Merge remote-tracking branch 'origin/main' into jg-codex/64-error-path-tests

* origin/main:
  Add release artifact verification gate (#77)
  Apply React 19.0.7 RSC reply-decode DoS fixes (CVE-2026-23869, CVE-2026-23870) to vendored runtime (#86)
  Harden dependency and Claude automation (#76)
  Make PR skill workflows discoverable (#88)
  Extract and own the webpack RSC plugin as TypeScript source (#87)
  Add packed-tarball E2E pipeline suite: webpack+rspack → Flight → SSR HTML → hydration (#85)
  Docs: Option 5 stock npm runtime go/no-go decision (#55 spike) (#80)

Author: justin808

.agents/skills/README.md

@@ -9,6 +9,11 @@ models the skills point to.
 Invoke a skill with its `$name` (e.g. `$pr-batch`, `$plan-pr-batch`, `$adversarial-pr-review`) or the
 matching Claude Code slash command.
 
+For the maintainer-facing guide to choosing and running these skills, see
+[`internal/contributor-info/agent-pr-batch-skills.md`](../../internal/contributor-info/agent-pr-batch-skills.md).
+For the workflow adoption and retargeting checklist, see
+[`internal/contributor-info/agent-workflow-adoption.md`](../../internal/contributor-info/agent-workflow-adoption.md).
+
 ## Adaptation status
 
 The originals assume a Ruby/Rails monorepo (rspec, rubocop, rake, shakapacker, a Pro tier, a

.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      root-dev-minor-patch:
+        dependency-type: development
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: /scripts/react-upgrade
+    schedule:
+      interval: weekly
+    groups:
+      react-upgrade-minor-patch:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/artifact-checks.yml

@@ -0,0 +1,28 @@
+name: Verify package artifacts
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  verify-artifacts:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      # Pinned immutable actions/checkout release SHA verified via git ls-remote.
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      - name: Use Node.js
+        # Pinned immutable actions/setup-node release SHA verified via git ls-remote.
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '20.x'
+          cache: yarn
+      - name: Install packages using yarn
+        run: yarn --frozen-lockfile
+      - name: Verify package artifacts
+        run: yarn verify:artifacts

.github/workflows/claude-code-review.yml

@@ -6,6 +6,15 @@ on:
 
 jobs:
   claude-review:
+    if: |
+      !(
+        startsWith(github.event.pull_request.title, 'Release react-on-rails-rsc ') ||
+        startsWith(github.event.pull_request.title, 'Stamp CHANGELOG and package version for ') ||
+        (
+          startsWith(github.event.pull_request.title, 'Prepare ') &&
+          endsWith(github.event.pull_request.title, ' changelog')
+        )
+      )
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -19,9 +28,24 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Detect Claude review workflow changes
+        id: claude-workflow-changes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          changed_files="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename')"
+          if printf '%s\n' "$changed_files" | grep -Fx '.github/workflows/claude-code-review.yml'; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Run Claude Code Review
+        if: steps.claude-workflow-changes.outputs.changed != 'true'
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@0cb4f3e5e764d2e00407d29b6bf0aa9df0976d88 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           prompt: |

.github/workflows/claude.yml

@@ -34,7 +34,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@0cb4f3e5e764d2e00407d29b6bf0aa9df0976d88 # v1
         with:
           github_token: ${{ github.token }}
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
@@ -52,4 +52,3 @@ jobs:
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://code.claude.com/docs/en/cli-reference for available options
           # claude_args: '--allowed-tools Bash(gh pr:*)'
-

.github/workflows/e2e-tests.yml

@@ -0,0 +1,18 @@
+name: Run E2E pipeline tests
+on: [pull_request]
+
+jobs:
+  e2e-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+      - name: Install packages using yarn
+        run: yarn
+      # Packs the npm tarball, installs it into a disposable consumer
+      # project, and runs the webpack+rspack -> Flight -> SSR -> hydration
+      # pipeline suite (scripts/e2e/run.sh).
+      - run: yarn test:e2e

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this package will be documented in this file.
 
+## [Unreleased]
+
+### Changed
+- Ported the webpack RSC plugin from the vendored built JavaScript artifact (`src/react-server-dom-webpack/cjs/react-server-dom-webpack-plugin.js`) to first-class TypeScript source at `src/webpack/RSCWebpackPlugin.ts`, preserving full behavior parity (server manifest emission, CSS/JS chunk scanning, runtime-chunk filtering, dependency-type chunk-group manifest construction with eager-import fallback, duplicate-package runtime detection, and hot-update CSS exclusion). The `./WebpackPlugin`, `./WebpackLoader`, and `./RSCReferenceDiscoveryPlugin` exports are unchanged; the vendored plugin file remains in the package but is no longer used by any export path. ([#87])
+
+### Fixed
+- Updated the vendored `react-server-dom-webpack` runtime from the React 19.0.4 security level to 19.0.7, applying the upstream React Server Components reply-decoding denial-of-service fixes for CVE-2026-23869 (GHSA-479c-33wc-g2pg) and CVE-2026-23870 (GHSA-rv78-f8rc-xrxh) while preserving the in-repo Flight CSS hint behavior. Note: the upstream CVE-2026-23869 fix changes the reply wire format for nested `FormData`, so client and server must both run the patched runtime (both are shipped together in this package); pairing with a pre-19.0.5 `react-server-dom-webpack` on the other side silently drops nested `FormData` entries. ([#86])
+
 ## [19.0.5-rc.7] - 2026-06-09
 
 ### Added
@@ -80,3 +88,5 @@ All notable changes to this package will be documented in this file.
 [19.0.5-rc.1]: https://github.com/shakacode/react_on_rails_rsc/releases/tag/19.0.5-rc.1
 
 [#52]: https://github.com/shakacode/react_on_rails_rsc/pull/52
+[#86]: https://github.com/shakacode/react_on_rails_rsc/pull/86
+[#87]: https://github.com/shakacode/react_on_rails_rsc/pull/87