Make browser extension checkout and CI reproducible

.github/workflows/ci.yml

@@ -18,56 +18,60 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
+          path: htmltrust-browser-reference
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          repository: HTMLTrust/htmltrust-browser-client
+          ref: 09e8c7552c8111a2cedd83fa45f4ffe3811bf5ca
+          persist-credentials: false
+          path: htmltrust-browser-client
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
 
-      # The package token used to be written to ~/.gitconfig, where every later
-      # step -- including any dependency lifecycle script -- could read it back.
-      # It is now passed through GIT_CONFIG_* environment variables, which git
-      # honours for this process tree only and never persists to disk, and
-      # --ignore-scripts keeps third-party install hooks from running at all
-      # while the token is in the environment. The webpack and eslint steps that
-      # follow run untrusted dependency code, but no longer with the token in
-      # reach.
-      #
-      # HTMLTRUST_PKG_TOKEN must be a fine-grained PAT scoped to the HTMLTrust
-      # package repositories with Contents: Read and nothing else. A classic
-      # `repo`-scoped token grants write access to every repo the owner can
-      # reach and must not be used here.
+      - name: Build browser client dependency
+        working-directory: htmltrust-browser-client
+        run: |
+          npm ci --ignore-scripts
+          npm run build
+
       - name: Install dependencies
-        env:
-          GIT_CONFIG_COUNT: "2"
-          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ secrets.HTMLTRUST_PKG_TOKEN }}@github.com/.insteadOf
-          GIT_CONFIG_VALUE_0: https://github.com/
-          GIT_CONFIG_KEY_1: url.https://x-access-token:${{ secrets.HTMLTRUST_PKG_TOKEN }}@github.com/.insteadOf
-          GIT_CONFIG_VALUE_1: ssh://git@github.com/
+        working-directory: htmltrust-browser-reference
         run: npm ci --ignore-scripts
 
       - name: Lint
-        run: npx eslint src/ --ext .ts,.tsx || true
+        working-directory: htmltrust-browser-reference
+        run: npm run lint
+
+      - name: Run tests
+        working-directory: htmltrust-browser-reference
+        run: npm test
 
       - name: Build Chromium
-        run: npx webpack --mode=production --env target=chromium
+        working-directory: htmltrust-browser-reference
+        run: npm run build:chromium
 
       - name: Build Firefox
-        run: npx webpack --mode=production --env target=firefox
+        working-directory: htmltrust-browser-reference
+        run: npm run build:firefox
 
       - name: Build Safari
-        run: npx webpack --mode=production --env target=safari
+        working-directory: htmltrust-browser-reference
+        run: npm run build:safari
 
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: extension-chromium
-          path: build/chromium/
+          path: htmltrust-browser-reference/build/chromium/
 
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: extension-firefox
-          path: build/firefox/
+          path: htmltrust-browser-reference/build/firefox/
 
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: extension-safari
-          path: build/safari/
+          path: htmltrust-browser-reference/build/safari/

README.md

@@ -59,20 +59,31 @@ src/
 
 ### Prerequisites
 
-- Node.js 18+
+- Node.js 22+ and npm
+- Chromium, Firefox, or Safari for loading the matching build
+
+The extension consumes the browser-client package from a sibling checkout. Use this layout when developing the two repositories together:
+
+```
+workspace/
+├── htmltrust-browser-client/
+└── htmltrust-browser-reference/
+```
+
+The canonicalization package is downloaded from its pinned v0.2.2 release archive, so only the browser-client sibling is required.
 
 ### Build
 
 ```sh
 git clone https://github.com/HTMLTrust/htmltrust-browser-reference.git
 cd htmltrust-browser-reference
-npm install
+npm ci
 ```
 
 Build for a specific browser:
 
 ```sh
-npm run build:chrome     # → build/chromium/
+npm run build:chromium   # → build/chromium/
 npm run build:firefox    # → build/firefox/
 npm run build:safari     # → build/safari/
 ```
@@ -86,7 +97,7 @@ npm run build            # Builds all targets + creates zips
 ### Development
 
 ```sh
-npm run dev:chrome       # Watch mode for Chromium
+npm run dev:chromium     # Watch mode for Chromium
 ```
 
 ### Load in Chrome
@@ -99,7 +110,8 @@ npm run dev:chrome       # Watch mode for Chromium
 
 ```sh
 npm test                 # Run all tests
-npm run test:coverage    # With coverage report
+npm run typecheck        # TypeScript check without emitting files
+npm run lint             # Lint TypeScript sources
 ```
 
 ## Project Structure

eslint.config.js

@@ -0,0 +1,58 @@
+const eslint = require("@eslint/js");
+const tsParser = require("@typescript-eslint/parser");
+const tsPlugin = require("@typescript-eslint/eslint-plugin");
+const react = require("eslint-plugin-react");
+const reactHooks = require("eslint-plugin-react-hooks");
+const globals = require("globals");
+
+module.exports = [
+  {
+    ignores: ["build/**", "node_modules/**"],
+  },
+  eslint.configs.recommended,
+  {
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      parser: tsParser,
+      parserOptions: {
+        ecmaFeatures: { jsx: true },
+        ecmaVersion: "latest",
+        sourceType: "module",
+      },
+      globals: {
+        ...globals.browser,
+        ...globals.node,
+        ...globals.jest,
+        chrome: "readonly",
+      },
+    },
+    plugins: {
+      "@typescript-eslint": tsPlugin,
+      react,
+      "react-hooks": reactHooks,
+    },
+    settings: {
+      react: { version: "detect" },
+    },
+    rules: {
+      "no-undef": "off",
+      "no-unused-vars": "off",
+      "@typescript-eslint/no-explicit-any": "warn",
+      "@typescript-eslint/no-unused-vars": ["warn", { argsIgnorePattern: "^_" }],
+      "react/prop-types": "off",
+      "react/react-in-jsx-scope": "off",
+      "react-hooks/rules-of-hooks": "error",
+      "react-hooks/exhaustive-deps": "warn",
+      "no-console": ["warn", { allow: ["warn", "error"] }],
+      "no-debugger": "warn",
+    },
+  },
+  {
+    files: ["**/*.js"],
+    languageOptions: {
+      globals: {
+        ...globals.node,
+      },
+    },
+  },
+];