chore: restore release safety baseline

.github/workflows/ci.yml

@@ -0,0 +1,131 @@
+name: Browser SDK CI
+
+on:
+  pull_request:
+    branches:
+      - main
+      - publish
+  push:
+    branches:
+      - main
+      - publish
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: '23.11.1'
+
+jobs:
+  quality:
+    name: Build, lint, typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Check formatting
+        run: yarn format
+
+      - name: Build packages
+        run: yarn build
+
+      - name: Lint packages
+        run: yarn lint
+
+      - name: Check package metadata
+        run: node scripts/check-packages.js
+
+      - name: Typecheck packages and test apps
+        run: |
+          yarn typecheck
+          scripts/cli typecheck test/apps/vanilla
+          scripts/cli typecheck test/e2e
+
+  unit:
+    name: Unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Run unit tests
+        run: yarn test:unit --single-run
+
+  compatibility:
+    name: Compatibility checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Check TypeScript compatibility
+        run: yarn test:compat:tsc
+
+      - name: Check server-side rendering compatibility
+        run: yarn test:compat:ssr
+
+  bundle:
+    name: Bundle and script tests
+    runs-on: ubuntu-latest
+    env:
+      BUILD_MODE: release
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Build release bundles
+        run: yarn build:bundle
+
+      - name: Run script tests
+        run: yarn test:script
+
+  e2e:
+    name: Chromium e2e
+    runs-on: ubuntu-latest
+    env:
+      FORCE_COLOR: '1'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Run Chromium e2e tests
+        run: yarn test:e2e:ci

.github/workflows/deploy-auto.yml

@@ -5,8 +5,13 @@ on:
     tags:
       - 'v*' # 当推送带有 v 前缀的标签时触发
 
+env:
+  NODE_VERSION: '23.11.1'
+  BUILD_MODE: release
+
 jobs:
-  deploy-prod:
+  preflight:
+    name: Release preflight
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -15,26 +20,70 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: ${{ env.NODE_VERSION }}
 
       - name: Install dependencies
-        run: yarn
+        run: yarn install --immutable
 
-      - name: Export BUILD_MODE
-        run: export BUILD_MODE=release
+      - name: Validate tag matches package version
+        run: |
+          FULL_VERSION=$(node -p "require('./lerna.json').version")
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          if [ "$FULL_VERSION" != "$TAG_VERSION" ]; then
+            echo "Tag v$TAG_VERSION does not match lerna.json version $FULL_VERSION"
+            exit 1
+          fi
 
-      - name: Get version
+      - name: Check release metadata
+        run: node scripts/release/check-release.js
+
+      - name: Run release checks
         run: |
-          FULL_VERSION=$(node -p -e "require('./lerna.json').version")
-          MAJOR_VERSION=$(echo $FULL_VERSION | cut -d. -f1)
-          echo "VERSION=$MAJOR_VERSION" >> $GITHUB_ENV
-          echo "version=$MAJOR_VERSION" >> $GITHUB_OUTPUT
-        env:
-          BUILD_MODE: release
+          yarn format
+          yarn build
+          yarn lint
+          node scripts/check-packages.js
+          yarn typecheck
+          yarn test:unit --single-run
+          yarn test:compat:tsc
+          yarn test:compat:ssr
 
       - name: Build bundle
         run: yarn build:bundle
 
+      - name: Upload bundle artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-bundles
+          path: packages/*/bundle/**
+          if-no-files-found: error
+
+  deploy-prod:
+    needs: preflight
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Download verified bundle artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: release-bundles
+          path: packages
+
+      - name: Get version
+        run: |
+          FULL_VERSION=$(node -p "require('./lerna.json').version")
+          echo "VERSION=$FULL_VERSION" >> $GITHUB_ENV
+
       - name: Deploy to prod
         run: node ./scripts/deploy/deploy-oss.js prod v${VERSION}
         env:
@@ -54,11 +103,11 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org/'
 
       - name: Install dependencies
-        run: yarn
+        run: yarn install --immutable
 
       - name: Publish to NPM
         run: node ./scripts/deploy/publish-npm.js

.github/workflows/deploy-manual.yml

@@ -8,8 +8,25 @@ on:
         required: true
         default: 'no'
 
+env:
+  NODE_VERSION: '23.11.1'
+  BUILD_MODE: release
+
 jobs:
-  deploy-prod:
+  validate-confirmation:
+    name: Validate manual confirmation
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require explicit confirmation
+        run: |
+          if [ "${{ github.event.inputs.confirm_deploy }}" != "yes" ]; then
+            echo 'Deployment blocked: confirm_deploy must be exactly "yes".'
+            exit 1
+          fi
+
+  preflight:
+    name: Release preflight
+    needs: validate-confirmation
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -18,26 +35,61 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: ${{ env.NODE_VERSION }}
 
       - name: Install dependencies
-        run: yarn
+        run: yarn install --immutable
 
-      - name: Export BUILD_MODE
-        run: export BUILD_MODE=release
+      - name: Check release metadata
+        run: node scripts/release/check-release.js
 
-      - name: Get version
+      - name: Run release checks
         run: |
-          FULL_VERSION=$(node -p -e "require('./lerna.json').version")
-          MAJOR_VERSION=$(echo $FULL_VERSION | cut -d. -f1)
-          echo "VERSION=$MAJOR_VERSION" >> $GITHUB_ENV
-          echo "version=$MAJOR_VERSION" >> $GITHUB_OUTPUT
-        env:
-          BUILD_MODE: release
+          yarn format
+          yarn build
+          yarn lint
+          node scripts/check-packages.js
+          yarn typecheck
+          yarn test:unit --single-run
+          yarn test:compat:tsc
+          yarn test:compat:ssr
 
       - name: Build bundle
         run: yarn build:bundle
 
+      - name: Upload bundle artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-bundles
+          path: packages/*/bundle/**
+          if-no-files-found: error
+
+  deploy-prod:
+    needs: preflight
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Download verified bundle artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: release-bundles
+          path: packages
+
+      - name: Get version
+        run: |
+          FULL_VERSION=$(node -p "require('./lerna.json').version")
+          echo "VERSION=$FULL_VERSION" >> $GITHUB_ENV
+
       - name: Deploy to prod
         run: node ./scripts/deploy/deploy-oss.js prod v${VERSION}
         env:
@@ -57,17 +109,17 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org/'
 
       - name: Install dependencies
-        run: yarn
+        run: yarn install --immutable
 
       - name: Publish to NPM
         run: node ./scripts/deploy/publish-npm.js
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        
+
   notify-success:
     needs: publish-npm
     runs-on: ubuntu-latest