feat: 0.5.0 API surface — archive policy, publication mechanics, sync locks, secret create-only, Root.walk, cleanup receipts

.github/workflows/ci.yml

@@ -58,3 +58,148 @@ jobs:
 
       - name: Check
         run: pnpm check
+
+  native-check:
+    name: Native check (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-15
+          - windows-latest
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 10.34.5
+          run_install: false
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Test native crate
+        run: cargo test --workspace --locked
+
+      - name: Build host binding
+        run: pnpm native:build
+
+      - name: Build package
+        run: pnpm build
+
+      - name: Test native mode auto
+        run: node scripts/native-mode-smoke.mjs auto
+
+      - name: Test native mode require
+        run: node scripts/native-mode-smoke.mjs require
+
+      - name: Test native mode off
+        run: node scripts/native-mode-smoke.mjs off
+
+      - name: Test native security and path equivalence
+        run: pnpm test test/native-integration.test.ts test/native-archive-equivalence.test.ts test/native-publish-equivalence.test.ts test/private-directory.test.ts
+
+  native-musl:
+    name: Native check (linux-x64-musl)
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Build and test in Alpine
+        run: |
+          docker run --rm -v "$GITHUB_WORKSPACE:/work" -w /work node:24-alpine sh -euxc '
+            apk add --no-cache cargo rust musl-dev build-base python3
+            npm install --global pnpm@10.34.5
+            pnpm install --frozen-lockfile
+            cargo test --workspace --locked
+            pnpm native:build
+            pnpm build
+            node scripts/native-mode-smoke.mjs auto
+            node scripts/native-mode-smoke.mjs require
+            node scripts/native-mode-smoke.mjs off
+            pnpm test test/native-archive-equivalence.test.ts test/native-publish-equivalence.test.ts
+          '
+
+  cargo-quality:
+    name: Cargo clippy and audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Cache Cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-quality-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+
+      - name: Clippy
+        run: cargo clippy --workspace --locked -- -D warnings
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --version 0.22.2 --locked
+
+      - name: Audit
+        run: cargo audit --deny warnings
+
+  release-graph-smoke:
+    name: Release graph smoke (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-15
+          - windows-latest
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 10.34.5
+          run_install: false
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build host binding
+        run: pnpm native:build
+
+      - name: Pack and smoke test release graph
+        run: pnpm release-graph:smoke
+
+      - name: Upload behavior proof
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-graph-proof-${{ runner.os }}-${{ runner.arch }}
+          path: release-graph-proof.json
+          if-no-files-found: error

.github/workflows/coverage.yml

@@ -37,6 +37,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Build host binding
+        run: pnpm native:build
+
       - name: Coverage
         run: pnpm test:coverage