refactor(landlock-run): unify workspace release (review round 1)

.github/workflows/landlock-run-release.yml

@@ -0,0 +1,170 @@
+# Build and publish the node-addon-landlock-run package family from the
+# harness source of record. Rehearsal and publication consume the same packed
+# tarballs; each native binary is built on its matching architecture.
+name: Landlock Run Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish packed tarballs to npm. Must run from a landlock-run-v* tag.
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  # Stable/prerelease dist-tags are shared registry state; serialize release
+  # runs so two versions cannot race the final tag assignment.
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    working-directory: native/landlock-run
+
+jobs:
+  matrix:
+    name: Matrix
+    runs-on: ubuntu-24.04
+    outputs:
+      prebuilds: ${{ steps.matrix.outputs.prebuilds }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: matrix
+        run: echo "prebuilds=$(node ./scripts/github-matrix.mjs release-prebuild)" >> "$GITHUB_OUTPUT"
+
+  build-prebuilds:
+    name: ${{ matrix.package }}
+    needs: matrix
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.matrix.outputs.prebuilds) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          package_json_file: package.json
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --filter node-addon-landlock-run-workspace... --frozen-lockfile
+
+      - name: Install musl toolchain
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -yq musl-tools
+
+      - name: Build native binaries
+        run: pnpm build:native
+
+      - name: Verify binary metadata
+        run: node ./scripts/verify-launcher-binary.mjs ${{ matrix.dir }}
+
+      - name: Upload prebuild artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact }}
+          path: native/landlock-run/${{ matrix.dir }}/bin/*
+          if-no-files-found: error
+          retention-days: 7
+
+  pack:
+    name: Pack npm tarballs
+    needs: build-prebuilds
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          package_json_file: package.json
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --filter node-addon-landlock-run-workspace... --frozen-lockfile
+
+      - name: Build TypeScript
+        run: pnpm build:ts
+
+      - name: Verify release version
+        run: node ./scripts/verify-release.mjs
+        env:
+          RELEASE_PUBLISH: ${{ inputs.publish }}
+
+      - name: Download prebuild artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: prebuild-*
+          path: native/landlock-run/.release/prebuild-artifacts
+
+      - name: Assemble and verify prebuilds
+        run: node ./scripts/assemble-prebuilds.mjs .release/prebuild-artifacts
+
+      - name: Verify release payload
+        run: node ./scripts/verify-release.mjs --prebuilds
+        env:
+          RELEASE_PUBLISH: ${{ inputs.publish }}
+
+      - name: Pack release tarballs
+        run: node ./scripts/pack-release.mjs dist/npm
+
+      - name: Verify packed install
+        run: node ./scripts/verify-packed-install.mjs dist/npm
+        env:
+          NALR_REQUIRE_LANDLOCK: 1
+
+      - name: Upload npm tarballs
+        uses: actions/upload-artifact@v4
+        with:
+          name: npm-tarballs
+          path: native/landlock-run/dist/npm/*
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    name: Publish to npm
+    if: inputs.publish
+    needs: pack
+    runs-on: ubuntu-24.04
+    environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Download npm tarballs
+        uses: actions/download-artifact@v4
+        with:
+          name: npm-tarballs
+          path: native/landlock-run/dist/npm
+
+      - name: Publish tarballs
+        run: |
+          version="${GITHUB_REF#refs/tags/landlock-run-v}"
+          tag_args=()
+          case "$version" in *-*) tag_args=(--tag next);; esac
+          while IFS= read -r tarball; do
+            npm publish "dist/npm/${tarball}" --access public "${tag_args[@]}"
+          done < dist/npm/publish-order.txt
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/landlock-run.yml

@@ -1,15 +1,27 @@
-# Manually-dispatched CI for the landlock-run source of record
-# (native/landlock-run). A separate workflow from ci.yml on purpose: the
-# subtree is a self-contained pnpm workspace with its own gates, exercised on
-# demand — per-architecture native legs (build + behavioral tests + pack
-# rehearsal on real kernels) plus one darwin leg proving the documented
-# degradation on hosts without a platform package. Legs derive from the
-# subtree's checked-in package matrix (scripts/github-matrix.mjs). Packing
-# for npm happens in the release mirror (node-addon-landlock-run) after an
-# export — see native/README.md; this workflow never packs for release.
+# CI for the landlock-run packages under native/landlock-run. A separate
+# workflow from ci.yml keeps the native OS/architecture matrix independent of
+# the harness Node matrix. Release assembly and publication use the companion
+# Landlock Run Release workflow.
 name: Landlock Run
 
 on:
+  pull_request:
+    paths:
+      - '.github/workflows/landlock-run.yml'
+      - '.github/workflows/landlock-run-release.yml'
+      - 'native/landlock-run/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+  push:
+    branches: [master]
+    paths:
+      - '.github/workflows/landlock-run.yml'
+      - '.github/workflows/landlock-run-release.yml'
+      - 'native/landlock-run/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
   workflow_dispatch:
 
 concurrency:
@@ -52,16 +64,16 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          package_json_file: native/landlock-run/package.json
+          package_json_file: package.json
 
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: pnpm
-          cache-dependency-path: native/landlock-run/pnpm-lock.yaml
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --filter node-addon-landlock-run-workspace... --frozen-lockfile
 
       - name: Install musl toolchain
         run: |
@@ -103,16 +115,16 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          package_json_file: native/landlock-run/package.json
+          package_json_file: package.json
 
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: pnpm
-          cache-dependency-path: native/landlock-run/pnpm-lock.yaml
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --filter node-addon-landlock-run-workspace... --frozen-lockfile
 
       - name: Build TypeScript
         run: pnpm build:ts

.github/workflows/sandbox.yml

@@ -3,9 +3,8 @@
 # .agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.md.
 # A separate workflow from ci.yml because the axis is different — these jobs
 # fan out over OS×runner (kernel capabilities), not node versions. The Landlock
-# launcher arrives from the registry with `pnpm install` (the npm package family
-# `node-addon-landlock-run`, built and released from its own repository), so
-# these legs exercise the true consumer path — nothing is compiled here.
+# launcher is built from native/landlock-run on each Landlock leg and installed
+# from the same tarballs the main-repository release workflow publishes.
 name: Sandbox
 
 on:
@@ -30,7 +29,7 @@ jobs:
   # an OS×runner matrix — bwrap and Landlock on Linux (separate legs: the
   # Landlock files force the bwrap rung off, so each leg proves exactly one
   # rung; Landlock twice, once per architecture, each confining through the
-  # registry-installed launcher), Seatbelt on macOS (sandbox-exec ships with
+  # locally built launcher), Seatbelt on macOS (sandbox-exec ships with
   # the OS). One node
   # version only: kernel confinement does not vary by node, and ci.yml's
   # node matrix already covers the node axis.
@@ -80,6 +79,14 @@ jobs:
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 \
             || echo "apparmor userns knob absent — the functional probe decides"
 
+      - name: Build Landlock launcher for this architecture
+        if: matrix.runner == 'landlock'
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -yq musl-tools
+          pnpm --dir native/landlock-run run build:ts
+          pnpm --dir native/landlock-run run build:native
+
       # The unit suite runs on ubuntu in `checks`; this is the one darwin leg
       # in the workflow, so run it here too — the platform-dependent unit
       # expectations (Seatbelt path canonicalization: /tmp IS /private/tmp)
@@ -105,14 +112,10 @@ jobs:
           # the very platform that exists to prove it) is a failure, not a pass.
           echo "$out" | grep -qE 'Test Files[[:space:]]+2 passed \(2\)'
 
-      # Publish-path rehearsal, Landlock legs only (the pack gates need built
-      # lib/). The e2e packs the workspace closure, installs the tarballs
-      # into a throwaway consumer — npm pulling `node-addon-landlock-run`
-      # and its platform package from the registry, the true consumer path —
-      # and confines through the INSTALLED launcher, asserting it executable
-      # apart (a mode-stripped binary must not masquerade as a non-enforcing
-      # kernel). Same no-silent-skip guard as above.
-      - name: Build packages (lib/ for the pack rehearsal)
+      # Publish-path rehearsal, Landlock legs only. Build the launcher on its
+      # native architecture, then install the local native and harness tarballs
+      # together so registry state cannot mask source/package drift.
+      - name: Build packages for the pack rehearsal
         if: matrix.runner == 'landlock'
         run: pnpm run build