@blamejs/blamejs-shop 0.2.12 → 0.2.13

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.13 (2026-05-28) — **Product-grid and product-page visual polish.** Small visual refinements to the catalog grid and product page. Product tiles previously all carried the same fixed corner glow, so a grid of them read as one card stamped repeatedly; the glow position now rotates per tile so the grid looks like a designed set. The product page's buy box gets clearer elevation so it reads as a distinct purchase surface, and the fallback placeholder shown for a product with no image is now legible on the dark theme instead of a near-invisible mark. **Changed:** *Product tiles no longer share one identical glow* — Each product card's media glow now rotates through a set of positions per tile (matching the collection cards) instead of every tile glowing in the exact same corner, so a full grid reads as a designed set rather than a single card repeated. · *Clearer product-page buy box* — The product page's buy box gains a stronger border and a soft shadow so it stands out from the page as the purchase surface. · *Legible image-less placeholder* — The fallback artwork shown when a product has no image was nearly invisible on the dark canvas; its contrast is lifted (grid lines, shield detail, and caption) so it reads as an intentional placeholder. Applied identically on the edge and container render paths.
+
 - v0.2.12 (2026-05-28) — **Truthful product availability and real SEO metadata — canonical URLs, structured data, and per-page descriptions.** Two related improvements to the storefront's honesty and discoverability. Product pages now report real availability from inventory (instead of a hardcoded 'In stock') and reflect it in their structured data, and the shipping line is suppressed for digital products. Separately, every page now emits a canonical URL and a populated Open Graph URL (previously empty — which broke social-share unfurls and let sort/currency query parameters fork into duplicate indexed pages), the home page emits the same Organization/Website structured data the edge already did, breadcrumb structured data uses absolute URLs, and the home, category, and search pages get their own meta descriptions instead of one shared default. The footer's account links are regrouped and a shipping-and-returns link was added. **Changed:** *Product availability is truthful* — The product page's stock badge and its `Product`/`AggregateOffer` structured-data `availability` are now driven by real per-SKU inventory (`InStock` / `OutOfStock`) rather than a hardcoded value, so a sold-out item reads as sold out everywhere and structured data no longer mismatches reality. The shipping-time line is suppressed for all-digital products (shown as delivered on purchase). Identical across the edge and container render paths. · *Footer account links regrouped* — The footer's operator-oriented column is now a customer 'Your account' grouping (Account / Orders / Contact), the public Admin link was removed, and a 'Shipping & returns' link was added to the policy area. · *Form fields are legible on the dark theme* — Text inputs, selects, and textareas (checkout, address book, search, sign-in) previously rendered with a 10%-opacity hairline that disappeared against the near-black canvas — fields read as empty voids. They now have a clearly-bounded outline and a lifted fill, stretch to fill their column, and the rule covers `tel`/`url`/`password` inputs it previously missed. **Fixed:** *Canonical + Open Graph URLs on every page* — Every page now includes `<link rel="canonical">` and a populated `og:url` (both were absent/empty before). This fixes social-share previews that unfurled with no link target and prevents tracking/sort/currency query-string variants from being indexed as duplicate pages. Emitted on both render paths, derived from the request's own origin. · *Consistent structured data + unique page descriptions* — The home page now emits the `Organization` and `WebSite` (search-action) structured data that previously only appeared on the edge render, breadcrumb structured-data item URLs are absolute (so the breadcrumb rich result is eligible), and the home, category, and search pages each carry their own meta/OG description instead of sharing one generic string.
 
 - v0.2.11 (2026-05-27) — **A clearer checkout — itemised order summary, honest pricing, and recoverable errors.** Reworks the checkout and cart experience. Checkout now uses the same two-column layout as the cart, with a sticky order-summary rail that lists the actual items being bought (thumbnail, title, quantity, line total) rather than a bare number in a lonely column. The summary no longer shows a misleading 'Total' equal to the subtotal — it shows the subtotal plus an honest note that tax and shipping are calculated at the payment step, matching the cart. Adding an item now confirms it and offers to keep shopping, checkout and cart failures render as proper pages you can recover from instead of a blank error string, required fields announce themselves to screen readers, and the header 'Framework' link works from every page. **Changed:** *Checkout shows an itemised, sticky order summary* — The checkout page adopts the cart's two-column layout: the shipping form on the left and a sticky order summary on the right that lists each item (thumbnail, title, quantity, line total) with an 'Edit cart' link back to the cart. Previously the form was a narrow column with a bare subtotal box and no way back. · *Honest checkout pricing* — The order summary no longer renders a 'Total (plus tax + shipping)' line bound to the subtotal value (which read as the final price but wasn't). It now shows the subtotal and the same honest note the cart uses — tax and shipping are calculated at the payment step. · *Add-to-cart confirmation + continue shopping* — Adding an item lands on the cart with a dismissible 'Added to cart' confirmation, and the cart now has a 'Continue shopping' link so multi-item shoppers aren't dead-ended. **Fixed:** *Checkout and cart errors are recoverable, not blank pages* — A declined gift card, an invalid input, or a checkout failure previously dumped an unstyled plain-text error. These now render as styled pages with the reason and a way back — gift-card and loyalty errors re-display the checkout form with the message inline so the shopper can correct it without losing their place. · *Required fields announce to screen readers* — Required form fields kept only a red asterisk (color-only); they now include a visually-hidden '(required)' so assistive technology conveys it. · *Header 'Framework' link works on every page* — It pointed at an on-page anchor that only existed on the home page (a no-op elsewhere); it now resolves from any page.

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.2.12",
+  "version": "0.2.13",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
       "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
     },
     "css/main.css": {
-      "integrity": "sha384-4n7LcnY4MZQmhe0dlnwm50HaOyzJ0QMqtb7b70N9qO20B4LJ858lMOxXuua7aFYz",
-      "fingerprinted": "css/main.666c51fd74364739.css"
+      "integrity": "sha384-E56XcvNC5nbTWyHJJcepF6sVA1KjRNo/MWFL5F5w2PDN10JNaHdzIAP9a46m2Md8",
+      "fingerprinted": "css/main.a76d36ac566703d6.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/storefront.js

@@ -696,7 +696,7 @@ var PRODUCT_CARD_IMAGE =
 var PRODUCT_CARD =
   "<a class=\"product-card\" href=\"/products/{{slug}}\">\n" +
   "  <figure class=\"product-card__media product-card__media--placeholder\">\n" +
-  "    <svg class=\"media-ph__svg\" viewBox=\"0 0 160 120\" aria-hidden=\"true\"><rect width=\"160\" height=\"120\" fill=\"none\"/><g stroke=\"currentColor\" stroke-opacity=\"0.10\" stroke-width=\"1\"><path d=\"M0 30 H160 M0 60 H160 M0 90 H160 M40 0 V120 M80 0 V120 M120 0 V120\"/></g><g fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M80 38 L104 50 L104 76 L80 88 L56 76 L56 50 Z\"/><path d=\"M56 50 L80 62 L104 50 M80 62 V88\" stroke=\"#732A8D\"/><path d=\"M70 47 L74 50 L70 53\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M77 54 H86\" stroke=\"currentColor\" stroke-width=\"2\"/></g><text x=\"80\" y=\"106\" text-anchor=\"middle\" font-family=\"ui-monospace,Menlo,Consolas,monospace\" font-size=\"9\" letter-spacing=\"1.5\" fill=\"#6b6b78\">no image yet</text></svg>\n" +
+  "    <svg class=\"media-ph__svg\" viewBox=\"0 0 160 120\" aria-hidden=\"true\"><rect width=\"160\" height=\"120\" fill=\"none\"/><g stroke=\"currentColor\" stroke-opacity=\"0.18\" stroke-width=\"1\"><path d=\"M0 30 H160 M0 60 H160 M0 90 H160 M40 0 V120 M80 0 V120 M120 0 V120\"/></g><g fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M80 38 L104 50 L104 76 L80 88 L56 76 L56 50 Z\"/><path d=\"M56 50 L80 62 L104 50 M80 62 V88\" stroke=\"#C75BE8\"/><path d=\"M70 47 L74 50 L70 53\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M77 54 H86\" stroke=\"currentColor\" stroke-width=\"2\"/></g><text x=\"80\" y=\"106\" text-anchor=\"middle\" font-family=\"ui-monospace,Menlo,Consolas,monospace\" font-size=\"9\" letter-spacing=\"1.5\" fill=\"#9b9ba7\">no image yet</text></svg>\n" +
   "  </figure>\n" +
   "  <div class=\"product-card__meta\">\n" +
   "    <h3 class=\"product-card__title\">{{title}}</h3>\n" +

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.22",
-      "tag": "v0.13.22",
+      "version": "0.13.24",
+      "tag": "v0.13.24",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/.github/workflows/actions-lint.yml

@@ -50,6 +50,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install pinact (release binary + sha256 verify)
         # Install pinact directly from the upstream release binary
@@ -106,32 +108,43 @@ jobs:
     name: zizmor — workflow security audit
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    permissions:
-      contents: read
-      security-events: write   # required for SARIF upload to Code Scanning
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
-      - name: Install uv (zizmor distribution)
-        uses: astral-sh/setup-uv@69d3e2780fa0ea7da961bfbb898be32a9b1d10b1  # v7.0.0
+      - name: Install zizmor (release binary + sha256 verify)
+        # Direct release-binary install instead of astral-sh/setup-uv + uvx.
+        # setup-uv (a third-party action) startup_failures the whole
+        # workflow on the current runner — the same class of failure as the
+        # raven-actions/actionlint composite that took down the actionlint
+        # job (no jobs, no logs). A run: step cannot startup_failure.
+        # zizmor publishes no checksums file, so the expected sha256 is
+        # pinned inline; a mismatch fails closed.
+        env:
+          ZIZMOR_VERSION: v1.18.0
+          ZIZMOR_SHA256:  8e7901319ab7b71c38d6d388a48e02ff65791e5971b2ee6577c9b5c3ab44c65f
+        run: |
+          set -euo pipefail
+          curl -fsSLo /tmp/zizmor.tar.gz "https://github.com/zizmorcore/zizmor/releases/download/${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+          ACTUAL=$(sha256sum /tmp/zizmor.tar.gz | awk '{print $1}')
+          if [ "$ACTUAL" != "$ZIZMOR_SHA256" ]; then
+            echo "::error::zizmor tarball sha256 ${ACTUAL} does not match pinned ${ZIZMOR_SHA256}"
+            exit 1
+          fi
+          mkdir -p /tmp/zizmor-bin
+          tar -xzf /tmp/zizmor.tar.gz -C /tmp/zizmor-bin ./zizmor
+          sudo install -m 0755 /tmp/zizmor-bin/zizmor /usr/local/bin/zizmor
+          zizmor --version
 
       - name: Run zizmor (fail on level=low across every rule class)
-        # `--min-severity low` flags every documented class. Suppression
-        # requires an inline `# zizmor: ignore[<rule>] — <reason>` per
-        # the spec.
+        # Pure run-gate: zizmor exits non-zero on any finding, failing the
+        # job. Inline `# zizmor: ignore[<rule>] — <reason>` is the
+        # suppression mechanism for reviewed exceptions.
         run: |
           set -euo pipefail
-          uvx zizmor@1.18.0 --min-severity low --format sarif . > zizmor.sarif || EXIT=$?
-          uvx zizmor@1.18.0 --min-severity low . || true   # human-readable output for the step log
-          if [ "${EXIT:-0}" != "0" ]; then exit "$EXIT"; fi
-
-      - name: Upload SARIF to Code Scanning
-        if: always()
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
-        with:
-          sarif_file: zizmor.sarif
-          category: zizmor
+          zizmor --min-severity low --no-progress .github/workflows/
 
   actionlint:
     name: actionlint — YAML + expression + shellcheck on `run:` blocks
@@ -140,9 +153,44 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-
-      - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8  # v2.1.2
         with:
-          fail_on_error: true
-          shellcheck: true
+          persist-credentials: false
+
+      - name: Install actionlint (release binary + sha256 verify)
+        # Direct release-binary install instead of the
+        # raven-actions/actionlint composite action. That composite (v2.1.2,
+        # the latest release) startup_failures on the current runner, taking
+        # the whole workflow down before any job runs — which is why this
+        # gate never ran from v0.11.21 onward. The binary path also drops the
+        # composite's transitive github-script / cache action surface, which
+        # fits the gate whose entire purpose is pinning discipline. Mirrors
+        # the pinact install step above.
+        env:
+          ACTIONLINT_VERSION: v1.7.12
+        run: |
+          set -euo pipefail
+          V="${ACTIONLINT_VERSION#v}"
+          curl -fsSLo /tmp/actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/${ACTIONLINT_VERSION}/actionlint_${V}_linux_amd64.tar.gz"
+          curl -fsSLo /tmp/actionlint-checksums.txt "https://github.com/rhysd/actionlint/releases/download/${ACTIONLINT_VERSION}/actionlint_${V}_checksums.txt"
+          ACTUAL=$(sha256sum /tmp/actionlint.tar.gz | awk '{print $1}')
+          EXPECTED=$(grep "actionlint_${V}_linux_amd64.tar.gz\$" /tmp/actionlint-checksums.txt | awk '{print $1}')
+          if [ -z "$EXPECTED" ]; then
+            echo "::error::could not find actionlint_${V}_linux_amd64.tar.gz line in upstream checksums"
+            exit 1
+          fi
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "::error::actionlint tarball sha256 ${ACTUAL} does not match upstream-published ${EXPECTED}"
+            exit 1
+          fi
+          mkdir -p /tmp/actionlint-bin
+          tar -xzf /tmp/actionlint.tar.gz -C /tmp/actionlint-bin actionlint
+          sudo install -m 0755 /tmp/actionlint-bin/actionlint /usr/local/bin/actionlint
+          actionlint --version
+
+      - name: Run actionlint (+ shellcheck on every run block)
+        # shellcheck ships preinstalled on ubuntu-latest; actionlint invokes
+        # it automatically on each `run:` block. Non-zero exit on any finding
+        # keeps this a hard gate (the raven composite's fail_on_error: true).
+        run: |
+          set -euo pipefail
+          actionlint -color

package/lib/vendor/blamejs/.github/workflows/cflite_batch.yml

@@ -69,6 +69,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

package/lib/vendor/blamejs/.github/workflows/cflite_pr.yml

@@ -80,6 +80,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

package/lib/vendor/blamejs/.github/workflows/ci.yml

@@ -52,6 +52,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -106,6 +108,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -126,6 +130,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -149,6 +155,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -168,6 +176,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           # gitleaks scans full history on a non-shallow checkout, so an
           # accidentally-committed secret in any prior commit on the
           # branch is caught even if a later commit reverts it. The
@@ -225,6 +234,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -254,6 +265,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -294,6 +307,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Run Hadolint (strict, all severities)
         # `--no-fail` is OFF; any error or warning fails the job.
@@ -336,6 +351,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Detect shell scripts
         id: sh

package/lib/vendor/blamejs/.github/workflows/npm-publish.yml

@@ -94,6 +94,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -102,11 +104,14 @@ jobs:
 
       - name: Compute version + is_tag flag
         id: version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF: ${{ github.ref }}
         run: |
           set -euo pipefail
           PKG_VERSION=$(node -e "console.log(require('./package.json').version)")
           echo "version=$PKG_VERSION" >> "$GITHUB_OUTPUT"
-          if [ "${{ github.event_name }}" = "push" ] && [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+          if [ "$EVENT_NAME" = "push" ] && [[ "$REF" == refs/tags/v* ]]; then
             TAG_VERSION="${GITHUB_REF#refs/tags/v}"
             echo "is_tag=true" >> "$GITHUB_OUTPUT"
             if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
@@ -132,7 +137,7 @@ jobs:
 
       - name: ShellCheck
         if: steps.shells.outputs.found == 'true'
-        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca  # v2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # 2.0.0
         with:
           severity: error
 
@@ -229,7 +234,7 @@ jobs:
         id: subjects
         run: |
           set -euo pipefail
-          TARBALL=$(basename "$(ls dist/*.tgz | head -1)")
+          TARBALL=$(basename "$(find dist -maxdepth 1 -name '*.tgz' | head -1)")
           HASHES=$(
             (cd dist && sha256sum "$TARBALL") && \
             sha256sum sbom.cdx.json sbom.vendored.cdx.json
@@ -292,7 +297,9 @@ jobs:
     # repo specifically so the SLSA tag-pin call is permitted. The
     # `slsa-action-not-pinned` codebase-patterns detector allowlists
     # this specific callsite (see test/layer-0-primitives/codebase-patterns.test.js).
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # allow:slsa-framework-action-not-sha-pinned — SLSA's internal builder-fetch refuses non-tag refs; mitigated by slsa-framework's upstream tag-protection + immutable-release rules
+    # SLSA's reusable builder workflow refuses non-tag refs (cannot be
+    # SHA-pinned); upstream tag-protection + immutable releases mitigate.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # zizmor: ignore[unpinned-uses] allow:slsa-framework-action-not-sha-pinned — SLSA's internal builder-fetch refuses non-tag refs; mitigated by slsa-framework's upstream tag-protection + immutable-release rules
     with:
       base64-subjects:    "${{ needs.validate.outputs.hashes }}"
       upload-assets:      false
@@ -410,6 +417,7 @@ jobs:
         # and failed immediately on the first PQC release run.
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           path: src
 
       - name: Release-digest sidecars (SHA-256 + SHA3-512)
@@ -424,7 +432,7 @@ jobs:
         # Both written in `<sha>  <filename>` sha-sum-compatible format.
         run: |
           set -euo pipefail
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           node src/scripts/sha3-digest.js "$TARBALL"
 
       - name: PQC sidecar — ML-DSA-65 signature of the tarball
@@ -463,7 +471,7 @@ jobs:
             echo "available=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           # The signer expects keys/release-pqc-pub.json at the
           # framework root for the self-verify cross-check. Symlink
           # the checked-out src/keys/ into the working directory so
@@ -514,11 +522,11 @@ jobs:
           set -euo pipefail
           if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "::error::Release $TAG already exists. The workflow is authoritative for release creation as of v0.11.7."
-            echo "::error::Manual `gh release create` was removed from the release workflow in v0.11.7."
-            echo "::error::Either delete the existing release (`gh release delete $TAG`) and re-run this workflow, OR push a new tag."
+            echo "::error::Manual 'gh release create' was removed from the release workflow in v0.11.7."
+            echo "::error::Either delete the existing release with 'gh release delete $TAG' and re-run this workflow, OR push a new tag."
             exit 1
           fi
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           # Title comes from the structured release-notes JSON's
           # `headline` field — single source of truth. Format:
           # `vX.Y.Z — <headline>`.
@@ -594,7 +602,7 @@ jobs:
         # mis-classifies a relative path containing `/` as a git
         # spec.
         run: |
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           echo "Publishing: $TARBALL"
           npm publish "./${TARBALL}" --provenance --access public
         env:

package/lib/vendor/blamejs/.github/workflows/release-container.yml

@@ -57,6 +57,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -73,6 +75,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Run Hadolint (strict, all severities)
         uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5  # v3.3.0
         with:
@@ -88,6 +92,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Detect shell scripts
         id: sh
         run: |
@@ -97,7 +103,7 @@ jobs:
           echo "found=$count" >> "$GITHUB_OUTPUT"
       - name: Run ShellCheck
         if: steps.sh.outputs.found != '0'
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # v2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # 2.0.0
         with:
           severity: style
           format:   tty
@@ -118,16 +124,18 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU (for ARM64 cross-build)
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
 
       - name: Log in to GHCR
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -162,7 +170,7 @@ jobs:
       # Note: load: true forces single-arch (amd64). The multi-arch
       # build happens on the post-scan push step below.
       - name: Build (local-only, for Trivy)
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: examples/wiki/Dockerfile
@@ -210,7 +218,7 @@ jobs:
       - name: Push (multi-arch, after Trivy gate)
         id: push
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' }}
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: examples/wiki/Dockerfile
@@ -236,7 +244,7 @@ jobs:
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' && steps.push.outputs.digest }}
         env:
           DIGEST: ${{ steps.push.outputs.digest }}
-        run: cosign sign --yes "${{ env.IMAGE }}@${DIGEST}"
+        run: cosign sign --yes "${IMAGE}@${DIGEST}"
 
       - name: Generate SHA3-512 digest
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' && steps.push.outputs.digest }}
@@ -245,8 +253,8 @@ jobs:
           DIGEST: ${{ steps.push.outputs.digest }}
         run: |
           set -euo pipefail
-          docker pull "${{ env.IMAGE }}@${DIGEST}"
-          HASH=$(docker save "${{ env.IMAGE }}@${DIGEST}" | openssl dgst -sha3-512 | awk '{print $NF}')
+          docker pull "${IMAGE}@${DIGEST}"
+          HASH=$(docker save "${IMAGE}@${DIGEST}" | openssl dgst -sha3-512 | awk '{print $NF}')
           echo "SHA3-512: $HASH"
           echo "sha3=$HASH" >> "$GITHUB_OUTPUT"
           {
@@ -275,8 +283,8 @@ jobs:
             echo "|---|---|"
             echo "| **Version**   | ${VERSION} |"
             echo "| **Platforms** | linux/amd64, linux/arm64 |"
-            echo "| **Registry**  | ${{ env.IMAGE }} |"
-            echo "| **Commit**    | ${{ github.sha }} |"
+            echo "| **Registry**  | ${IMAGE} |"
+            echo "| **Commit**    | ${GITHUB_SHA} |"
             echo "| **Dry run**   | ${DRY_RUN} |"
             echo "| **Tag push**  | ${IS_TAG} |"
             echo ""
@@ -297,6 +305,11 @@ jobs:
     if: ${{ !inputs.dry_run && needs.publish.outputs.digest != '' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    env:
+      # Hoisted so run: blocks reference $DIGEST instead of inlining the
+      # ${{ needs.publish.outputs.digest }} expression (template-injection
+      # hardening — keeps GitHub-context values out of shell-parsed text).
+      DIGEST: ${{ needs.publish.outputs.digest }}
     steps:
       # Smoke-test runs on a fresh runner — it doesn't inherit the
       # publish job's GHCR auth. Log in first so `docker pull` works
@@ -304,19 +317,19 @@ jobs:
       # against a public package, so this is the right shape regardless
       # of visibility.
       - name: Log in to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Pull published image
-        run: docker pull "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}"
+        run: docker pull "${IMAGE}@${DIGEST}"
 
       - name: Verify OCI labels
         run: |
           set -euo pipefail
-          LABELS=$(docker inspect "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}" --format '{{json .Config.Labels}}')
+          LABELS=$(docker inspect "${IMAGE}@${DIGEST}" --format '{{json .Config.Labels}}')
           echo "$LABELS" | python3 -m json.tool
           echo "$LABELS" | python3 -c "
           import sys, json
@@ -342,7 +355,7 @@ jobs:
             --security-opt no-new-privileges:true \
             --cap-drop ALL \
             -p 3008:3008 \
-            "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}"
+            "${IMAGE}@${DIGEST}"
 
           echo "Waiting for /healthz..."
           for i in $(seq 1 30); do
@@ -396,7 +409,7 @@ jobs:
           {
             echo "### Post-publish smoke ❌"
             echo ""
-            echo "Smoke test failed for ${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}."
+            echo "Smoke test failed for ${IMAGE}@${DIGEST}."
             echo "See the 'Capture container diagnostics on failure' step above for"
             echo "docker ps / inspect / logs output."
           } >> "$GITHUB_STEP_SUMMARY"

package/lib/vendor/blamejs/.github/workflows/sha-to-tag-verify.yml

@@ -39,6 +39,7 @@ jobs:
       - name: Checkout (full history needed for first-parent walk)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
@@ -53,10 +54,15 @@ jobs:
       - name: Resolve tag + verify chain
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          # Hoisted: a workflow_dispatch input is operator-supplied text;
+          # inlining ${{ github.event.inputs.tag }} into the shell is the
+          # template-injection vector. Reference $INPUT_TAG instead.
+          INPUT_TAG: ${{ github.event.inputs.tag }}
         run: |
           set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ github.event.inputs.tag }}"
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            TAG="$INPUT_TAG"
           else
             TAG="${GITHUB_REF#refs/tags/}"
           fi
@@ -77,7 +83,20 @@ jobs:
           #    pass that test. The strict first-parent invariant is
           #    what the project's squash-merge policy actually
           #    produces; check it directly.
-          if ! git rev-list --first-parent origin/main | grep -qx "$SHA"; then
+          #
+          #    Capture rev-list output first, then grep against a
+          #    here-string. The obvious-looking
+          #      `git rev-list --first-parent origin/main | grep -qx "$SHA"`
+          #    is a `set -o pipefail` + `grep -q` trap: when grep -q
+          #    finds the match it exits early and closes its stdin,
+          #    rev-list gets SIGPIPE and exits 141, and pipefail then
+          #    propagates 141 as the pipeline's exit. The outer
+          #    `if !` negates 141 → enters the false-fail branch
+          #    every time on a long first-parent chain. (False-failed
+          #    every release v0.13.18-.22.) The here-string consumes
+          #    rev-list to completion first; no pipe, no SIGPIPE.
+          FIRST_PARENT=$(git rev-list --first-parent origin/main)
+          if ! grep -qFx "$SHA" <<<"$FIRST_PARENT"; then
             echo "::error::tag $TAG points at $SHA which is NOT on main's first-parent history"
             echo "::error::this means the tag was created from a side-branch commit that never merged via the project's squash-merge flow"
             echo "::error::the publish workflow refuses to proceed; investigate before re-tagging"

package/lib/vendor/blamejs/.github/zizmor.yml

@@ -0,0 +1,29 @@
+# zizmor configuration (auto-discovered at .github/zizmor.yml).
+#
+# Suppressions live here rather than as inline `# zizmor: ignore[...]`
+# comments because the affected lines are `uses:` references that
+# already carry a pinact version comment (`# vX.Y.Z`). zizmor only
+# honors an ignore pragma when `zizmor:` is the first token of the
+# YAML comment; a `# vX.Y.Z  # zizmor: ignore[...]` line reads as the
+# comment text "vX.Y.Z  # zizmor: ..." and the pragma is never seen.
+# A config-file ignore is the only placement that does not collide
+# with the SHA-pin version comment that pinact requires.
+
+rules:
+  cache-poisoning:
+    # actions/setup-node carries an optional `cache:` input that, when
+    # set, restores a dependency cache. zizmor flags the *capability*
+    # whenever the workflow also has a release-class trigger
+    # (`push: tags: ["v*"]`), because a poisoned cache restored during a
+    # publishing run is high-impact. None of these workflows set a
+    # `cache:` input — no dependency cache is created or restored, so
+    # there is nothing to poison. The finding is capability-driven, not
+    # an observed cache.
+    #
+    # Invariant for future edits: if any step in one of these files adds
+    # a `cache:` input to a setup-* action, remove that file from this
+    # list and review the cache-poisoning exposure for real.
+    ignore:
+      - ci.yml
+      - npm-publish.yml
+      - release-container.yml