Merge pull request #2 from Goreeng/feat/html-gen

Feat/html gen

Author: Goreeng

.claude/hooks/run-sce-or-show-install-guidance.sh

@@ -15,11 +15,6 @@ updates:
     schedule:
       interval: daily
 
-  - package-ecosystem: cargo
-    directory: /integrations/install
-    schedule:
-      interval: daily
-
   - package-ecosystem: npm
     directory: /npm
     schedule:

.claude/settings.json

@@ -50,7 +50,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{matrix.language}}"

.github/dependabot.yml

@@ -14,6 +14,11 @@ on:
         required: false
         default: true
         type: boolean
+      prerelease:
+        description: "Treat this as a prerelease publication; version must include semver prerelease metadata"
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -29,6 +34,7 @@ jobs:
       DISPATCH_RELEASE_TAG: ${{ inputs.release_tag }}
       EVENT_RELEASE_TAG: ${{ github.event.release.tag_name }}
       DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}
+      PRE_RELEASE: ${{ github.event_name == 'release' && github.event.release.prerelease || github.event_name == 'workflow_dispatch' && inputs.prerelease || false }}
       CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -43,7 +49,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@32cb6a5ae30bb0dfc996fa7baf8bf1ed28442fa4 # v3.17.3
+        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3.21.2
 
       - name: Verify checked-in release version parity
         shell: bash
@@ -70,7 +76,21 @@ jobs:
             exit 1
           fi
 
-          printf 'Publishing checked-in crate version %s from tag %s\n' "$version" "$release_tag"
+          case "$version" in
+            *-*) version_is_prerelease=true ;;
+            *) version_is_prerelease=false ;;
+          esac
+
+          if [ "${PRE_RELEASE:-false}" = "true" ] && [ "$version_is_prerelease" != "true" ]; then
+            printf 'Prerelease crate publication requires a semver prerelease version, but .version is %s\n' "$version" >&2
+            exit 1
+          fi
+
+          if [ "$version_is_prerelease" = "true" ]; then
+            printf 'Publishing checked-in semver prerelease crate version %s from tag %s\n' "$version" "$release_tag"
+          else
+            printf 'Publishing checked-in crate version %s from tag %s\n' "$version" "$release_tag"
+          fi
 
       - name: Prepare crate-local generated assets
         env:

.github/workflows/codeql.yml

@@ -14,6 +14,11 @@ on:
         required: false
         default: true
         type: boolean
+      prerelease:
+        description: "Publish with the next dist-tag instead of latest; version must include semver prerelease metadata"
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -29,6 +34,7 @@ jobs:
       DISPATCH_RELEASE_TAG: ${{ inputs.release_tag }}
       EVENT_RELEASE_TAG: ${{ github.event.release.tag_name }}
       DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}
+      PRE_RELEASE: ${{ github.event_name == 'release' && github.event.release.prerelease || github.event_name == 'workflow_dispatch' && inputs.prerelease || false }}
       GH_TOKEN: ${{ github.token }}
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
@@ -74,7 +80,21 @@ jobs:
             exit 1
           fi
 
-          printf 'Publishing checked-in npm package version %s from tag %s\n' "$version" "$release_tag"
+          case "$version" in
+            *-*) version_is_prerelease=true ;;
+            *) version_is_prerelease=false ;;
+          esac
+
+          if [ "${PRE_RELEASE:-false}" = "true" ] && [ "$version_is_prerelease" != "true" ]; then
+            printf 'Prerelease npm publication requires a semver prerelease version, but .version is %s\n' "$version" >&2
+            exit 1
+          fi
+
+          if [ "${PRE_RELEASE:-false}" = "true" ] || [ "$version_is_prerelease" = "true" ]; then
+            printf 'Publishing checked-in npm prerelease package version %s from tag %s with npm dist-tag next\n' "$version" "$release_tag"
+          else
+            printf 'Publishing checked-in npm package version %s from tag %s with npm dist-tag latest\n' "$version" "$release_tag"
+          fi
 
       - name: Download canonical npm release asset
         shell: bash
@@ -120,7 +140,14 @@ jobs:
         if: env.DRY_RUN == 'true'
         run: |
           version="$(tr -d '\n' < .version)"
-          npm publish "dist/npm/sce-v${version}-npm.tgz" --access public --dry-run
+          npm_tag="latest"
+          case "$version" in
+            *-*) npm_tag="next" ;;
+          esac
+          if [ "${PRE_RELEASE:-false}" = "true" ]; then
+            npm_tag="next"
+          fi
+          npm publish "dist/npm/sce-v${version}-npm.tgz" --access public --tag "$npm_tag" --dry-run
 
       - name: Ensure npm token is configured
         if: env.DRY_RUN != 'true'
@@ -138,4 +165,11 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           version="$(tr -d '\n' < .version)"
-          npm publish "dist/npm/sce-v${version}-npm.tgz" --access public
+          npm_tag="latest"
+          case "$version" in
+            *-*) npm_tag="next" ;;
+          esac
+          if [ "${PRE_RELEASE:-false}" = "true" ]; then
+            npm_tag="next"
+          fi
+          npm publish "dist/npm/sce-v${version}-npm.tgz" --access public --tag "$npm_tag"

.github/workflows/publish-crates.yml

@@ -36,6 +36,36 @@ jobs:
             --version "${{ inputs.release_version }}" \
             --out-dir dist
 
+      - name: Validate packaged Linux ARM CLI release artifact
+        run: |
+          set -euo pipefail
+
+          version="${{ inputs.release_version }}"
+          target_triple="aarch64-unknown-linux-musl"
+          archive_root="sce-v${version}-${target_triple}"
+          archive_path="dist/${archive_root}.tar.gz"
+
+          if [ ! -f "$archive_path" ]; then
+            printf 'Expected release archive at %s\n' "$archive_path" >&2
+            exit 1
+          fi
+
+          extract_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/sce-release-validate.XXXXXX")"
+          cleanup() {
+            rm -rf "$extract_dir"
+          }
+          trap cleanup EXIT
+
+          tar -xzf "$archive_path" -C "$extract_dir"
+          release_binary="$extract_dir/$archive_root/bin/sce"
+          if [ ! -x "$release_binary" ]; then
+            printf 'Expected executable release binary at %s\n' "$release_binary" >&2
+            exit 1
+          fi
+
+          "$release_binary" version --format json
+          nix run .#native-portability-audit -- --platform linux --binary "$release_binary"
+
       - name: Allow Flatpak build sandbox
         run: |
           sudo sysctl -w kernel.unprivileged_userns_clone=1
@@ -60,6 +90,6 @@ jobs:
       - name: Upload Linux ARM CLI release artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: sce-release-aarch64-unknown-linux-gnu
+          name: sce-release-aarch64-unknown-linux-musl
           path: dist/
           if-no-files-found: error

.github/workflows/publish-npm.yml

@@ -36,6 +36,36 @@ jobs:
             --version "${{ inputs.release_version }}" \
             --out-dir dist
 
+      - name: Validate packaged Linux CLI release artifact
+        run: |
+          set -euo pipefail
+
+          version="${{ inputs.release_version }}"
+          target_triple="x86_64-unknown-linux-musl"
+          archive_root="sce-v${version}-${target_triple}"
+          archive_path="dist/${archive_root}.tar.gz"
+
+          if [ ! -f "$archive_path" ]; then
+            printf 'Expected release archive at %s\n' "$archive_path" >&2
+            exit 1
+          fi
+
+          extract_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/sce-release-validate.XXXXXX")"
+          cleanup() {
+            rm -rf "$extract_dir"
+          }
+          trap cleanup EXIT
+
+          tar -xzf "$archive_path" -C "$extract_dir"
+          release_binary="$extract_dir/$archive_root/bin/sce"
+          if [ ! -x "$release_binary" ]; then
+            printf 'Expected executable release binary at %s\n' "$release_binary" >&2
+            exit 1
+          fi
+
+          "$release_binary" version --format json
+          nix run .#native-portability-audit -- --platform linux --binary "$release_binary"
+
       - name: Allow Flatpak build sandbox
         run: |
           sudo sysctl -w kernel.unprivileged_userns_clone=1
@@ -60,6 +90,6 @@ jobs:
       - name: Upload Linux CLI release artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: sce-release-x86_64-unknown-linux-gnu
+          name: sce-release-x86_64-unknown-linux-musl
           path: dist/
           if-no-files-found: error

.github/workflows/release-sce-linux-arm.yml

@@ -28,14 +28,44 @@ jobs:
           ref: ${{ inputs.release_ref }}
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@32cb6a5ae30bb0dfc996fa7baf8bf1ed28442fa4 # v3.17.3
+        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3.21.2
 
       - name: Build canonical macOS ARM CLI release artifacts
         run: |
           nix run .#release-artifacts -- \
             --version "${{ inputs.release_version }}" \
             --out-dir dist
 
+      - name: Validate packaged macOS ARM CLI release artifact
+        run: |
+          set -euo pipefail
+
+          version="${{ inputs.release_version }}"
+          target_triple="aarch64-apple-darwin"
+          archive_root="sce-v${version}-${target_triple}"
+          archive_path="dist/${archive_root}.tar.gz"
+
+          if [ ! -f "$archive_path" ]; then
+            printf 'Expected release archive at %s\n' "$archive_path" >&2
+            exit 1
+          fi
+
+          extract_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/sce-release-validate.XXXXXX")"
+          cleanup() {
+            rm -rf "$extract_dir"
+          }
+          trap cleanup EXIT
+
+          tar -xzf "$archive_path" -C "$extract_dir"
+          release_binary="$extract_dir/$archive_root/bin/sce"
+          if [ ! -x "$release_binary" ]; then
+            printf 'Expected executable release binary at %s\n' "$release_binary" >&2
+            exit 1
+          fi
+
+          "$release_binary" version --format json
+          nix run .#native-portability-audit -- --platform macos --binary "$release_binary"
+
       - name: Upload macOS ARM CLI release artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with: