🔐 Address PR #231 review findings: env leak, path resolution, a11y, CI hardening

[sergak01]

Summary

Addresses the CodeRabbit review findings left on PR #231 (develop → main) that we agreed to fix. Skips the package.json npx-vs-devDependency suggestion for semantic-release — that one is intentional (see reply) and left as is.

Key changes

• 🔐 fix(ci): reject leading-zero prerelease identifiers, pin npm for OIDC publishing — the release tag SemVer regex allowed purely-numeric prerelease identifiers with a leading zero (e.g. v1.0.0-01); tightened to match the SemVer spec. Also pins the npm upgrade step to a tested version instead of floating npm@latest.
• ♿ fix(ui): make the popup close control an accessible button — was a <div>, unreachable from the keyboard (undismissable when duration: 0). Now a native <button type="button"> with aria-label="Close", with button-chrome reset and a visible focus ring in CSS.
• 🔐 fix(env): stop MI_ values leaking across sequential project roots* — loadPPDevEnv folds already-set process.env values back into loadEnv()'s result, so a value loaded for one project root survived into the next root's load (and across watcher restarts) even when that root's own .env never set it. Now clears its previously-written keys before each reload.
• 🔐 fix(build): resolve packaging paths against the Vite project root — DistService and writeBuildVersionManifest resolved relative backup/build/dist-zip/manifest paths against process.cwd(), which only matches the intended project root by coincidence. Threaded an explicit root through DistService (from the resolved Vite/Next.js server config) and through writeBuildVersionManifest/versionPlugin (from Vite's resolvedConfig.root), defaulting to process.cwd() for backward compatibility.
• 🔧 fix(ui): handle failed variable editor fetches instead of hanging — loadSchema/loadValues had no rejection handling around fetch()/.json(), so a network failure left the "Refreshing…" indicator stuck forever. Wrapped in try/catch, surfaced through the existing error banner.
• 🧹 test: lazily import jsdom in variables-editor.spec.ts, per the heavy-module coding guideline.

Testing

• npx tsc --noEmit — clean
• npm run lint — clean
• npm run test:unit — 323/323 passing (adds tests/unit/lib/env.spec.ts, tests/unit/lib/dist.service.root.spec.ts, plus new cases in popup.spec.ts, variables-editor.spec.ts, version-manifest.spec.ts)
• npm run test:integration — 39/39 passing

---

Merge Request: origin/pp-3990-review-fixes → origin/develop

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a15d504d-d678-46b4-ad4f-f7df2e5f6168

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}