npm: refresh v0.4.0 CLI vendor payload

.github/scripts/test_npm_binary_package_scaffold.py

@@ -43,15 +43,15 @@
 SUPPORTED_TARGETS = {
     "darwin:arm64": {
         "binary": "ethos-darwin-arm64",
-        "binary_sha256": "777e1fb243425a46b83b63ed92fbf7cb810f59cfedd81cfe671cf791410c20dc",
+        "binary_sha256": "ac1ca14b5b9fe53abc6b58afd24d26d0d4d6b737566aa7b47f8f910ce858dcfd",
         "release_asset": "ethos-macos-arm64.tar.gz",
-        "release_asset_sha256": "efb163f140bf4afffd1caeb396f79e42f484591c3e90a86810ca6c0f0c209c96",
+        "release_asset_sha256": "f3393ea5c3be7b9f5e0ab4b0393bc103be908385ff5db9cd312911f7d5dcbe31",
     },
     "linux:x64": {
         "binary": "ethos-linux-x64",
-        "binary_sha256": "b416993fc38e6f794611b8b71789ed85af18eb6aa63fef380d9ae7738661f154",
+        "binary_sha256": "22367ad9efc2f4d51767afc147d4a15ecff2a6ce5f3c92998577c741b8e53915",
         "release_asset": "ethos-linux-x64.tar.gz",
-        "release_asset_sha256": "b549ba5968e04b7679a8d3e879cd45d27f3e9a6fd226eee5c270a4e4f5c01405",
+        "release_asset_sha256": "b3ba45fe21905e902c47e246d5a8f458e33c56b7db27a04fbbac9a70f861157d",
     },
 }
 EXPECTED_PACKAGE_FILES = {
@@ -114,7 +114,7 @@ def test_vendor_manifest_binds_supported_targets_to_release_assets(self) -> None
 
         self.assertEqual(1, manifest["version"])
         self.assertEqual("@docushell/ethos-pdf", manifest["package"])
-        self.assertEqual("0.3.0", manifest["cli_version"])
+        self.assertEqual("0.4.0", manifest["cli_version"])
         self.assertEqual(SUPPORTED_TARGETS, manifest["targets"])
         for target in manifest["targets"].values():
             self.assertRegex(target["release_asset_sha256"], r"^[a-f0-9]{64}$")

.github/scripts/test_package_registry_source_consistency.py

@@ -130,7 +130,7 @@ def validate_registry_surfaces(root: Path) -> list[str]:
     expected_publication = (
         f"The current published npm package is `{published_npm_name}@{published_npm_version}`."
     )
-    expected_binary_version = f"Its vendored CLI binaries report `ethos {cli_version}`."
+    expected_binary_version = f"Its vendored CLI binaries report `ethos {published_npm_version}`."
     expected_npm_install = f"npm install -g {published_npm_name}@{published_npm_version}"
     forbidden_postures = (
         re.compile(r"source package candidate", re.IGNORECASE),
@@ -154,9 +154,9 @@ def validate_registry_surfaces(root: Path) -> list[str]:
                 f"{path.relative_to(root)} is missing CLI version wording: {expected_binary_version}"
             )
         reported_versions = re.findall(rf"`ethos ({SEMVER})`", text)
-        if reported_versions != [cli_version]:
+        if reported_versions != [published_npm_version]:
             failures.append(
-                f"{path.relative_to(root)} must report only CLI version {cli_version}; "
+                f"{path.relative_to(root)} must report only CLI version {published_npm_version}; "
                 f"found {reported_versions}"
             )
         for pattern in forbidden_postures:
@@ -226,7 +226,7 @@ def write_fixture(
     )
     npm_text = (
         f"The current published npm package is `@docushell/ethos-pdf@{published_npm_version}`. "
-        f"Its vendored CLI binaries report `ethos {cli_version}`.\n"
+        f"Its vendored CLI binaries report `ethos {published_npm_version}`.\n"
     )
     (root / "python/README.md").write_text(python_text, encoding="utf-8")
     (root / "python/QUICKSTART.md").write_text(python_text, encoding="utf-8")
@@ -277,14 +277,13 @@ def test_rejects_npm_wording_stale_against_release_state(self) -> None:
             failures = validate_registry_surfaces(root)
         self.assertTrue(any("missing current-publication wording" in failure for failure in failures))
 
-    def test_rejects_cli_wording_stale_against_vendor_manifest(self) -> None:
+    def test_rejects_cli_wording_stale_against_published_npm_version(self) -> None:
         with tempfile.TemporaryDirectory(prefix="ethos-registry-consistency-") as temp:
             root = Path(temp)
             write_fixture(root)
-            manifest = root / "packages/npm/ethos-pdf/vendor/manifest.json"
-            manifest.write_text(
-                json.dumps({"version": 1, "cli_version": "0.3.2", "targets": {}}),
-                encoding="utf-8",
+            readme = root / "packages/npm/ethos-pdf/README.md"
+            readme.write_text(
+                read(readme).replace("`ethos 0.3.1`", "`ethos 0.3.2`"), encoding="utf-8"
             )
             failures = validate_registry_surfaces(root)
         self.assertTrue(any("missing CLI version wording" in failure for failure in failures))

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+- ci: keep the verification Action checksum-pinned to the published v0.3.0 CLI while npm
+  candidate vendor metadata advances to v0.4.0.
+- boundary-exception: refresh the v0.4.0 npm vendor manifest and macOS arm64/Linux x64 binaries
+  from the byte-identical caller-provided-PDFium CLI candidates; keep public installation wording
+  on the actually published 0.3.0 package until publication closeout.
 - boundary-exception: normalize CLI release archive metadata and gzip headers so repeated macOS arm64 and Linux
   x64 candidate builds are byte-identical before npm vendoring or publication.
 - build: remove unused Cargo Deny license allowances and document the unavoidable transitive

actions/verify/tests/test_action.py

@@ -32,6 +32,8 @@
 ACTION = Path(__file__).resolve().parents[1]
 ROOT = ACTION.parents[1]
 FIXTURES = Path(__file__).resolve().parent / "fixtures"
+PUBLISHED_LINUX_ARCHIVE_SHA256 = "b549ba5968e04b7679a8d3e879cd45d27f3e9a6fd226eee5c270a4e4f5c01405"
+PUBLISHED_LINUX_BINARY_SHA256 = "b416993fc38e6f794611b8b71789ed85af18eb6aa63fef380d9ae7738661f154"
 sys.path.insert(0, str(ACTION))
 
 import install_cli  # noqa: E402
@@ -173,10 +175,14 @@ def test_scratch_repository_fabricated_citation_fails(self) -> None:
     def test_action_is_pinned_and_example_is_short(self) -> None:
         action = (ACTION / "action.yml").read_text(encoding="utf-8")
         readme = (ACTION / "README.md").read_text(encoding="utf-8")
-        manifest = json.loads((ROOT / "packages/npm/ethos-pdf/vendor/manifest.json").read_text())
-        linux = manifest["targets"]["linux:x64"]
-        self.assertIn(linux["release_asset_sha256"], action)
-        self.assertIn(linux["binary_sha256"], action)
+        release_state = json.loads((ROOT / "docs/release-state.json").read_text(encoding="utf-8"))
+        published_version = release_state["release"]["npm_package"]["version"]
+        self.assertIn(
+            f"releases/download/v{published_version}/ethos-linux-x64.tar.gz",
+            action,
+        )
+        self.assertIn(PUBLISHED_LINUX_ARCHIVE_SHA256, action)
+        self.assertIn(PUBLISHED_LINUX_BINARY_SHA256, action)
         self.assertNotIn("cli-path", action)
         example = readme.split("```yaml\n", 1)[1].split("```", 1)[0]
         self.assertLessEqual(len(example.strip().splitlines()), 10)

packages/npm/ethos-pdf/test/platform-selection.test.js

@@ -49,7 +49,7 @@ assert.throws(
 const manifest = readVendorManifest();
 assert.strictEqual(manifest.version, 1);
 assert.strictEqual(manifest.package, "@docushell/ethos-pdf");
-assert.strictEqual(manifest.cli_version, "0.3.0");
+assert.strictEqual(manifest.cli_version, "0.4.0");
 validateVendorManifest(manifest);
 for (const [key, binaryName] of SUPPORTED_TARGETS.entries()) {
   assert.strictEqual(manifest.targets[key].binary, binaryName);

packages/npm/ethos-pdf/vendor/manifest.json

@@ -1,19 +1,19 @@
 {
   "version": 1,
   "package": "@docushell/ethos-pdf",
-  "cli_version": "0.3.0",
+  "cli_version": "0.4.0",
   "targets": {
     "darwin:arm64": {
       "binary": "ethos-darwin-arm64",
-      "binary_sha256": "777e1fb243425a46b83b63ed92fbf7cb810f59cfedd81cfe671cf791410c20dc",
+      "binary_sha256": "ac1ca14b5b9fe53abc6b58afd24d26d0d4d6b737566aa7b47f8f910ce858dcfd",
       "release_asset": "ethos-macos-arm64.tar.gz",
-      "release_asset_sha256": "efb163f140bf4afffd1caeb396f79e42f484591c3e90a86810ca6c0f0c209c96"
+      "release_asset_sha256": "f3393ea5c3be7b9f5e0ab4b0393bc103be908385ff5db9cd312911f7d5dcbe31"
     },
     "linux:x64": {
       "binary": "ethos-linux-x64",
-      "binary_sha256": "b416993fc38e6f794611b8b71789ed85af18eb6aa63fef380d9ae7738661f154",
+      "binary_sha256": "22367ad9efc2f4d51767afc147d4a15ecff2a6ce5f3c92998577c741b8e53915",
       "release_asset": "ethos-linux-x64.tar.gz",
-      "release_asset_sha256": "b549ba5968e04b7679a8d3e879cd45d27f3e9a6fd226eee5c270a4e4f5c01405"
+      "release_asset_sha256": "b3ba45fe21905e902c47e246d5a8f458e33c56b7db27a04fbbac9a70f861157d"
     }
   }
 }