Prepare clearfetch 1.0.7 release

.github/pull_request_template.md

@@ -6,10 +6,15 @@ Describe the change and why it exists.
 
 - [ ] `npm run lint`
 - [ ] `npm test`
+- [ ] `npm run test:browser-real` when browser or web-platform behavior changes
+- [ ] `npm run test:types-compat` when public types change
 - [ ] `npm run build`
+- [ ] `npm run check:lockfile`
 - [ ] `npm run check:package-metadata`
 - [ ] `npm run check:pack-smoke`
-- [ ] dependency audit performed when dependencies or lockfiles change
+- [ ] `npm run check:publish-dry-run` when release behavior changes
+- [ ] `npm run check:dependency-audit` performed when dependencies or lockfiles change
+- [ ] `npm run check:dependency-signatures` performed when dependencies or lockfiles change
 
 ## Notes
 

.github/workflows/ci.yml

@@ -12,13 +12,20 @@ env:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   workflow-lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Lint GitHub Actions workflows
         uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0
@@ -29,23 +36,30 @@ jobs:
 
   verify:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
-        node-version: [18, 20, 22]
+        node-version: [18, 20, 22, 24, 26]
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Validate lockfile before install
+        run: node scripts/check-lockfile.mjs
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Install dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts --no-audit --registry=https://registry.npmjs.org
 
       - name: Lint
         run: npm run lint
@@ -58,42 +72,94 @@ jobs:
 
   browser-like:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Validate lockfile before install
+        run: node scripts/check-lockfile.mjs
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Install dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts --no-audit --registry=https://registry.npmjs.org
 
       - name: Run browser-like tests
         run: npm run test:browser-like
 
+  browser-real:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Validate lockfile before install
+        run: node scripts/check-lockfile.mjs
+
+      - name: Install dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts --no-audit --registry=https://registry.npmjs.org
+
+      - name: Install Chromium
+        run: node node_modules/playwright/cli.js install --with-deps chromium
+
+      - name: Run real-browser tests
+        run: npm run test:browser-real
+
   package-guardrails:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Validate lockfile before install
+        run: node scripts/check-lockfile.mjs
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Install dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts --no-audit --registry=https://registry.npmjs.org
+
+      - name: Audit dependencies
+        run: npm run check:dependency-audit
+
+      - name: Verify dependency signatures and attestations
+        run: npm run check:dependency-signatures
 
       - name: Build package
         run: npm run build
 
+      - name: Verify TypeScript compatibility
+        run: npm run test:types-compat
+
       - name: Validate package metadata
         run: npm run check:package-metadata
 

.github/workflows/dependency-review.yml

@@ -17,13 +17,20 @@ env:
 permissions:
   contents: read
 
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Review dependency changes
         if: github.event_name == 'pull_request'