🚀 Promote develop to main: security & reliability fixes (build outputs, variable editor, unsafe HTML, CI hardening)

.github/workflows/release-beta.yml

@@ -1,7 +1,9 @@
 name: Beta Release
 
 on:
-  push:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
     branches: [develop]
   # Manual re-run for releases that failed mid-way: `[skip ci]` release commits
   # never trigger the push event, and re-running a failed run pins the old SHA,
@@ -13,21 +15,52 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
+  actions: read
   contents: write
   issues: write
   pull-requests: write
 
 jobs:
   release-beta:
-    # Guard manual runs: beta releases may only be dispatched from develop.
-    if: github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/develop'
+    # Automatic releases require a successful push-triggered CI run on develop.
+    # Manual retries are restricted to develop and verify that its current SHA passed CI below.
+    if: >-
+      (github.event_name == 'workflow_run' &&
+       github.event.workflow_run.event == 'push' &&
+       github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.head_branch == 'develop') ||
+      (github.event_name == 'workflow_dispatch' &&
+       github.ref == 'refs/heads/develop')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+
+      - name: Verify successful CI for manual release
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ci_run_id="$(gh run list \
+            --workflow ci.yml \
+            --branch develop \
+            --commit "$GITHUB_SHA" \
+            --event push \
+            --status success \
+            --limit 1 \
+            --json databaseId \
+            --jq '.[0].databaseId // empty')"
+
+          if [[ -z "$ci_run_id" ]]; then
+            echo "No successful CI run found for develop commit $GITHUB_SHA"
+            exit 1
+          fi
+
+          echo "Verified successful CI run: $ci_run_id"
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -61,4 +94,4 @@ jobs:
       - name: Release Beta
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npx semantic-release
+        run: npm run release

.github/workflows/release.yml

@@ -26,8 +26,10 @@ jobs:
         run: |
           TAG="${INPUT_TAG:-$GITHUB_REF_NAME}"
 
-          if [[ "$TAG" != v* ]]; then
-            echo "This workflow must be run against a version tag (e.g. v1.0.0), or pass the 'tag' input when dispatching from a branch."
+          # Prerelease identifiers follow SemVer: a purely-numeric identifier must not have a
+          # leading zero (e.g. "01" is invalid), but an identifier containing a letter/hyphen may.
+          if [[ ! "$TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
+            echo "Tag must be a valid SemVer value prefixed with v (for example, v1.0.0 or v1.0.0-beta.2)."
             exit 1
           fi
 
@@ -48,10 +50,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          ref: ${{ steps.version.outputs.git_tag }}
+          ref: refs/tags/${{ steps.version.outputs.git_tag }}
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Verify release tag
+        env:
+          GIT_TAG: ${{ steps.version.outputs.git_tag }}
+        run: git show-ref --verify --quiet "refs/tags/$GIT_TAG"
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
@@ -77,13 +84,19 @@ jobs:
       # chore(release) commit where package.json already carries the tag's version;
       # plain `npm version` fails with "Version not changed" there.
       - name: Update package version
-        run: npm version ${{ steps.version.outputs.version }} --no-git-tag-version --allow-same-version
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: npm version "$VERSION" --no-git-tag-version --allow-same-version
 
+      # Pinned (not @latest) so the OIDC trusted-publishing toolchain is reproducible and
+      # reviewed — bump this deliberately via a dependency update, not implicitly on each run.
       - name: Upgrade npm for OIDC trusted publishing
-        run: npm install -g npm@latest --no-audit
+        run: npm install -g npm@11.17.0 --no-audit
 
       - name: Publish to npm
-        run: npm publish --access public --tag ${{ steps.version.outputs.tag }}
+        env:
+          NPM_DIST_TAG: ${{ steps.version.outputs.tag }}
+        run: npm publish --access public --tag "$NPM_DIST_TAG"
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3

e2e/toolbar/toolbar.minimize.spec.ts

@@ -1,7 +1,15 @@
-import { test, expect } from '@playwright/test';
+import { test, expect, type Locator } from '@playwright/test';
 
 const testType = process.env.TEST_TYPE;
 
+async function waitForPanelTransition(minimizeBtn: Locator): Promise<void> {
+  await minimizeBtn.evaluate(async (button) => {
+    const panel = button.closest('.pp-dev-info');
+
+    await Promise.all(panel?.getAnimations().map((animation) => animation.finished) ?? []);
+  });
+}
+
 test.describe('Toolbar Minimize Functionality', () => {
   // Skip toolbar tests for Next.js
   test.skip(testType?.includes('nextjs') ?? false, 'Skipping toolbar tests for Next.js');
@@ -53,6 +61,8 @@ test.describe('Toolbar Minimize Functionality', () => {
     await minimizeBtn.click({ force: true });
     await expect(toolbar).toHaveClass(/closed/);
 
+    await waitForPanelTransition(minimizeBtn);
+
     // Restore
     await minimizeBtn.click({ force: true });
     await expect(toolbar).not.toHaveClass(/closed/);
@@ -121,6 +131,10 @@ test.describe('Toolbar Minimize Functionality', () => {
     // SVG should have 'closed' class
     await expect(minimizeSvg).toHaveClass(/closed/);
 
+    // The panel moves while minimizing. Wait for that transition so the next mouse click
+    // targets the button at its settled position instead of coordinates it has already left.
+    await waitForPanelTransition(minimizeBtn);
+
     // Click to restore
     await minimizeBtn.click({ force: true });