Ship highlight.js verbatim from @highlightjs/cdn-assets (#112)

AMO's review of 1.9.4 is blocked on reproducing the minification of
lib/highlight.min.js. That is unwinnable as long as we ship a custom build:
there is no official artifact to checksum against, so the reviewer has to
reproduce a build, and reproducing ours was never possible anyway --
package.json pinned highlight.js to a bare GitHub URL with no ref, the
workflow re-resolved it with `npm install --package-lock-only` before
clean-install, `npm audit fix` ran immediately before the build, and
package-lock.json was stripped from the release archive. Nothing in the
submitted zip identified a fixed version.

Consume the project's own published distribution instead, pinned exactly, and
copy the files without modification. @highlightjs/cdn-assets is highlight.js'
own npm package rather than a third-party CDN rehost, so package-lock.json
records the tarball URL and its SHA-512 integrity hash: a reviewer verifies
the shipped files with `npm ci` and `diff`, with no build to reproduce.

The es/ modules give core plus only the xml, http and properties grammars --
about 24 KB, slightly smaller than the custom build. A first-party shim
registers them and exposes hljs as a global so the page's classic scripts are
unchanged; every hljs call site is event-driven, so the deferred module
script is not a timing hazard.

cdn-assets has no 11.11.1 successor yet, so this pins one patch behind the
11.11.2 the lock-file previously resolved to. A documentable downgrade is
worth more than an unreproducible build.

Refs #109

Author: kellenmurphy

.gitattributes

@@ -2,4 +2,5 @@ lib/.gitkeep export-ignore
 node_modules/ export-ignore
 test/ export-ignore
 vendor/ export-ignore
-package-lock.json export-ignore
+# package-lock.json is deliberately kept in the release archive: it is the provenance record
+# for the third-party files in lib/, and AMO reviewers need it to verify them.

.github/workflows/build-release.yml

@@ -29,24 +29,23 @@ jobs:
         with:
           node-version: 24
 
-      - name: Install & build assets
-        run: |
-          # Make sure the lock-file is up to date before we run clean-install
-          npm install --package-lock-only
-          npm clean-install
-          npm audit fix
-
-      - name: Build custom (minimum) release of highlight.js
-        run: |
-          cd node_modules/highlight.js
-          npm install --package-lock-only
-          npm clean-install
-          npm run build
-          node tools/build.js xml properties http
+      - name: Install assets
+        # Deliberately a plain clean-install: package-lock.json is authoritative, so the
+        # published build is reproducible from the committed lock-file alone. Do not add
+        # `npm install --package-lock-only` or `npm audit fix` here -- both mutate the
+        # dependency tree at build time, which makes the shipped third-party files
+        # impossible for AMO reviewers to verify.
+        run: npm clean-install
 
       - name: Copy third-party dependencies to lib/ directory
+        # Copied verbatim from the @highlightjs/cdn-assets package, which is highlight.js'
+        # own published distribution. The files are byte-identical to that release, so a
+        # reviewer can verify them with `npm ci` and `diff` rather than reproducing a build.
         run: |
-          cp node_modules/highlight.js/build/highlight.min.js lib/highlight.min.js
+          cp node_modules/@highlightjs/cdn-assets/es/core.min.js lib/core.min.js
+          cp node_modules/@highlightjs/cdn-assets/es/languages/xml.min.js lib/xml.min.js
+          cp node_modules/@highlightjs/cdn-assets/es/languages/http.min.js lib/http.min.js
+          cp node_modules/@highlightjs/cdn-assets/es/languages/properties.min.js lib/properties.min.js
           cp node_modules/pako/dist/pako_inflate.min.js lib/pako_inflate.min.js
 
       - name: Clean release

attribution.md

@@ -15,6 +15,11 @@ License type: BSD 3-clause "New" or "Revised" License
 
 Project URL: https://github.com/highlightjs/highlight.js
 
+Distribution: the files in `lib/` are copied verbatim, without modification, from the
+project's own published distribution package `@highlightjs/cdn-assets`, pinned to version
+11.11.1 in `package.json`. The exact tarball and its SHA-512 integrity hash are recorded in
+`package-lock.json`, so the shipped files can be verified with `npm ci` followed by `diff`.
+
 Original license text:
 
 ```

package-lock.json

@@ -6,7 +6,7 @@
     "test": "jest"
   },
   "dependencies": {
-    "highlight.js": "github:highlightjs/highlight.js",
+    "@highlightjs/cdn-assets": "11.11.1",
     "pako": "~2.2"
   },
   "devDependencies": {

package.json

@@ -39,7 +39,7 @@
         </div>
 
         <script type="text/javascript" src="../lib/pako_inflate.min.js"></script>
-        <script type="text/javascript" src="../lib/highlight.min.js"></script>
+        <script type="module" src="hljs-init.js"></script>
         <script type="text/javascript" src="splitter.js"></script>
         <script type="text/javascript" src="hash.js"></script>
         <script type="text/javascript" src="SAMLTrace.js"></script>

src/TraceWindow.html

@@ -0,0 +1,16 @@
+// Registers the highlight.js grammars SAML-tracer uses and exposes hljs as a global,
+// so the classic (non-module) scripts on this page can keep calling hljs.highlightElement().
+//
+// The imported files are unmodified artifacts from the @highlightjs/cdn-assets package,
+// copied verbatim during the release build -- see .github/workflows/build-release.yml.
+// Only this wrapper is first-party code.
+import hljs from '../lib/core.min.js';
+import xml from '../lib/xml.min.js';
+import http from '../lib/http.min.js';
+import properties from '../lib/properties.min.js';
+
+hljs.registerLanguage('xml', xml);
+hljs.registerLanguage('http', http);
+hljs.registerLanguage('properties', properties);
+
+window.hljs = hljs;