Stabilize Glaze architecture, runtime, security, packaging, and cross-platform APIs

.editorconfig

@@ -0,0 +1,14 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.rkt]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,15 @@
+* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.icns binary
+*.dll binary
+*.exe binary
+*.msi binary
+*.dmg binary
+*.zip binary
+*.gz binary
+*.AppImage binary

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,72 @@
+name: Bug report
+description: Report a reproducible Glaze runtime, native integration, or packaging problem
+title: "[bug] "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a Glaze bug. Native and packaging behavior is platform-sensitive, so exact environment details are important.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What happened?
+      description: Describe the observed behavior and what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal reproduction
+      description: Include the smallest Racket code or repository/commands that reproduce the problem.
+      placeholder: |
+        raco glaze init repro
+        cd repro
+        ...
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Windows
+        - macOS
+        - Linux
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: os-version
+    attributes:
+      label: OS version / architecture
+      placeholder: "macOS 15 arm64, Windows 11 x64, Ubuntu 24.04 x86_64"
+    validations:
+      required: true
+  - type: input
+    id: racket
+    attributes:
+      label: Racket version
+      placeholder: "8.12 CS / 9.3 CS"
+    validations:
+      required: true
+  - type: input
+    id: glaze
+    attributes:
+      label: Glaze version or commit
+      placeholder: "0.7 or commit SHA"
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs / output
+      render: text
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues for the same problem.
+          required: true
+        - label: I removed secrets, license private keys, tokens, and customer data from the report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/turinglambdaai/glaze/security/policy
+    about: Please use the private security reporting path described in SECURITY.md instead of a public issue.

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Summary
+
+Describe the user-visible or maintenance problem this PR solves.
+
+## Validation
+
+- [ ] `raco make glaze/main.rkt glaze-cli/cli.rkt`
+- [ ] `raco test glaze-test/`
+- [ ] Public API changes are documented, or this PR does not change the public API
+- [ ] Platform-specific behavior is behind the existing dispatcher boundary
+- [ ] Packaging changes were exercised on the affected platform(s)
+- [ ] Security-sensitive changes avoid shell interpolation and keep loopback capability boundaries intact
+
+## Compatibility
+
+Call out any behavior change that existing Glaze applications may observe. Prefer additive changes during the 0.x stabilization period.

.github/workflows/ci.yml

@@ -6,51 +6,95 @@ on:
   pull_request:
     branches: [main]
 
+# CI only needs to read the repository. Keep the default GITHUB_TOKEN surface
+# minimal so third-party actions and native packaging steps cannot write back.
+permissions:
+  contents: read
+
+# A PR can receive many small stabilization commits. Only the newest SHA is
+# useful; cancel stale runs so they do not consume the cross-platform runners
+# or delay feedback for the current head.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macOS-latest]
         racket-version: ['8.12']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Install Racket
-        uses: Bogdanp/setup-racket@v1.11
+        uses: Bogdanp/setup-racket@2466913449df77df2bad149d1f2fc4e1ea4795dd # v1.15
         with:
           version: ${{ matrix.racket-version }}
 
       - name: Install Glaze package
         shell: bash
         run: raco pkg install --auto --no-docs --link "$PWD"
 
+      - name: Compile public entrypoints
+        run: raco make glaze/main.rkt glaze-cli/cli.rkt scripts/package-entry-smoke.rkt
+
       - name: Run tests
         run: raco test glaze-test/
 
-      - name: Check formatting
-        run: raco fmt --check glaze/ glaze-cli/ glaze-test/
-        continue-on-error: true
+  source-package:
+    # Release hygiene: prove the filtered source archive is independently
+    # installable. This job intentionally does not link the checkout first.
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+      - name: Install Racket
+        uses: Bogdanp/setup-racket@2466913449df77df2bad149d1f2fc4e1ea4795dd # v1.15
+        with:
+          version: '8.12'
+
+      - name: Create source package
+        shell: bash
+        run: |
+          cd ..
+          raco pkg create --source --format zip glaze
+          test -s glaze.zip
+
+      - name: Install source package archive
+        shell: bash
+        run: raco pkg install --auto --no-docs ../glaze.zip
+
+      - name: Verify installed facade and CLI
+        shell: bash
+        run: |
+          racket -e '(require glaze) (unless (procedure? run-app) (error "missing run-app"))'
+          raco glaze help
 
   webview-e2e:
     # Real-window WebView end-to-end on each OS: open -> load (title
     # commits) -> capture -> navigate -> close -> on-close. Windows needs
     # nothing extra (WebView2 runtime is preinstalled); Linux runs under
     # Xvfb with the WebKitGTK packages.
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macOS-latest]
         racket-version: ['8.12']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Install Racket
-        uses: Bogdanp/setup-racket@v1.11
+        uses: Bogdanp/setup-racket@2466913449df77df2bad149d1f2fc4e1ea4795dd # v1.15
         with:
           version: ${{ matrix.racket-version }}
 
@@ -83,57 +127,72 @@ jobs:
     # Build a sample app with `raco glaze build --installer` on each platform
     # and upload the resulting distribution + installer as artifacts.
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macOS-latest]
         racket-version: ['8.12']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Install Racket
-        uses: Bogdanp/setup-racket@v1.11
+        uses: Bogdanp/setup-racket@2466913449df77df2bad149d1f2fc4e1ea4795dd # v1.15
         with:
           version: ${{ matrix.racket-version }}
 
       - name: Install Glaze package
         shell: bash
         run: raco pkg install --auto --no-docs --link "$PWD"
 
-      - name: Install installer toolchain (Linux)
+      - name: Install packaging dependencies (Linux)
         if: runner.os == 'Linux'
         run: |
           sudo apt-get update
           sudo apt-get install -y libayatana-appindicator3-dev libgtk-3-dev
-          # AppImage tooling (optional; build falls back to tar.gz if missing)
-          sudo wget -q https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage -O /usr/local/bin/appimagetool
-          sudo chmod +x /usr/local/bin/appimagetool
+          # Do not download and execute AppImageKit's mutable `continuous`
+          # release in CI. With no AppImage tool installed, Glaze deliberately
+          # exercises its portable tar.gz installer fallback instead.
 
       - name: Install installer toolchain (Windows)
         if: runner.os == 'Windows'
+        shell: pwsh
         run: |
-          # WiX Toolset v4 (build falls back to zip if missing)
-          dotnet tool install --global wix
-          echo "$HOME/.dotnet/tools" >> $GITHUB_PATH
+          # Glaze supports WiX v4 syntax, but GitHub's latest global `wix`
+          # tool is now v7 and requires an additional OSMF license flow.
+          # NSIS is the other supported native Windows installer backend.
+          choco install nsis -y --no-progress
+          $nsis = "C:\Program Files (x86)\NSIS"
+          if (Test-Path $nsis) { $nsis | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append }
+
+      - name: Verify packaged entry executes
+        run: racket scripts/package-entry-smoke.rkt
 
       - name: Scaffold and build a sample app
         shell: bash
         run: |
           raco glaze init sampleapp
           cd sampleapp
-          # --sign - exercises the signing pipeline everywhere: macOS signs
-          # the bundle ad-hoc (verifiable without a cert); Windows/Linux
-          # degrade with a loud warning when no signing toolchain exists.
-          raco glaze build --name sampleapp --version 0.0.1 --out dist --installer --sign -
+          # Exercise signing where CI can do it without secrets. On macOS,
+          # ad-hoc signing is verifiable; Windows signing correctly requires a
+          # real certificate and is covered by argument/tool failure behavior.
+          if [ "$RUNNER_OS" = "macOS" ]; then
+            raco glaze build --name sampleapp --version 0.0.1 --out dist --installer --sign -
+          else
+            raco glaze build --name sampleapp --version 0.0.1 --out dist --installer
+          fi
+          if [ "$RUNNER_OS" = "Linux" ]; then
+            test -s dist.tar.gz
+          fi
       - name: Verify macOS bundle signature
         if: runner.os == 'macOS'
         run: |
           codesign --verify --strict sampleapp/dist/sampleapp.app
           /usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" sampleapp/dist/sampleapp.app/Contents/Info.plist | grep -qx "0.0.1"
 
       - name: Upload distribution
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: glaze-${{ runner.os }}-dist
           path: |
@@ -143,3 +202,25 @@ jobs:
             sampleapp/dist/*.msi
             sampleapp/dist/*.dmg
             sampleapp/dist/*.AppImage
+
+  package-racket-9-3-macos:
+    # Regression coverage for the macOS/Racket 9.3 launcher failure reported
+    # in issue #1. This job executes the final packaged binary, not merely the
+    # build command.
+    runs-on: macOS-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+      - name: Install Racket
+        uses: Bogdanp/setup-racket@2466913449df77df2bad149d1f2fc4e1ea4795dd # v1.15
+        with:
+          version: '9.3'
+
+      - name: Install Glaze package
+        shell: bash
+        run: raco pkg install --auto --no-docs --link "$PWD"
+
+      - name: Verify packaged entry executes
+        run: racket scripts/package-entry-smoke.rkt

.gitignore

@@ -20,6 +20,17 @@ dist/
 
 # Build output
 build/
+dist.zip
+dist.tar.gz
+*.msi
+*.dmg
+*.AppImage
+*-setup.exe
+
+# Local signing / license secrets
+keys/private.pem
+*.p12
+*.pfx
 
 # showcase runtime artifacts (generated at startup / by self-check)
 examples/showcase/public/manifest.json