Verify npm registry integrity after accepted beta publication

.github/workflows/ci.yaml

@@ -12,7 +12,7 @@ concurrency:
 jobs:
   supplementary:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: coordinator-runners
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -87,7 +87,7 @@ jobs:
 
   chart:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: coordinator-runners
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/npm-release.yaml

@@ -104,4 +104,19 @@ jobs:
           test "$(gh api "repos/$REPOSITORY/git/ref/heads/main" --jq '.object.sha')" = "$SHA"
           test "$(sha256sum package.tgz | cut -d' ' -f1)" = "$(jq -r .archiveSha256 npm.json)"
           npm publish ./package.tgz --ignore-scripts --access public --tag beta --provenance --registry=https://registry.npmjs.org
-          printf 'Published `@samuelho-dev/coordinator@%s` under `beta` from CI `%s`, source `%s`, SHA256 `%s`. No rebuild or visibility change.\n' "$VERSION" '${{ inputs.ci_run_id }}' "$SHA" "$(jq -r .archiveSha256 npm.json)" >> "$GITHUB_STEP_SUMMARY"
+      - name: Verify published version and tarball integrity
+        working-directory: npm-evidence
+        env:
+          VERSION: ${{ inputs.version }}
+          SHA: ${{ inputs.source_sha }}
+        run: |
+          set -euo pipefail
+          INTEGRITY="sha512-$(openssl dgst -sha512 -binary package.tgz | openssl base64 -A)"
+          for attempt in {1..10}; do
+            STATUS="$(curl --silent --show-error --output "$RUNNER_TEMP/published.json" --write-out '%{http_code}' "https://registry.npmjs.org/@samuelho-dev%2fcoordinator/$VERSION")"
+            if [ "$STATUS" = 200 ]; then break; fi
+            if [ "$attempt" = 10 ]; then echo "Registry verification failed (HTTP $STATUS)." >&2; exit 1; fi
+            sleep 5
+          done
+          jq -e --arg version "$VERSION" --arg integrity "$INTEGRITY" '.name == "@samuelho-dev/coordinator" and .version == $version and .dist.integrity == $integrity' "$RUNNER_TEMP/published.json"
+          printf 'Published and verified `@samuelho-dev/coordinator@%s` under `beta` from CI `%s`, source `%s`, SHA256 `%s`. No rebuild or visibility change.\n' "$VERSION" '${{ inputs.ci_run_id }}' "$SHA" "$(jq -r .archiveSha256 npm.json)" >> "$GITHUB_STEP_SUMMARY"

README.md

@@ -217,7 +217,7 @@ Release gaps and constraints:
 
 - Authenticate with native `npm login` as an account authorized for `@samuelho-dev`; satisfy 2FA and inspect existing package/access/version state. GitHub or AWS access does not grant npm rights. An anonymous 404 is not creation permission; stop if ownership or private-package state is ambiguous.
 - Publish only the accepted tarball from successful current-main CI. Apply the [release workflow's](.github/workflows/npm-release.yaml) source/run/attempt, required-job, unique-unexpired-artifact, manifest/repository, normalized source-contract, SHA256 and unused-version checks. Do not rebuild, repack a dirty checkout or create a dummy bootstrap version. Explicitly publish that archive with `--ignore-scripts --access public --tag beta --registry=https://registry.npmjs.org`; an interactive first publication has no hosted npm provenance.
-- For later releases, configure [npm's trusted publisher](https://docs.npmjs.com/trusted-publishers/) for GitHub owner `samuelho-dev`, repository `coordinator`, workflow `npm-release.yaml`, environment `npm-public`, with direct publishing allowed. Protect that GitHub environment with maintainers/reviewers and main-only restrictions; naming it in YAML does not create those rules. The hosted OIDC workflow publishes the verified archive with provenance, without an npm token fallback.
+- For later releases, configure [npm's trusted publisher](https://docs.npmjs.com/trusted-publishers/) for GitHub owner `samuelho-dev`, repository `coordinator`, workflow `npm-release.yaml`, environment `npm-public`, with direct publishing allowed. Protect that GitHub environment with maintainers/reviewers and main-only restrictions; naming it in YAML does not create those rules. The hosted OIDC workflow publishes the verified archive with provenance, without an npm token fallback, then checks the registry's exact version and SHA-512 integrity against that archive. A failed post-publication check requires investigation; it does not undo a successful publish.
 
 
 ## Internal contract