feat(release): centralize and harden artifact publishing

.bun-version

@@ -1 +1 @@
-1.3.9
+1.3.14

.github/workflows/codeql.yml

@@ -13,15 +13,25 @@ permissions:
   contents: read
   security-events: write
 
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze JavaScript and TypeScript
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-      - uses: github/codeql-action/init@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3
         with:
           languages: javascript-typescript
 
-      - uses: github/codeql-action/analyze@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3
+      - name: Analyze repository
+        uses: github/codeql-action/analyze@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3

.github/workflows/dependency-review.yml

@@ -8,15 +8,23 @@ permissions:
   contents: read
   pull-requests: read
 
+concurrency:
+  group: dependency-review-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   dependency-review:
     name: Review dependency changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4
-        continue-on-error: true
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4
         with:
           fail-on-severity: high
           license-check: false

.github/workflows/release-please.yml

@@ -5,80 +5,213 @@ on:
     branches:
       - main
 
+permissions: {}
+
+concurrency:
+  group: release-please
+  cancel-in-progress: false
+
 jobs:
   release-please:
-    runs-on: ubuntu-latest
+    name: Prepare release
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     permissions:
       contents: write
       pull-requests: write
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
+
     steps:
-      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
+      - name: Prepare release
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
-  release-artifacts:
-    name: Build and publish release artifacts
-    runs-on: ubuntu-latest
+  release-matrix:
+    name: Resolve release matrix
+    needs: [release-please, verify-release]
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+
+    steps:
+      - name: Check out released revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .bun-version
+
+      - name: Export typed release matrix
+        id: matrix
+        run: echo "matrix=$(bun run cli/scripts/release.ts matrix)" >> "$GITHUB_OUTPUT"
+
+  release-native:
+    name: Build and test release binary (${{ matrix.artifact }})
+    needs: [release-please, verify-release, release-matrix]
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.release-matrix.outputs.matrix) }}
+
+    steps:
+      - name: Check out released revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .bun-version
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        working-directory: cli
+
+      - name: Verify release contract
+        run: bun run release:verify --tag=${{ needs.release-please.outputs.tag_name }}
+        working-directory: cli
+
+      - name: Compile release binary
+        run: bun run release:build --target=${{ matrix.target }}
+        working-directory: cli
+
+      - name: Smoke test release binary
+        run: bun run release:smoke --target=${{ matrix.target }}
+        working-directory: cli
+
+      - name: Upload tested release binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-${{ matrix.artifact }}
+          path: dist/${{ matrix.artifact }}
+          if-no-files-found: error
+          retention-days: 30
+
+  verify-release:
+    name: Canonical release verification
     needs: release-please
-    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    if: needs.release-please.outputs.release_created == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/verify.yml
+    with:
+      ref: ${{ needs.release-please.outputs.tag_name }}
+
+  release-artifacts:
+    name: Verify, attest, and publish release
+    needs: [release-please, release-native]
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
     permissions:
       artifact-metadata: write
       attestations: write
       contents: write
       id-token: write
+
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Check out released revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ needs.release-please.outputs.tag_name }}
+          submodules: recursive
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Install Node.js for npm provenance
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .node-version
           registry-url: "https://registry.npmjs.org"
 
-      - name: Log build environment
-        run: bun --version
-
-      - name: Build CLI bundle
-        run: |
-          cd cli
-          bun install --frozen-lockfile
-          bun run build
-
-      - name: Compile release binaries
-        run: |
-          mkdir -p dist
-          cd cli
-          bun build --compile --target=bun-darwin-arm64 src/cli.ts --outfile ../dist/altertable-darwin-arm64
-          bun build --compile --target=bun-darwin-x64 src/cli.ts --outfile ../dist/altertable-darwin-x64
-          bun build --compile --target=bun-linux-x64 src/cli.ts --outfile ../dist/altertable-linux-x64
-          bun build --compile --target=bun-linux-arm64 src/cli.ts --outfile ../dist/altertable-linux-arm64
-          cp dist/cli.js ../dist/altertable-cli.js
-          cd ../dist && shasum -a 256 altertable-darwin-* altertable-linux-* altertable-cli.js > checksums.txt
-
-      - name: Attest release assets
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        working-directory: cli
+
+      - name: Verify release tag and toolchain
+        run: bun run release:verify --tag=${{ needs.release-please.outputs.tag_name }}
+        working-directory: cli
+
+      - name: Download tested release binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: release-altertable-*
+          path: dist
+          merge-multiple: true
+
+      - name: Build JavaScript release bundle
+        run: bun run release:build --bundle
+        working-directory: cli
+
+      - name: Finalize exact release artifacts
+        run: bun run release:finalize --tag=${{ needs.release-please.outputs.tag_name }}
+        working-directory: cli
+
+      - name: Smoke test npm bundle on release toolchain
+        run: bun run scripts/smoke-npm-bundle.ts
+        working-directory: cli
+
+      - name: Install minimum supported npm runtime
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.1.0
+
+      - name: Smoke test exact npm bundle on minimum runtime
+        run: bun run scripts/smoke-npm-bundle.ts --expected-bun=1.1.0
+        working-directory: cli
+
+      - name: Restore release build toolchain
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .bun-version
+
+      - name: Verify release checksums
+        run: sha256sum --check checksums.txt
+        working-directory: dist
+
+      - name: Attest release provenance
         uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
         with:
-          subject-path: |
-            dist/altertable-darwin-*
-            dist/altertable-linux-*
-            dist/altertable-cli.js
-            dist/checksums.txt
+          subject-checksums: dist/checksums.txt
 
       - name: Upload release assets
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh release upload "${{ needs.release-please.outputs.tag_name }}" dist/altertable-darwin-* dist/altertable-linux-* dist/altertable-cli.js dist/checksums.txt --clobber
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: bun run release:upload-github
+        working-directory: cli
 
       - name: Publish npm package
-        run: npm publish --provenance --access public
+        run: bun run release:publish-npm
+        working-directory: cli
+
+      - name: Publish completed GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: bun run release:publish-github
         working-directory: cli

.github/workflows/semantic-pull-request.yml

@@ -1,17 +1,27 @@
 name: Semantic Pull Request
+
 on:
   pull_request_target:
     types:
       - opened
       - edited
       - synchronize
 
+permissions:
+  pull-requests: read
+
+concurrency:
+  group: semantic-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   main:
     name: Validate PR title
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+      - name: Validate pull request title
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: