* ci(#4335): shard release.yml rc/finalize unit-suite tests
The finalize job's unsharded unit-coverage step outgrew the 30-minute job
timeout that was already raised once for this exact symptom (#2280): run
33988966357 finished all tests with 0 failures at 28m26s, then got cancelled
~80s into the post-test coverage merge — a phase that historically completes
in 54-101s. The suite's wall-clock time, not a hang, ate the budget.
test.yml already fixed the identical cliff for its own full-scope lane
(#2952, #3057) by sharding the unit suite 3 ways with a separate merged
coverage-gate job. Apply the same pattern to rc and finalize (rc has the
byte-identical unsharded shape and would hit the same wall next): each gains
a `*-test` matrix job (raw coverage only, no report/gate) and a
`*-coverage-gate` job that merges the shards' raw V8 dumps before enforcing
the existing gsd-core/bin/lib coverage floor. rc/finalize now depend on their
gate job instead of running the suite inline.
Updates release-coverage-scope.test.cjs's exact-count assertion for the new
command surface and adds release-shard-lane-sharding.test.cjs to pin
shard-set completeness and gate wiring, mirroring ci-full-lane-sharding.test.cjs.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Potential fix for pull request finding 'CodeQL / Cache Poisoning via execution of untrusted code'
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for pull request finding 'CodeQL / Cache Poisoning via execution of untrusted code'
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* fix(#4335): close CodeQL cache-poisoning and missing-permissions findings
CodeQL flagged the PR (10 actions/cache-poisoning/poisonable-step errors, 4
actions/missing-workflow-permissions warnings) on release.yml.
Remove `cache: 'npm'` from every actions/setup-node step in the file (7
occurrences, not just the 4 newly-added jobs the alerts pointed at) —
restoring an npm cache before running install/build code in a
write-permissioned job is exactly the shape this query targets, and the
same pattern was already present unchanged in create/rc/finalize. These are
short CI/release jobs; losing npm's install cache costs a few seconds per
job, closing the finding everywhere it appears in this file rather than
only where the alert happened to land on a changed line.
Add explicit `permissions: contents: read` to rc-test, rc-coverage-gate,
finalize-test, finalize-coverage-gate — the four new jobs had no
permissions block at all and inherited the ambient default. Matches
validate-version's existing least-privilege pattern; create/rc/finalize
keep their own broader write/publish scopes unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: sim <sim@local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
hotfix.yml was deleted (folded into release.yml). Remove the now-broken
release-coverage-scope and policy-release-no-npm-self-upgrade assertions that
readFileSync'd hotfix.yml (release.yml equivalents retained), drop the dead
install-smoke.yml path trigger, and update VERSIONING.md / docs/branching.md
prose to describe hotfixes via the Release workflow with a patch version.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
release.yml (rc + finalize) and hotfix.yml (finalize) ran the full
`npm run test:coverage` suite on the release path, redundantly re-running
the integration/install/security/slow suites that already passed on the
PR lanes into next. Switch those three sites to `npm run test:coverage:unit`
(same c8 config, unit suite only) to cut release latency. Full-suite
coverage remains available via the dedicated lanes / `test:coverage:all`.
Adds a workflow-contract regression test asserting the release/hotfix gates
invoke the unit coverage command (exact-line match, not substring).
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
