fix(release): integrate verified distribution lifecycle

.github/workflows/ci.yml

@@ -5,25 +5,44 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_call:
+    inputs:
+      source_sha:
+        description: Full source commit SHA to verify
+        required: true
+        type: string
+      tooling_sha:
+        description: Protected commit SHA containing the reusable CI workflow
+        required: true
+        type: string
 
 concurrency:
-  group: ci-${{ github.ref }}
+  group: ci-${{ inputs.source_sha || github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   build-check:
     name: Build and check
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.source_sha || github.sha }}
+          persist-credentials: false
+
+      - name: Verify source commit
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -43,10 +62,21 @@ jobs:
       - name: Check
         run: npm run check
 
+      - name: Check release packages
+        if: inputs.source_sha == ''
+        run: npm run check:release-packages
+
+      - name: Check workflow security contracts
+        if: inputs.source_sha == ''
+        working-directory: packages/coding-agent
+        run: node --test scripts/check-workflow-security.mjs
+
   test:
     name: Test (${{ matrix.name }})
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -84,11 +114,19 @@ jobs:
             command: npm run test:kernel
             install_uv: true
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.source_sha || github.sha }}
+          persist-credentials: false
+
+      - name: Verify source commit
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -105,26 +143,79 @@ jobs:
       - name: Build
         run: npm run build
 
-      - name: Install uv
+      - name: Install pinned uv
         if: matrix.install_uv
         run: |
-          python3 -m pip install --user uv
+          python3 -m pip install --user uv==0.11.33
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Test
         working-directory: ${{ matrix.package }}
         run: ${{ matrix.command }}
 
+  python-runtime:
+    name: Python runtime tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.source_sha || github.sha }}
+          persist-credentials: false
+
+      - name: Checkout protected Python lock
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.tooling_sha || github.sha }}
+          path: release-tooling
+          persist-credentials: false
+
+      - name: Verify source commit
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+
+      - name: Setup Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: '3.11.15'
+
+      - name: Install pinned uv
+        run: python -m pip install uv==0.11.33
+
+      - name: Install locked runtime test dependencies
+        run: uv sync --project release-tooling/prime-agent-runtime --frozen --group test
+
+      - name: Test exact source runtime
+        env:
+          PYTHONPATH: ${{ github.workspace }}/prime-agent-runtime
+        run: >-
+          uv run
+          --project release-tooling/prime-agent-runtime
+          --frozen
+          --group test
+          python -m unittest discover -s prime-agent-runtime/test -p 'test_*.py'
+
   build-check-test:
     name: build-check-test
     if: always()
-    needs: [build-check, test]
+    needs: [build-check, test, python-runtime]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
+      - name: Checkout protected CI tooling
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.tooling_sha || github.sha }}
+          persist-credentials: false
+
       - name: Verify CI results
-        env:
-          BUILD_CHECK_RESULT: ${{ needs.build-check.result }}
-          TEST_RESULT: ${{ needs.test.result }}
-        run: |
-          test "$BUILD_CHECK_RESULT" = success
-          test "$TEST_RESULT" = success
+        run: >-
+          node scripts/verify-ci-results.mjs
+          build-check=${{ needs.build-check.result }}
+          test=${{ needs.test.result }}
+          python-runtime=${{ needs.python-runtime.result }}

.github/workflows/nightly-process-stress.yml

@@ -9,20 +9,21 @@ concurrency:
   group: nightly-process-stress
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   process-stress:
     name: Process stress
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm