Harden E2E dependencies and checkout docs

.github/workflows/ci.yml

@@ -0,0 +1,58 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test E2E harness
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          path: htmltrust-e2e
+          persist-credentials: false
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          repository: HTMLTrust/htmltrust-canonicalization
+          ref: 79b0d52fecd958f8fc7ade713fe0799ca1e79626
+          path: htmltrust-canonicalization
+          persist-credentials: false
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          repository: HTMLTrust/htmltrust-browser-client
+          ref: 09e8c7552c8111a2cedd83fa45f4ffe3811bf5ca
+          path: htmltrust-browser-client
+          persist-credentials: false
+
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 22
+
+      - name: Build browser client
+        working-directory: htmltrust-browser-client
+        run: |
+          npm ci --ignore-scripts
+          npm run build
+
+      - name: Install harness
+        working-directory: htmltrust-e2e
+        run: npm ci --ignore-scripts
+
+      - name: Test and type-check
+        working-directory: htmltrust-e2e
+        run: |
+          npm test
+          npm run build
+
+      - name: Audit dependencies
+        working-directory: htmltrust-e2e
+        run: npm audit --audit-level=low

README.md

@@ -2,7 +2,7 @@
 
 This repository runs a Docker-backed HTMLTrust simulation. It creates trust-directory records, publishes signed WordPress and Hugo pages, verifies them with Playwright, records votes and reports, and writes a report under `results/`.
 
-The harness is private and expects sibling repositories. Install and run it from the layout below.
+The harness is public and expects sibling repositories. Install and run it from the layout below.
 
 ## Required checkout layout
 
@@ -20,6 +20,17 @@ htmltrust/
 
 The Docker build reads the canonicalization and server directories from the parent. Compose mounts the WordPress plugin from `htmltrust-cms-reference`. The browser phase mounts `htmltrust-browser-reference/build/chromium`.
 
+From an empty parent directory, clone the required repositories with:
+
+```bash
+git clone https://github.com/HTMLTrust/htmltrust-canonicalization.git
+git clone https://github.com/HTMLTrust/htmltrust-browser-client.git
+git clone https://github.com/HTMLTrust/htmltrust-browser-reference.git
+git clone https://github.com/HTMLTrust/htmltrust-cms-reference.git
+git clone https://github.com/HTMLTrust/htmltrust-e2e.git
+git clone https://github.com/HTMLTrust/htmltrust-server-reference.git
+```
+
 ## Prerequisites
 
 - Docker Engine with Compose v2