Codex/node network devtools v2

.github/workflows/nightly.yml

@@ -0,0 +1,80 @@
+name: Nightly compatibility
+
+on:
+  schedule:
+    - cron: '17 18 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nightly-compatibility
+  cancel-in-progress: false
+
+# The reusable gate supplies the complete Ubuntu runtime matrix. These jobs add
+# Windows/macOS across every declared runtime. As of 2026-08-28, Node 18/20 are
+# EOL compatibility lines; 22/24 are LTS and 26 is Current. Evidence:
+# https://github.com/nodejs/Release#release-schedule
+jobs:
+  quality:
+    name: Reusable Ubuntu quality matrix
+    uses: ./.github/workflows/reusable-quality.yml
+    permissions:
+      contents: read
+
+  legacy-os-runtime:
+    name: Legacy / ${{ matrix.os }} / Node ${{ matrix.node }}
+    needs: quality
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+        node: [18.18.0, 20, 22, 24, 26]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+      - uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.quality.outputs.package_artifact_name }}
+          path: ${{ runner.temp }}/npm-package
+      - name: Run the node:test Legacy controller against the exact tarball
+        env:
+          NND_PACK_DIR: ${{ runner.temp }}/npm-package
+          HTTP_PROXY: ''
+          HTTPS_PROXY: ''
+          ALL_PROXY: ''
+          NO_PROXY: 127.0.0.1,localhost
+        run: node --test packages/network-debugger/test/e2e/pack/legacy-runtime.test.mjs
+
+  native-os-runtime:
+    name: Native / ${{ matrix.os }} / Node ${{ matrix.node }}
+    needs: quality
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+        node: [22, 24, 26]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+      - uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.quality.outputs.package_artifact_name }}
+          path: ${{ runner.temp }}/npm-package
+      - name: Run the node:test Native controller against the exact tarball
+        env:
+          NND_PACK_DIR: ${{ runner.temp }}/npm-package
+          HTTP_PROXY: ''
+          HTTPS_PROXY: ''
+          ALL_PROXY: ''
+          NO_PROXY: 127.0.0.1,localhost
+        run: node --test packages/network-debugger/test/e2e/pack/native-runtime.test.mjs

.github/workflows/npm-publish.yml

@@ -4,20 +4,58 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: npm-publish-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
 jobs:
+  quality:
+    name: Rebuild once and run the reusable release gate
+    uses: ./.github/workflows/reusable-quality.yml
+    permissions:
+      contents: read
+
   publish:
+    name: Publish the exact tested tarball
+    needs: quality
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+      # npm trusted publishing requires npm >=11.5.1 and Node >=22.14. The
+      # official configuration is OIDC-first; NPM_TOKEN remains a migration
+      # fallback but cannot bypass the reusable quality dependency above.
+      # https://docs.npmjs.com/trusted-publishers/
+      - uses: actions/setup-node@v4
         with:
-          node-version: 22
-          registry-url: 'https://registry.npmjs.org/'
-      - run: npm i -g pnpm@9.12.2
-      - run: pnpm i
-      - run: pnpm build --filter=node-network-devtools
-      - run: |
-          cd packages/network-debugger
-          npm publish --access public
+          node-version: 24
+          registry-url: https://registry.npmjs.org/
+      - run: npm install --global npm@11
+      - uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.quality.outputs.package_artifact_name }}
+          path: ${{ runner.temp }}/npm-package
+      - name: Verify release candidate identity
+        shell: bash
+        env:
+          EXPECTED_TARBALL: ${{ needs.quality.outputs.package_tarball_name }}
+          EXPECTED_SHA256: ${{ needs.quality.outputs.package_sha256 }}
+          EXPECTED_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          tarball="$RUNNER_TEMP/npm-package/$EXPECTED_TARBALL"
+          test -f "$tarball"
+          echo "$EXPECTED_SHA256  $tarball" | sha256sum --check --strict
+          package_version="$(tar -xOf "$tarball" package/package.json | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).version")"
+          test "${EXPECTED_TAG#v}" = "$package_version"
+      - name: Publish with OIDC provenance (or NPM_TOKEN fallback)
         env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          TARBALL: ${{ runner.temp }}/npm-package/${{ needs.quality.outputs.package_tarball_name }}
+        run: npm publish "$TARBALL" --access public --provenance

.github/workflows/quality.yml

@@ -0,0 +1,34 @@
+name: Quality
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - 'codex/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: quality-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Required package and protocol quality
+    uses: ./.github/workflows/reusable-quality.yml
+    permissions:
+      contents: read
+
+  quality-gate:
+    name: Quality Gate
+    if: always()
+    needs: quality
+    runs-on: ubuntu-latest
+    steps:
+      - name: Enforce the complete reusable workflow result
+        env:
+          QUALITY_RESULT: ${{ needs.quality.result }}
+        run: test "$QUALITY_RESULT" = success