Prepare ForgeFlow for public release

tests/update-service.test.mjs

@@ -118,7 +118,7 @@ test("update repository parts reject path injection", async () => {
   await rm(temp, { recursive: true, force: true });
 });
 
-test("source updater confirms an external STARTED marker before ForgeFlow may close", async () => {
+test("source updater refuses an unsigned archive before launching a helper", async () => {
   const temp = await mkdtemp(
     path.join(os.tmpdir(), "forgeflow-update-handshake-"),
   );
@@ -181,10 +181,11 @@ test("source updater confirms an external STARTED marker before ForgeFlow may cl
     remoteSha: "a".repeat(40),
     sha256: "b".repeat(64),
   };
-  const result = await service.apply();
-  assert.equal(result.confirmed, true);
-  assert.ok(capturedArgs.includes("-StatusPath"));
-  assert.ok(capturedArgs.includes("-UpdateId"));
+  await assert.rejects(
+    service.apply(),
+    (error) => error.code === "SIGNED_SOURCE_UPDATE_REQUIRED",
+  );
+  assert.equal(capturedArgs, null);
   await rm(temp, { recursive: true, force: true });
 });
 
@@ -710,11 +711,12 @@ test("release manifest verification rejects a different publisher key", () => {
 });
 
 test("Windows release pipeline emits signed provenance, manifest and SBOM evidence", async () => {
-  const [pkgSource, signatureSource, checksumSource, manifestSigner] = await Promise.all([
+  const [pkgSource, signatureSource, checksumSource, manifestSigner, releaseWorkflow] = await Promise.all([
     readFile(new URL("../package.json", import.meta.url), "utf8"),
     readFile(new URL("../scripts/verify-release-signatures.mjs", import.meta.url), "utf8"),
     readFile(new URL("../scripts/write-release-checksums.mjs", import.meta.url), "utf8"),
     readFile(new URL("../scripts/sign-release-manifest.mjs", import.meta.url), "utf8"),
+    readFile(new URL("../.gitea/workflows/release.yml", import.meta.url), "utf8"),
   ]);
   assert.match(pkgSource, /verify-release-signatures\.mjs/);
   assert.match(signatureSource, /FORGEFLOW_SIGNED_RELEASE/);
@@ -729,6 +731,16 @@ test("Windows release pipeline emits signed provenance, manifest and SBOM eviden
   assert.match(manifestSigner, /Ed25519/);
   assert.match(manifestSigner, /release-manifest\.json/);
   assert.match(pkgSource, /sign-release-manifest\.mjs/);
+  assert.doesNotMatch(releaseWorkflow, /checkout@v\d|setup-node@v\d/);
+  assert.match(releaseWorkflow, /checkout@[a-f0-9]{40}/);
+  assert.match(releaseWorkflow, /setup-node@[a-f0-9]{40}/);
+  assert.ok(
+    releaseWorkflow.indexOf("Validate version bump and build release artifacts") <
+      releaseWorkflow.indexOf("FORGEFLOW_RELEASE_SIGNING_KEY_PEM"),
+    "signing secrets must not be present during dependency installation and quality checks",
+  );
+  assert.match(releaseWorkflow, /finally \{/);
+  assert.match(releaseWorkflow, /Remove-Item -LiteralPath \$privateKeyPath -Force/);
   const publisher = await readFile(new URL("../scripts/publish-binary-release.cjs", import.meta.url), "utf8");
   assert.match(publisher, /draft: true/);
   assert.match(publisher, /requiredAssets/);