workflows/chatgpt-validation.yml

@@ -10,8 +10,8 @@ jobs:
   quality:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -21,7 +21,7 @@ jobs:
       - run: npm run test:browser:ci
       - name: Preserve browser failure evidence
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: forgeflow-browser-failure-evidence
           path: artifacts/

.gitea/workflows/quality.yml

@@ -9,7 +9,7 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Secret scan
         shell: bash
         run: |
@@ -23,8 +23,8 @@ jobs:
     # Browser quality runs against the dedicated bounded Windows 11 VM runner.
     runs-on: windows-native
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
-      - uses: https://gitea.com/actions/setup-node@v4
+      - uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: https://gitea.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -38,7 +38,7 @@ jobs:
       - run: npm run test:browser:ci
       - name: Preserve browser failure evidence
         if: failure()
-        uses: https://gitea.com/actions/upload-artifact@v3.2.2-node20
+        uses: https://gitea.com/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: forgeflow-browser-failure-evidence
           path: artifacts/

.gitea/workflows/release.yml

@@ -15,23 +15,17 @@ jobs:
   release:
     runs-on: windows-native
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 2
-      - uses: https://gitea.com/actions/setup-node@v4
+      - uses: https://gitea.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
-      - name: Build, sign and publish version bump
+      - name: Validate version bump and build release artifacts
         shell: powershell
         env:
           GITEA_EVENT_NAME: ${{ gitea.event_name }}
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          FORGEFLOW_RELEASE_BASE_URL: ${{ gitea.server_url }}
-          FORGEFLOW_RELEASE_OWNER: Jens
-          FORGEFLOW_RELEASE_REPO: ForgeFlow
-          FORGEFLOW_RELEASE_BRANCH: main
-          FORGEFLOW_RELEASE_SIGNING_KEY_PEM: ${{ secrets.FORGEFLOW_RELEASE_SIGNING_KEY_PEM }}
         run: |
           $ErrorActionPreference = "Stop"
           Set-StrictMode -Version Latest
@@ -56,25 +50,6 @@ jobs:
             throw "ForgeFlow version '$version' is not a stable semantic version."
           }
 
-          if ($env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM) {
-            $privateKeyPath = Join-Path $env:RUNNER_TEMP "forgeflow-release-signing-private.pem"
-            $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
-            [System.IO.File]::WriteAllText($privateKeyPath, $env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM, $utf8NoBom)
-            $env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY = $privateKeyPath
-          }
-
-          $effectiveKeyPath = if ($env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY) {
-            $env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY
-          } else {
-            Join-Path $env:APPDATA "forgeflow\release-signing-private.pem"
-          }
-          if (-not (Test-Path -LiteralPath $effectiveKeyPath)) {
-            throw "ForgeFlow release signing key is not provisioned for the windows-native runner. Provision the existing Ed25519 private key as FORGEFLOW_RELEASE_SIGNING_KEY_PEM or at $effectiveKeyPath."
-          }
-          if (-not $env:GITEA_TOKEN) {
-            throw "Gitea Actions did not provide GITEA_TOKEN to the release job."
-          }
-
           & cmd.exe /d /s /c "npm ci --no-audit --no-fund"
           if ($LASTEXITCODE -ne 0) { throw "npm ci failed." }
           & cmd.exe /d /s /c "npx electron --version"
@@ -87,9 +62,47 @@ jobs:
           if ($LASTEXITCODE -ne 0) { throw "ForgeFlow browser acceptance suite failed." }
           & cmd.exe /d /s /c "npm audit --omit=dev --audit-level=high"
           if ($LASTEXITCODE -ne 0) { throw "ForgeFlow production dependency audit failed." }
-          & cmd.exe /d /s /c "npm run dist:win"
-          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Windows build/signing failed." }
-          & cmd.exe /d /s /c "npm run release:binary"
-          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Gitea release publication failed." }
+          & cmd.exe /d /s /c "npx electron-builder --win nsis portable"
+          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Windows build failed." }
+          & node scripts/write-release-checksums.mjs
+          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow checksum generation failed." }
 
-          Write-Host "ForgeFlow $version was fully validated, built, signed and published from exact main HEAD $env:GITEA_SHA."
+      - name: Sign and publish validated artifacts
+        shell: powershell
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          FORGEFLOW_RELEASE_BASE_URL: ${{ gitea.server_url }}
+          FORGEFLOW_RELEASE_OWNER: Jens
+          FORGEFLOW_RELEASE_REPO: ForgeFlow
+          FORGEFLOW_RELEASE_BRANCH: main
+          FORGEFLOW_RELEASE_SIGNING_KEY_PEM: ${{ secrets.FORGEFLOW_RELEASE_SIGNING_KEY_PEM }}
+        run: |
+          $ErrorActionPreference = "Stop"
+          Set-StrictMode -Version Latest
+          $privateKeyPath = Join-Path $env:RUNNER_TEMP "forgeflow-release-signing-private.pem"
+          try {
+            if (-not $env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM) {
+              throw "FORGEFLOW_RELEASE_SIGNING_KEY_PEM is not configured."
+            }
+            if (-not $env:GITEA_TOKEN) {
+              throw "GITEA_TOKEN is not configured."
+            }
+            $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+            [System.IO.File]::WriteAllText($privateKeyPath, $env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM, $utf8NoBom)
+            $env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY = $privateKeyPath
+            & node scripts/sign-release-manifest.mjs
+            if ($LASTEXITCODE -ne 0) { throw "ForgeFlow manifest signing failed." }
+            & node scripts/verify-release-signatures.mjs
+            if ($LASTEXITCODE -ne 0) { throw "ForgeFlow release signature verification failed." }
+            & node scripts/prune-dist.mjs
+            if ($LASTEXITCODE -ne 0) { throw "ForgeFlow artifact pruning failed." }
+            & .\node_modules\.bin\electron.cmd scripts/publish-binary-release.cjs
+            if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Gitea release publication failed." }
+          } finally {
+            $env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY = $null
+            if (Test-Path -LiteralPath $privateKeyPath) {
+              Remove-Item -LiteralPath $privateKeyPath -Force
+            }
+          }
+
+          Write-Host "ForgeFlow artifacts were signed and published from exact main HEAD $env:GITEA_SHA."