ci(release): harden RxJS 9 single-maintainer publishing

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,10 @@
 <!--
 Thank you very much for your pull request!
 
+Use a Conventional Commit pull-request title because the squash-merge title
+selects the release version. Examples: `fix(core): repair teardown`,
+`feat(test): add scheduler helper`, or `feat(api)!: remove legacy behavior`.
+
 If your PR is the addition of a new operator, please make sure all these boxes are ticked with an x:
 
 - [ ] Add the operator to Rx

.github/actions/install-dependencies/action.yml

@@ -15,13 +15,13 @@ runs:
   using: 'composite'
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
       with:
         version: 10.34.5
         run_install: false
 
     - name: Use Node.js ${{ inputs.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: ${{ inputs.node-version }}
         registry-url: ${{ inputs.registry-url }}

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - security
+    open-pull-requests-limit: 5

.github/workflows/ci_main.yml

@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install dependencies
         uses: ./.github/actions/install-dependencies
@@ -58,7 +58,7 @@ jobs:
             advisory: true
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Fetch the RxJS 7 migration-evidence source
         run: git fetch --no-tags --depth=1 origin 7.x:7.x

.github/workflows/ci_ts_latest.yml

@@ -19,7 +19,7 @@ jobs:
     name: ts@latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Dependencies
         uses: ./.github/actions/install-dependencies

.github/workflows/codeql.yml

@@ -0,0 +1,28 @@
+name: CodeQL
+
+on:
+  push:
+    branches: ['master']
+  pull_request:
+    branches: ['master']
+  schedule:
+    - cron: '23 4 * * 2'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: CodeQL JavaScript and TypeScript
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          category: '/language:javascript-typescript'

.github/workflows/conventional-commit.yml

@@ -0,0 +1,25 @@
+name: Conventional Commit title
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  title:
+    name: Conventional Commit title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+      - name: Validate squash-merge title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: node scripts/release/validate-pr-title.mjs "$PR_TITLE"

.github/workflows/finalize-release.yml

@@ -0,0 +1,43 @@
+name: Finalize staged release
+
+on:
+  schedule:
+    - cron: '17 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  finalize:
+    name: Finalize fully approved release
+    runs-on: ubuntu-24.04
+    permissions:
+      attestations: read
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: '24.12.0', package-manager-cache: false }
+      - name: Install checked npm 11.18.0
+        run: |
+          npm_bin=$(node scripts/release/install-pinned-npm.mjs "$RUNNER_TEMP/npm-cli")
+          echo "$(dirname "$npm_bin")" >> "$GITHUB_PATH"
+      - name: Publish immutable GitHub Releases only after registry, signatures, and attestations verify
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api "repos/$GITHUB_REPOSITORY/releases?per_page=100" --jq '.[] | select(.draft == true) | .tag_name' | while read -r version; do
+            candidate_dir="$RUNNER_TEMP/$version"
+            mkdir -p "$candidate_dir"
+            gh release download "$version" --dir "$candidate_dir"
+            for tarball in "$candidate_dir"/*.tgz; do gh attestation verify "$tarball" --repo "$GITHUB_REPOSITORY"; done
+            if node scripts/release/finalize-release.mjs "$candidate_dir"; then
+              if [[ "$version" == *-* ]]; then
+                gh release edit "$version" --draft=false --prerelease --latest=false
+              else
+                gh release edit "$version" --draft=false --latest
+              fi
+            fi
+          done

.github/workflows/fuzz.yml

@@ -0,0 +1,26 @@
+name: Extended property fuzzing
+
+on:
+  schedule:
+    - cron: '23 6 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  fuzz:
+    name: Observable and release-policy properties
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - name: Install dependencies
+        uses: ./.github/actions/install-dependencies
+        with: { node-version: '24.12.0' }
+      - name: Run extended properties; fast-check reports the reproduction seed on failure
+        env: { RXJS_FUZZ_RUNS: 5000 }
+        run: |
+          pnpm --filter @rxjs/observable-polyfill exec vitest --run src/lifecycle.fuzz.spec.ts
+          node --test scripts/release/authorize-stage.test.mjs scripts/release/install-pinned-npm.test.mjs scripts/release/release-policy.test.mjs scripts/release/release-candidate.test.mjs scripts/release/stage-release.test.mjs

.github/workflows/observable-wpt.yml

@@ -36,29 +36,29 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install JavaScript dependencies
         uses: ./.github/actions/install-dependencies
         with:
           node-version: '24'
 
       - name: Install pinned Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ env.WPT_PYTHON }}
 
       - name: Install WPT native build dependencies
         run: sudo apt-get update && sudo apt-get install --yes libatspi2.0-dev libcairo2-dev libgirepository1.0-dev pkg-config
 
       - name: Restore pinned WPT runner
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .cache/rxjs-wpt/runner
           key: observable-wpt-runner-${{ runner.os }}-${{ runner.arch }}-python-${{ env.WPT_PYTHON }}-${{ env.WPT_COMMIT }}
 
       - name: Restore pinned browser
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .cache/rxjs-wpt/browser
           key: observable-wpt-browser-${{ runner.os }}-chrome-150.0.7871.126-${{ hashFiles('packages/observable-polyfill/test/wpt/browser-lock.json') }}
@@ -77,7 +77,7 @@ jobs:
 
       - name: Upload WPT evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: observable-wpt-pinned-${{ github.run_id }}
           if-no-files-found: warn
@@ -99,30 +99,30 @@ jobs:
     continue-on-error: true
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install JavaScript dependencies
         uses: ./.github/actions/install-dependencies
         with:
           node-version: '24'
 
       - name: Install pinned Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ env.WPT_PYTHON }}
 
       - name: Install WPT native build dependencies
         run: sudo apt-get update && sudo apt-get install --yes libatspi2.0-dev libcairo2-dev libgirepository1.0-dev pkg-config
 
       - name: Restore pinned WPT runner
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .cache/rxjs-wpt/runner
           key: observable-wpt-runner-${{ runner.os }}-${{ runner.arch }}-python-${{ env.WPT_PYTHON }}-${{ env.WPT_COMMIT }}
 
       - name: Install latest stable Chrome and matching driver
         id: chrome
-        uses: browser-actions/setup-chrome@v2
+        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
         with:
           chrome-version: stable
           install-chromedriver: true
@@ -153,7 +153,7 @@ jobs:
 
       - name: Upload WPT evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: observable-wpt-latest-chrome-${{ github.run_id }}
           if-no-files-found: warn

.github/workflows/osv.yml

@@ -0,0 +1,53 @@
+name: OSV vulnerability policy
+
+on:
+  pull_request:
+    branches: ['master']
+  push:
+    branches: ['master']
+  schedule:
+    - cron: '41 7 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: osv-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: No unreviewed release-reachable vulnerabilities
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
+        with: { version: 10.34.5, run_install: false }
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: '24.12.0', package-manager-cache: false }
+      - run: pnpm install --frozen-lockfile
+      - name: Reject expired, unowned, untracked, or overlong exceptions
+        run: node scripts/security/check-osv-exceptions.mjs
+      - run: mkdir -p .security
+      - name: Run full OSV scan with only reviewed docs-tooling exceptions
+        uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+        with:
+          scan-args: |-
+            --config=osv-scanner.toml
+            --format=json
+            --output-file=.security/osv-root.json
+            --lockfile=pnpm-lock.yaml
+      - name: Prove every remaining npm advisory path is isolated to apps/rxjs.dev
+        run: |
+          pnpm audit --json > .security/pnpm-audit.json || true
+          node scripts/security/check-osv-exceptions.mjs .security/pnpm-audit.json
+      - name: Preserve scan evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: osv-evidence-${{ github.run_id }}
+          path: .security
+          if-no-files-found: warn
+          retention-days: 30