ci(release): harden RxJS 9 single-maintainer publishing

[benlesh]

Summary

Implements the RxJS 9 single-maintainer security plan around the explicit reality that the same sole maintainer authors, reviews, merges, and releases changes.

• preserves the existing behavior where merging an ordinary PR automatically creates or refreshes the generated release PR
• requires zero human approvals while retaining mandatory automated branch checks
• makes self-merging the generated release PR start read-only qualification only
• requires a later manual run ID, version, and manifest SHA-512 authorization before npm staging
• separates that authorization into a no-OIDC job before the protected stage-only npm OIDC job
• retains separate npm WebAuthn approval, with rxjs approved last

Release and supply-chain controls

• builds twice on fresh Ubuntu 24.04 jobs with exact Node 24.12.0 and pnpm 10.34.5
• requires byte-identical tarballs, filenames, inventories, and SHA-512 values
• runs package, type, import, runtime, browser, Safari, alternate-runtime, performance, and WPT gates against the canonical candidate
• produces a release manifest, CycloneDX SBOM, isolated OSV result, portable GitHub attestation bundle, release lockfile, and exact tarballs
• verifies checked npm 11.18.0 by its registry SHA-512 before privileged use
• rejects stale, failed, expired, changed, non-current, unauthorized, or replayed staging attempts
• finalizes the GitHub Release only after registry integrity, npm signature/provenance, and GitHub attestation verification

Vulnerability and public-signal changes

• adds SHA-pinned OSV checks for PRs, master, weekly monitoring, and release candidates
• removes release/build/test-reachable advisory paths
• records 176 reviewed legacy-documentation OSV exceptions, all isolated to apps/rxjs.dev and expiring 2026-10-31
• adds bounded and scheduled fast-check properties for release authorization and Observable lifecycle behavior
• documents the RxJS 7/9 security support policy and consumer verification commands
• moves OpenSSF Scorecard out of the README headline and treats Code-Review 0 as an honest single-maintainer signal
• removes CODEOWNER, reviewer-team, succession-role, and direct-publish bootstrap assumptions

No runtime API, export, or compatibility change is intended.

Validation

• pnpm run release:check: 45 tests plus release doctor, package documentation, coherence, and OSV-exception policy
• pnpm run test:workflows
• pnpm install --frozen-lockfile
• pnpm run prepare-packages
• local two-candidate rehearsal: byte-identical four-package candidates
• 1,044 package/source tests
• all four type and import suites
• migration packing and migration-contract evidence
• the broader strict cold-compatibility command reproduced the reviewed 2,299-pass/39-failure baseline exactly

Required external setup before the first beta

P6.10 intentionally remains the sole NEXT item until the following are verified outside the repository:

• GitHub and npm WebAuthn plus offline recovery codes
• protected master and tag rulesets with zero approving reviews
• the reviewer-free npm-stage environment
• stage-only npm trusted publishers for all four packages
• removal of every reusable publish-capable npm credential
• a complete disposable-package rehearsal using only the sole maintainer account

[Copilot]

Pull request overview

This PR implements a single-maintainer–compatible RxJS 9 release security model by replacing token-based publishing and Nx-driven release automation with a repository-owned, reproducible qualification + typed manual staging authorization flow, backed by new CI workflows, scripts, and public documentation.

Changes:

• Replaces legacy release/publish scripts and workflows with a staged, reproducible, evidence-producing release pipeline (release PR → qualify → typed authorize → npm stage → finalize).
• Adds OSV exception policy tooling + scheduled/root scans, plus new release/security evidence docs and runbook updates.
• Introduces property-based fuzzing for Observable lifecycle invariants and release authorization/version policy logic.

Reviewed changes

Copilot reviewed 69 out of 71 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
SECURITY.md	Updates public security policy to reflect single-maintainer reality and links assurance doc.
scripts/security/generate-osv-baseline.mjs	Generates reviewed OSV ignore baseline from OSV + pnpm audit path classification.
scripts/security/check-osv-exceptions.test.mjs	Adds tests for OSV exception policy and audit completeness/path isolation.
scripts/security/check-osv-exceptions.mjs	Implements OSV exception validation and pnpm audit path classification.
scripts/release/wait-for-required-checks.mjs	Polls GitHub check-runs to ensure required master checks are successful.
scripts/release/validate-pr-title.mjs	Validates PR titles against the repo’s Conventional Commit policy.
scripts/release/validate-commit-message.mjs	Validates commit message titles (husky hook) via release policy.
scripts/release/stage-release.test.mjs	Tests stage output parsing, URL validation, byte verification, and comment rendering.
scripts/release/stage-release.mjs	Stages qualified tarballs to npm staging and renders approval/rejection instructions.
scripts/release/release-policy.test.mjs	Tests release selection/versioning rules and Conventional Commit parsing.
scripts/release/release-policy.mjs	Defines Conventional Commit parsing and RxJS 9 version selection rules.
scripts/release/release-doctor.mjs	Audits repo/workflow/toolchain invariants for the hardened release process.
scripts/release/release-config.mjs	Centralizes release package list, toolchain pins, and npm URL validation.
scripts/release/release-candidate.test.mjs	Tests manifest integrity, byte hashing, reproducibility compare, and inventory enforcement.
scripts/release/release-candidate.mjs	Builds/verifies release candidates (pack, hash, manifest, hydrate, evidence recording).
scripts/release/prepare-release-pr.mjs	Generates/refreshes the release PR (versions, changelog, allowlisted edits).
scripts/release/install-pinned-npm.test.mjs	Tests registry integrity verification for the pinned npm CLI tarball.
scripts/release/install-pinned-npm.mjs	Fetches/verifies pinned npm CLI by integrity before privileged use.
scripts/release/generate-release-evidence.mjs	Generates SBOM + release lockfile and records them as candidate evidence.
scripts/release/finalize-release.mjs	Verifies registry integrity + npm signatures before publishing the draft GitHub Release.
scripts/release/compare-release-candidates.mjs	Compares two independent candidate builds and produces canonical reproducible output.
scripts/release/check-release-bot-diff.mjs	Enforces allowlisted file boundary for release PR automation diffs.
scripts/release/authorize-stage.test.mjs	Tests typed manual staging authorization across all critical dimensions.
scripts/release/authorize-stage.mjs	Validates typed staging authorization against workflow run, artifact, head SHA, etc.
scripts/release/authorize-release-commit.test.mjs	Tests selection of the authorizing release PR for a merge commit.
scripts/release/authorize-release-commit.mjs	Ensures only the expected repo-owned release PR authorizes qualification/staging.
scripts/release.js	Removes legacy Nx-based release entrypoint script.
scripts/publish.js	Removes legacy token-based publish script and dist-tag logic.
scripts/check-release-coherence.test.mjs	Updates coherence tests for new release workflow and policy inputs.
scripts/check-release-coherence.mjs	Updates coherence checks to reflect removal of Nx release + new workflows/policy sources.
README.md	Moves Scorecard out of headline; links runbook and security assurance docs.
pnpm-workspace.yaml	Extends allowBuilds for updated Nx version lane.
packages/test/src/types.ts	Changes TestMessage export shape (interface → type alias).
packages/rxjs/src/notification.ts	Refactors Notification#do implementation to explicit if/else.
packages/rxjs/README.md	Links the new security assurance documentation.
packages/rxjs/package.json	Fixes repository/bugs URL case and updates esbuild version.
packages/rxjs/docs/SECURITY_ASSURANCE.md	Adds detailed RxJS 9 security assurance and verification guidance.
packages/rxjs/docs/RELEASE_GATES.md	Links secure release runbook and clarifies gates vs publication authority.
packages/rxjs/docs/PRERELEASE_APPROVAL.md	Updates approval doc to reference secure staged release workflow/runbook.
packages/observable-polyfill/src/lifecycle.fuzz.spec.ts	Adds fast-check lifecycle state-machine property test.
packages/observable-polyfill/src/index.ts	Documents intentional global interface merging; suppresses empty-object-type lint.
packages/observable-polyfill/package.json	Adds fast-check devDependency for fuzz properties.
packages/migrate/package.json	Pins vitest to an exact version (removes caret).
package.json	Replaces release scripts, expands release checks, pins/upgrades toolchain deps, adds overrides.
osv-scanner.toml	Adds generated reviewed OSV ignore list with expirations and reasons.
nx.json	Removes Nx “release” configuration block.
docs/security/LEGACY_DOCS_VULNERABILITIES.md	Tracks legacy docs-app vulnerability backlog + review cadence.
docs/rxjs-next/PROJECT_PLAN.md	Advances plan status and records P6.10 implementation evidence/session notes.
docs/rxjs-next/DECISIONS.md	Records D-057 decision for single-maintainer staged release process.
docs/rxjs-next/ARCHITECTURE.md	Documents single-maintainer release boundary architecture.
docs/RELEASE_PROCESS.md	Adds the public secure release runbook and one-time setup checklist.
.gitignore	Broadens Nx ignore from .nx/cache to .nx/.
.github/workflows/release-stage.yml	Adds manual typed authorization + npm staging workflow with OIDC boundary separation.
.github/workflows/release-readiness.yml	Pins action SHAs (checkout/setup-deno/setup-bun) for determinism/security.
.github/workflows/release-qualify.yml	Adds reproducible two-build qualification pipeline + evidence generation/attestation.
.github/workflows/release-pr.yml	Adds release PR generator workflow using GitHub App token and required-check polling.
.github/workflows/release-doctor.yml	Adds scheduled/manual read-only doctor workflow.
.github/workflows/rebase.yml	Pins actions to SHAs and fixes formatting.
.github/workflows/publish.yml	Removes legacy publish workflow (token-based publish path).
.github/workflows/osv.yml	Adds OSV policy workflow + exception validation + artifacted evidence.
.github/workflows/observable-wpt.yml	Pins actions/cache/upload-artifact/setup-python/setup-chrome to SHAs.
.github/workflows/fuzz.yml	Adds scheduled extended fuzzing workflow for lifecycle + release properties.
.github/workflows/finalize-release.yml	Adds scheduled/manual GitHub Release finalization after registry/signature checks.
.github/workflows/conventional-commit.yml	Adds PR-title Conventional Commit validation workflow.
.github/workflows/codeql.yml	Adds CodeQL scanning workflow for JS/TS.
.github/workflows/ci_ts_latest.yml	Pins checkout action SHA.
.github/workflows/ci_main.yml	Pins checkout action SHA.
.github/PULL_REQUEST_TEMPLATE.md	Documents Conventional Commit PR title requirement for release selection.
.github/dependabot.yml	Adds Dependabot updates for GitHub Actions.
.github/actions/install-dependencies/action.yml	Pins pnpm/setup-node action SHAs in composite action.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.