ci: align security, release automation, and mutation threshold (#48)

## Summary
- Align GPG verification and release automation with
php-security/php-audit-logger repos
- Add App Token for CI, verify-signatures, GPG mandatory checks
- Raise Stryker mutation score break threshold to 85%
- Add missing unit tests for all untested classes (Debounce, Throttle,
RequestAuth, RequestMiddleware, BaseStorageManager, EncryptionError,
CspError, LoggerConfig)
- Enhance existing tests for better mutation coverage
- Reach 100% line coverage with v8 ignore for unreachable defensive
guards
- Fix dompurify vulnerability (GHSA-39q2-94rc-95cp)

**Metrics:**
- Mutation score: 81.68% → 86.90% (threshold: 85%)
- Line coverage: 99.75% → 100%

## Test plan
- [ ] CI quality checks pass (format, lint, typecheck, test, build,
size, audit)
- [ ] CI mutation testing passes with ≥85% score
- [ ] CI security checks pass (audit clean)
- [ ] Verify GPG signature verification works in CI

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: marcstraube

.github/workflows/release-please.yml

@@ -20,9 +20,17 @@ jobs:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - uses: googleapis/release-please-action@v4
         id: release
         with:
+          token: ${{ steps.app-token.outputs.token }}
           release-type: node
 
       # If a release was created, publish to npm
@@ -67,7 +75,7 @@ jobs:
       - name: Upload SBOM to release
         if: ${{ steps.release.outputs.release_created }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: gh release upload ${{ steps.release.outputs.tag_name }} sbom.cdx.json --clobber
 
   publish:
@@ -108,5 +116,5 @@ jobs:
 
       - name: Upload SBOM to release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release upload ${{ inputs.tag }} sbom.cdx.json --clobber

.github/workflows/verify-signatures.yml

@@ -0,0 +1,89 @@
+name: Verify Signatures
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify GPG Signatures
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Verify all commits are signed (via GitHub API)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          echo "Checking commits in this PR/push via GitHub API..."
+
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            BASE_SHA="${{ github.event.pull_request.base.sha }}"
+            HEAD_SHA="${{ github.event.pull_request.head.sha }}"
+          else
+            # For push events, check commits
+            HEAD_SHA="${{ github.sha }}"
+            BEFORE_SHA="${{ github.event.before }}"
+
+            # Handle new branches where github.event.before is null SHA
+            if [ "${BEFORE_SHA}" = "0000000000000000000000000000000000000000" ]; then
+              echo "New branch detected, checking all commits since master..."
+              BASE_SHA=$(git merge-base origin/master ${HEAD_SHA} 2>/dev/null || echo "")
+              if [ -z "$BASE_SHA" ]; then
+                echo "No common ancestor with master, checking only HEAD commit"
+                BASE_SHA="${HEAD_SHA}^"
+              fi
+            else
+              BASE_SHA="${BEFORE_SHA}"
+            fi
+          fi
+
+          COMMITS=$(git rev-list ${BASE_SHA}..${HEAD_SHA} 2>/dev/null || echo "${HEAD_SHA}")
+          UNSIGNED_COMMITS=()
+
+          for commit in $COMMITS; do
+            # Use GitHub API to check signature verification
+            VERIFIED=$(gh api repos/${{ github.repository }}/commits/${commit} --jq '.commit.verification.verified')
+            if [ "$VERIFIED" != "true" ]; then
+              UNSIGNED_COMMITS+=("$commit")
+              REASON=$(gh api repos/${{ github.repository }}/commits/${commit} --jq '.commit.verification.reason')
+              echo "❌ Commit $commit is NOT verified (reason: $REASON)"
+            else
+              echo "✅ Commit $commit is verified"
+            fi
+          done
+
+          if [ ${#UNSIGNED_COMMITS[@]} -gt 0 ]; then
+            echo ""
+            echo "ERROR: Found ${#UNSIGNED_COMMITS[@]} unverified commit(s)!"
+            echo ""
+            echo "All commits must be GPG-signed for security packages."
+            echo "See CONTRIBUTING.md for setup instructions."
+            exit 1
+          fi
+
+          echo ""
+          echo "✅ All commits are verified!"
+
+      - name: Verify tag signature (if tagged)
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ github.ref_name }}"
+          # Use GitHub API to check tag verification
+          VERIFIED=$(gh api repos/${{ github.repository }}/git/tags/$(gh api repos/${{ github.repository }}/git/ref/tags/${TAG} --jq '.object.sha') --jq '.verification.verified' 2>/dev/null || echo "false")
+          if [ "$VERIFIED" != "true" ]; then
+            echo "❌ Tag $TAG is NOT verified"
+            echo "Create signed tags with: git tag -s"
+            exit 1
+          fi
+          echo "✅ Tag $TAG is verified"

CONTRIBUTING.md

@@ -37,18 +37,41 @@ pnpm run quality           # Run all quality checks
 - ESLint with zero warnings (`--max-warnings=0`)
 - 100% test coverage for new code
 - Prettier formatting
+- Minimum 85% mutation score (Stryker, enforced in CI)
 
-## Commit Signing (Optional)
+## Commit Signing
 
-GPG-signed commits are recommended but not required. If you'd like to sign your
-commits:
+**CRITICAL: All commits MUST be GPG-signed.**
+
+This is enforced in CI/CD:
+
+- GitHub Actions will fail on unsigned commits
+- Pull requests with unsigned commits will be rejected
+
+### Setup GPG Signing
 
 ```bash
-# Configure Git to sign commits
+# Generate GPG key
+gpg --full-generate-key
+
+# List keys
+gpg --list-secret-keys --keyid-format=long
+
+# Export public key
+gpg --armor --export YOUR_KEY_ID
+
+# Configure Git
 git config --global user.signingkey YOUR_KEY_ID
 git config --global commit.gpgsign true
+git config --global tag.gpgSign true
 ```
 
+### Add GPG key to GitHub
+
+1. Go to <https://github.com/settings/keys>
+2. Click "New GPG key"
+3. Paste your public key
+
 See
 [GitHub's GPG documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification)
 for full setup instructions.
@@ -84,6 +107,7 @@ security: sanitize user input in download filename
 
 ### PR Requirements
 
+- [ ] All commits are GPG-signed
 - [ ] All tests pass (`pnpm run test`)
 - [ ] Code style is clean (`pnpm run lint`)
 - [ ] TypeScript compiles (`pnpm run typecheck`)

SECURITY.md

@@ -117,6 +117,7 @@ All changes require:
 - Dependency vulnerability checks
 - Type checking catches type confusion attacks
 - Test coverage prevents regressions
+- Signed releases: GPG-signed tags and commits
 
 ## Known Limitations
 

pnpm-lock.yaml

@@ -430,9 +430,12 @@ export class RetryQueue {
    * Uses a sliding window approach.
    */
   private checkRateLimit(): boolean {
+    // Defensive guard - callers already check for rateLimit before calling
+    /* v8 ignore start */
     if (!this.options.rateLimit) {
       return true;
     }
+    /* v8 ignore stop */
 
     const now = Date.now();
     const { windowMs, maxRequestsPerWindow } = this.options.rateLimit;
@@ -451,9 +454,12 @@ export class RetryQueue {
    * Record an operation timestamp for rate limiting.
    */
   private recordOperation(): void {
+    // Defensive guard - callers already check for rateLimit before calling
+    /* v8 ignore start */
     if (!this.options.rateLimit) {
       return;
     }
+    /* v8 ignore stop */
 
     this.operationTimestamps.push(Date.now());
   }
@@ -463,9 +469,12 @@ export class RetryQueue {
    * Returns the time until the oldest operation in the window expires.
    */
   private calculateRateLimitDelay(): number {
+    // Defensive guard - callers already check for rateLimit before calling
+    /* v8 ignore start */
     if (!this.options.rateLimit || this.operationTimestamps.length === 0) {
       return 0;
     }
+    /* v8 ignore stop */
 
     const now = Date.now();
     const { windowMs } = this.options.rateLimit;

src/network/RetryQueue.ts

@@ -651,9 +651,12 @@ export const OfflineQueue = {
 
     // Rate limiting helper: check if we can process another item
     const checkRateLimit = (): boolean => {
+      // Defensive guard - callers already check for rateLimit before calling
+      /* v8 ignore start */
       if (!rateLimit) {
         return true;
       }
+      /* v8 ignore stop */
 
       const now = Date.now();
       const { windowMs, maxRequestsPerWindow } = rateLimit;
@@ -678,9 +681,12 @@ export const OfflineQueue = {
 
     // Rate limiting helper: calculate delay when limit is exceeded
     const calculateRateLimitDelay = (): number => {
+      // Defensive guard - callers already check for rateLimit before calling
+      /* v8 ignore start */
       if (!rateLimit || operationTimestamps.length === 0) {
         return 0;
       }
+      /* v8 ignore stop */
 
       const now = Date.now();
       const { windowMs } = rateLimit;

src/offline/OfflineQueue.ts

@@ -27,7 +27,9 @@ function isPrivateIPv4(hostname: string): boolean {
     octet3 === undefined ||
     octet4 === undefined
   ) {
+    /* v8 ignore start */
     return false;
+    /* v8 ignore stop */
   }
 
   const octets = [
@@ -39,16 +41,20 @@ function isPrivateIPv4(hostname: string): boolean {
 
   // Validate octets are in range 0-255
   if (octets.some((octet) => octet > 255)) {
+    /* v8 ignore start */
     return false;
+    /* v8 ignore stop */
   }
 
   const first = octets[0];
   const second = octets[1];
 
   // Type guard: verify octets exist
+  /* v8 ignore start */
   if (first === undefined || second === undefined) {
     return false;
   }
+  /* v8 ignore stop */
 
   // 127.0.0.0/8 - Loopback
   if (first === 127) return true;

src/request/RequestValidation.ts

@@ -388,12 +388,13 @@ export abstract class BaseStorageManager<T = unknown> {
 
   protected evictOldest(): void {
     // Memory mode path - unreachable since quota errors only occur with native storage
-    /* v8 ignore next 5 */
+    /* v8 ignore start */
     if (this.isMemoryMode) {
       const evicted = this.memoryStorage.evictOldest(this.config.minSafeEntries);
       this.config.logger.debug(`Emergency eviction (memory): ${evicted} entries`);
       return;
     }
+    /* v8 ignore stop */
 
     const entries = this.entries();
 

src/storage/BaseStorageManager.ts

@@ -8,7 +8,7 @@ export default {
   vitest_comment: 'vitest runner auto-detects vitest.config.ts',
   disableTypeChecks: 'src/**/*.ts',
   ignoreStatic: true,
-  thresholds: { high: 80, low: 60, break: null },
+  thresholds: { high: 85, low: 70, break: 85 },
   tempDirName: '.stryker-tmp',
   // concurrency: default = cpus - 1
 };