From 5cab7fb59f927affc5bf04140af27999fcfb8e06 Mon Sep 17 00:00:00 2001
From: Roger Chappel <miscanalysis@gmail.com>
Date: Sun, 14 Jun 2026 12:08:48 +1000
Subject: [PATCH 1/3] chore: publish package trust metadata

---
 package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4d7a56b..ad48768 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,8 @@
     "LICENSE",
     "SECURITY.md",
     "CHANGELOG.md",
-    "CONTRIBUTING.md"
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md"
   ],
   "scripts": {
     "check": "node scripts/check.mjs",

From 193168f9b3c2fce955195d1256b89db1f97dcfad Mon Sep 17 00:00:00 2001
From: Roger Chappel <miscanalysis@gmail.com>
Date: Sun, 14 Jun 2026 12:08:48 +1000
Subject: [PATCH 2/3] ci: run explicit npm verification

---
 .github/workflows/ci.yml | 105 ++++++++-------------------------------
 1 file changed, 21 insertions(+), 84 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92ebea6..ab53d0b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,95 +1,32 @@
 name: CI
 
 on:
-  pull_request:
   push:
-    branches:
-      - main
-  workflow_dispatch:
+    branches: [main]
+  pull_request:
+    branches: [main]
 
 permissions:
   contents: read
 
 jobs:
-  repository-hygiene:
-    name: Repository hygiene
+  verify:
     runs-on: ubuntu-latest
-
     steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
-
-      - name: Validate required project files
-        run: |
-          set -euo pipefail
-
-          required_files=(
-            README.md
-            LICENSE
-          )
-
-          for file in "${required_files[@]}"; do
-            test -s "$file"
-          done
-
-      - name: Validate markdown files are not empty
-        run: |
-          set -euo pipefail
-
-          markdown_count=0
-
-          while IFS= read -r -d '' file; do
-            markdown_count=$((markdown_count + 1))
-            test -s "$file"
-          done < <(find . -type f -name '*.md' -not -path './.git/*' -print0)
-
-          if [ "$markdown_count" -eq 0 ]; then
-            echo "No markdown files found."
-            exit 1
-          fi
-
-      - name: Run package verification
-        run: |
-          set -euo pipefail
-
-          if [ ! -f package.json ]; then
-            echo "No package.json found; skipping Node checks."
-            exit 0
-          fi
-
-          if [ -f pnpm-lock.yaml ]; then
-            corepack enable
-            pnpm install --frozen-lockfile
-            if node -e "process.exit(require('./package.json').scripts?.['release:check'] ? 0 : 1)"; then
-              pnpm run release:check
-            else
-              pnpm run check --if-present
-              pnpm test --if-present
-              pnpm run build --if-present
-              pnpm run smoke --if-present
-              pnpm run package:smoke --if-present
-            fi
-          elif [ -f package-lock.json ]; then
-            npm ci
-            if node -e "process.exit(require('./package.json').scripts?.['release:check'] ? 0 : 1)"; then
-              npm run release:check
-            else
-              npm run check --if-present
-              npm test --if-present
-              npm run build --if-present
-              npm run smoke --if-present
-              npm run package:smoke --if-present
-            fi
-          else
-            npm install
-            if node -e "process.exit(require('./package.json').scripts?.['release:check'] ? 0 : 1)"; then
-              npm run release:check
-            else
-              npm run check --if-present
-              npm test --if-present
-              npm run build --if-present
-              npm run smoke --if-present
-              npm run package:smoke --if-present
-            fi
-          fi
-
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - name: npm run check
+        run: npm run check
+      - name: npm run build
+        run: npm run build
+      - name: npm test
+        run: npm test
+      - name: npm run smoke
+        run: npm run smoke
+      - name: npm run package:smoke
+        run: npm run package:smoke

From 0ef6051716ba87ce1a8effc7301bb7cae5c7d553 Mon Sep 17 00:00:00 2001
From: Roger Chappel <miscanalysis@gmail.com>
Date: Sun, 14 Jun 2026 12:10:40 +1000
Subject: [PATCH 3/3] ci: support installs without a lockfile

---
 .github/workflows/ci.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ab53d0b..d37016e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,9 +17,8 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
       - name: Install dependencies
-        run: npm ci
+        run: npm install
       - name: npm run check
         run: npm run check
       - name: npm run build