Merge remote-tracking branch 'origin/main' into fix/macos-transport-security

Author: SarthakWade

.github/scripts/release-checksums.sh

@@ -0,0 +1,75 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: release-checksums.sh VERSION DIST_DIRECTORY" >&2
+  exit 64
+fi
+
+VERSION="$1"
+DIST_DIRECTORY="$2"
+
+case "$VERSION" in
+  ""|[!0-9A-Za-z]*|*[!0-9A-Za-z.-]*|*..*|*.)
+    echo "release checksums: invalid version: $VERSION" >&2
+    exit 64
+    ;;
+esac
+if [ "${#VERSION}" -gt 64 ]; then
+  echo "release checksums: version is too long" >&2
+  exit 64
+fi
+if [ ! -d "$DIST_DIRECTORY" ]; then
+  echo "release checksums: dist directory does not exist: $DIST_DIRECTORY" >&2
+  exit 66
+fi
+
+DIST_DIRECTORY="$(CDPATH='' cd -- "$DIST_DIRECTORY" && pwd -P)"
+set -- \
+  "Headless-${VERSION}-macos.zip" \
+  "headless-${VERSION}-linux-amd64.tar.gz" \
+  "headless-${VERSION}-linux-arm64.tar.gz"
+
+for asset in "$@"; do
+  path="$DIST_DIRECTORY/$asset"
+  if [ ! -f "$path" ] || [ -L "$path" ] || [ ! -s "$path" ]; then
+    echo "release checksums: missing or unsafe release asset: $asset" >&2
+    exit 66
+  fi
+done
+
+checksum_files() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$@"
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$@"
+  else
+    echo "release checksums: sha256sum or shasum is required" >&2
+    exit 69
+  fi
+}
+
+verify_manifest() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum -c SHA256SUMS
+  else
+    shasum -a 256 -c SHA256SUMS
+  fi
+}
+
+MANIFEST="$DIST_DIRECTORY/SHA256SUMS"
+TEMP_MANIFEST="$(mktemp "$DIST_DIRECTORY/.SHA256SUMS.XXXXXX")"
+trap '[ -z "$TEMP_MANIFEST" ] || rm -f "$TEMP_MANIFEST"' EXIT INT TERM
+
+(
+  cd "$DIST_DIRECTORY"
+  checksum_files "$@"
+) > "$TEMP_MANIFEST"
+chmod 0644 "$TEMP_MANIFEST"
+mv -f "$TEMP_MANIFEST" "$MANIFEST"
+TEMP_MANIFEST=""
+
+(
+  cd "$DIST_DIRECTORY"
+  verify_manifest
+)

.github/workflows/release.yml

@@ -4,6 +4,22 @@ on:
   push:
     tags:
       - "v*"
+  pull_request:
+    paths:
+      - ".github/workflows/release.yml"
+      - ".github/scripts/**"
+      - "apps/headless/Dockerfile.linux"
+      - "apps/headless/build.sh"
+      - "apps/headless/build-linux.sh"
+      - "apps/headless/install-linux.sh"
+      - "apps/headless/Package.swift"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Build and verify release packages without publishing
+        required: true
+        default: true
+        type: boolean
 
 permissions:
   contents: read
@@ -13,9 +29,28 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
+      publish: ${{ steps.version.outputs.publish }}
     steps:
       - id: version
-        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+        env:
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          set -eu
+          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
+            case "$GITHUB_REF" in
+              refs/tags/v*) ;;
+              *) echo "release publishing requires a v* tag" >&2; exit 64 ;;
+            esac
+            echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          else
+            if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] && [ "$DRY_RUN" != "true" ]; then
+              echo "manual release runs must use dry_run=true; publish by pushing a v* tag" >&2
+              exit 64
+            fi
+            echo "version=0.0.${GITHUB_RUN_NUMBER}" >> "$GITHUB_OUTPUT"
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          fi
 
   macos:
     needs: version
@@ -36,8 +71,14 @@ jobs:
         env:
           VERSION: ${{ needs.version.outputs.version }}
         run: |
+          set -eu
           cd apps/headless
           ditto -c -k --keepParent Headless.app "Headless-${VERSION}-macos.zip"
+          test -s "Headless-${VERSION}-macos.zip"
+          unzip -t "Headless-${VERSION}-macos.zip"
+          unzip -Z1 "Headless-${VERSION}-macos.zip" | grep -qx 'Headless.app/Contents/MacOS/Headless'
+          unzip -Z1 "Headless-${VERSION}-macos.zip" | grep -qx 'Headless.app/Contents/Resources/bin/headless'
+          unzip -Z1 "Headless-${VERSION}-macos.zip" | grep -qx 'Headless.app/Contents/Resources/bin/headless-mcp'
       - uses: actions/upload-artifact@v7
         with:
           name: macos
@@ -56,8 +97,15 @@ jobs:
         env:
           VERSION: ${{ needs.version.outputs.version }}
         run: |
+          set -eu
           cp apps/headless/build/headless-linux-amd64.tar.gz \
             "apps/headless/build/headless-${VERSION}-linux-amd64.tar.gz"
+          archive="apps/headless/build/headless-${VERSION}-linux-amd64.tar.gz"
+          test -s "$archive"
+          tar -tzf "$archive" > archive-contents.txt
+          for expected in headless headless-host headless-mcp install-linux.sh Headless_HeadlessProtocol.resources/AgentRuntime.js; do
+            grep -qx "$expected" archive-contents.txt
+          done
       - uses: actions/upload-artifact@v7
         with:
           name: linux-amd64
@@ -76,23 +124,37 @@ jobs:
         env:
           VERSION: ${{ needs.version.outputs.version }}
         run: |
+          set -eu
           cp apps/headless/build/headless-linux-arm64.tar.gz \
             "apps/headless/build/headless-${VERSION}-linux-arm64.tar.gz"
+          archive="apps/headless/build/headless-${VERSION}-linux-arm64.tar.gz"
+          test -s "$archive"
+          tar -tzf "$archive" > archive-contents.txt
+          for expected in headless headless-host headless-mcp install-linux.sh Headless_HeadlessProtocol.resources/AgentRuntime.js; do
+            grep -qx "$expected" archive-contents.txt
+          done
       - uses: actions/upload-artifact@v7
         with:
           name: linux-arm64
           path: apps/headless/build/headless-${{ needs.version.outputs.version }}-linux-arm64.tar.gz
 
   publish:
     needs: [version, macos, linux-amd64, linux-arm64]
+    if: >-
+      github.event_name == 'push' &&
+      startsWith(github.ref, 'refs/tags/v') &&
+      needs.version.outputs.publish == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
+      - uses: actions/checkout@v7
       - uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true
+      - name: Generate and verify checksums
+        run: ./.github/scripts/release-checksums.sh "${{ needs.version.outputs.version }}" dist
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3
         with:
@@ -115,4 +177,5 @@ jobs:
             dist/Headless-${{ needs.version.outputs.version }}-macos.zip
             dist/headless-${{ needs.version.outputs.version }}-linux-amd64.tar.gz
             dist/headless-${{ needs.version.outputs.version }}-linux-arm64.tar.gz
+            dist/SHA256SUMS
           fail_on_unmatched_files: true

CHANGELOG.md

@@ -23,12 +23,17 @@ Cutting that release is tracked in
 
 ### Added
 
+- Tagged releases now include a verified `SHA256SUMS` manifest covering every
+  downloadable macOS and Linux package.
 - A single cross-engine conformance scenario now runs against real WKWebView
   and Chromium hosts, locking shared response shapes and declared capability
   errors without mirrored platform assertions.
 - A generated WebKit/Chromium capability matrix now declares exhaustive
   command support and intentional engine differences; host ping responses
   include the active engine profile.
+- The comparison benchmark now emits a validated JSON results artifact with
+  raw samples and medians, and its refreshed Headless workflows include
+  task-aware action inspection.
 - The single MCP tool now accurately declares its mutating, destructive,
   non-idempotent, open-world behavior; integration tests lock the metadata and
   deliberate `stop` / `session close` exposure.
@@ -72,6 +77,8 @@ Cutting that release is tracked in
 
 ### Changed
 
+- The release workflow can now exercise and verify every package without
+  publishing, manually or on pull requests that change packaging inputs.
 - macOS WebKit and Linux Chromium now share one `HostCore` dispatcher and
   lifecycle implementation behind small engine adapters, eliminating the two
   divergent copies of flow, capture, recording, report, trace, and error logic.

README.md

@@ -210,9 +210,22 @@ git tag v1.0.0
 git push origin v1.0.0
 ```
 
-Assets: macOS `Headless.app` zip, Linux amd64/arm64 tarballs. See the Actions
-`Release` workflow and the release notes on each tag for install caveats
-(Gatekeeper; Linux Chromium/FFmpeg).
+Assets: macOS `Headless.app` zip, Linux amd64/arm64 tarballs, and
+`SHA256SUMS`. Download the manifest beside the selected package and verify it
+before installing:
+
+```sh
+sha256sum --ignore-missing -c SHA256SUMS              # Linux
+shasum -a 256 --ignore-missing -c SHA256SUMS          # macOS
+```
+
+See the Actions `Release` workflow and the release notes on each tag for
+install caveats (Gatekeeper; Linux Chromium/FFmpeg).
+
+The `Release` workflow can also be run manually with `dry_run` enabled. That
+builds, verifies, and uploads all three workflow artifacts without creating a
+GitHub Release. Pull requests that change release packaging run the same dry
+run automatically.
 
 ## Tests
 

apps/headless/Tests/Benchmarks/headless.sh

@@ -6,6 +6,7 @@ headless start >/dev/null
 headless session create bench >/dev/null
 headless --session bench visit "$BENCH_URL" >/dev/null
 headless --session bench record start --fps 5 >/dev/null
+headless --session bench inspect --context actions --task 'continue to designer details' --limit 8 --budget 700 >/dev/null
 headless --session bench tour --full-page --pace 5000 >/dev/null
 headless --session bench click --role button --name Continue >/dev/null
 headless --session bench wait --url /next --text 'Designer details' --settled --timeout 10000 >/dev/null

apps/headless/Tests/Benchmarks/headless_warm.sh

@@ -3,6 +3,7 @@ set -eu
 
 headless --session bench visit "$BENCH_URL" >/dev/null
 headless --session bench record start --fps 5 >/dev/null
+headless --session bench inspect --context actions --task 'continue to designer details' --limit 8 --budget 700 >/dev/null
 headless --session bench tour --full-page --pace 5000 >/dev/null
 headless --session bench click --role button --name Continue >/dev/null
 headless --session bench wait --url /next --text 'Designer details' --settled --timeout 10000 >/dev/null