fix: public CLI v0.3.2 audit, stale labels and immutable reusable source

.github/workflows/pages-smoke.yml

@@ -21,8 +21,8 @@ jobs:
       - name: Check out trusted pgextwin/website main for native and cross-repository calls
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          repository: pgextwin/website
-          ref: main
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
           persist-credentials: false
       - name: Check live GitHub Pages and independent Landscape Registry
         run: |

en/cli.html

@@ -24,7 +24,7 @@
       <h2 id="download-heading">Get the Windows executable</h2>
       <div class="cli-download-actions">
         <a class="download-link" href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.2/pgextwin.exe">Download pgextwin.exe (12.83 MB)</a>
-        <a href="https://github.com/pgextwin/catalog/releases/tag/cli-v0.3.2">GitHub Release v0.3.1</a>
+        <a href="https://github.com/pgextwin/catalog/releases/tag/cli-v0.3.2">GitHub Release v0.3.2</a>
         <a href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.2/SHA256SUMS.txt">SHA256SUMS.txt</a>
       </div>
       <p class="cli-sha"><strong>Published EXE SHA256:</strong> <code>d4e8f63d402066b21db9d537f7679b51137ec47d9834fa4fd75b5889ad34e6f4</code></p>

en/index.html

@@ -32,7 +32,7 @@ <h1>PostgreSQL Extensions for Windows</h1>
 
   <main class="shell">
     <section class="cli-home-teaser" aria-labelledby="cli-home-heading">
-      <p class="eyebrow">Windows CLI · v0.3.1</p>
+      <p class="eyebrow">Windows CLI · v0.3.2</p>
       <h2 id="cli-home-heading">Download Catalog-registered ZIPs with one command</h2>
       <p>14 extensions × PostgreSQL 14–18 = <strong>70 original ZIPs</strong>. The CLI authenticates the Sigstore-signed Catalog feed, checks each ZIP SHA256, and preserves an explicit historical <code>--fixed</code> mode. Original ZIP signatures remain <code>INTEGRITY_ONLY</code>.</p>
       <pre><code>.\pgextwin.exe download-all --pg all</code></pre>

ja/cli.html

@@ -24,7 +24,7 @@
       <h2 id="download-heading">Windows用EXEを入手</h2>
       <div class="cli-download-actions">
         <a class="download-link" href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.2/pgextwin.exe">pgextwin.exeをダウンロード（12.83 MB）</a>
-        <a href="https://github.com/pgextwin/catalog/releases/tag/cli-v0.3.2">GitHub Release v0.3.1</a>
+        <a href="https://github.com/pgextwin/catalog/releases/tag/cli-v0.3.2">GitHub Release v0.3.2</a>
         <a href="https://github.com/pgextwin/catalog/releases/download/cli-v0.3.2/SHA256SUMS.txt">SHA256SUMS.txt</a>
       </div>
       <p class="cli-sha"><strong>公開EXEのSHA256:</strong> <code>d4e8f63d402066b21db9d537f7679b51137ec47d9834fa4fd75b5889ad34e6f4</code></p>

ja/index.html

@@ -32,7 +32,7 @@ <h1>PostgreSQL拡張機能のWindowsバイナリ</h1>
 
   <main class="shell">
     <section class="cli-home-teaser" aria-labelledby="cli-home-heading">
-      <p class="eyebrow">Windows CLI · v0.3.1</p>
+      <p class="eyebrow">Windows CLI · v0.3.2</p>
       <h2 id="cli-home-heading">Catalog登録済みのZIPを1行でまとめて取得</h2>
       <p>14拡張×PostgreSQL 14～18、計<strong>70個の元ZIP</strong>に対応。CLIはSigstore署名付きCatalogフィードを認証し、各ZIPのSHA256を照合します。過去の固定版は<code>--fixed</code>で指定できます。個々のZIPの真正署名は検証せず、<code>INTEGRITY_ONLY</code>です。</p>
       <pre><code>.\pgextwin.exe download-all --pg all</code></pre>

scripts/published-cli-contract.mjs

@@ -0,0 +1,24 @@
+import assert from 'node:assert/strict';
+
+// Approved public CLI Release 417855312 / EXE asset 657731413, GET-reconciled
+// on 2026-10-20. This checks served HTML against that identity; it does not
+// replace the existing independent EXE Sigstore/Windows acceptance.
+export const cliVersion = '0.3.2';
+export const cliExeSha = 'd4e8f63d402066b21db9d537f7679b51137ec47d9834fa4fd75b5889ad34e6f4';
+
+export function verifyPublishedCli(page, home, locale) {
+  assert.ok(['en', 'ja'].includes(locale), 'Unknown CLI page language');
+  assert.ok(page.includes('<html lang="' + locale + '">') &&
+    page.includes('cli-v' + cliVersion) && page.includes(cliExeSha) &&
+    page.includes('GitHub Release v' + cliVersion) &&
+    page.includes('cli-flow-steps') && page.includes('SIGSTORE VERIFIED') &&
+    page.includes('INTEGRITY_ONLY') && page.includes('download-all --pg all --fixed') &&
+    page.includes('download-all --pg all --verbose') && page.includes('download-verbose.log') &&
+    page.includes('83.83%'), 'Published CLI v' + cliVersion + ' incomplete (' + locale + ')');
+  assert.ok(page.includes('<article lang="' + locale + '" class="cli-note-block"') &&
+    !page.includes('<article lang="' + (locale === 'en' ? 'ja' : 'en') + '" class="cli-note-block"'),
+    "Published Website must show only the page's own locale release notes (" + locale + ')');
+  assert.ok(home.includes('CLI v' + cliVersion) &&
+    home.includes('Windows CLI · v' + cliVersion) && home.includes('cli-home-teaser') &&
+    !home.includes('CLI v0.2.2'), 'Homepage still advertises obsolete CLI (' + locale + ')');
+}

scripts/verify-published-pages.mjs

@@ -3,6 +3,7 @@
 // This is intentionally independent of Catalog v2 / Release assets.
 import assert from "node:assert/strict";
 import { setTimeout as delay } from "node:timers/promises";
+import { verifyPublishedCli } from './published-cli-contract.mjs';
 
 const root = "https://pgextwin.github.io/website/";
 const site = root + "en/";
@@ -26,30 +27,15 @@ async function verify() {
     assert.ok(page.includes('src="../locale.js"'));
     assert.ok(page.includes('hreflang="x-default"'));
   }
-  // CLI v0.3.1 public website launch smoke; verify BOTH languages and
-  // English-then-Japanese release notes, never stale v0.2.2 labels.
+  // Verify the current approved public CLI identity and each page's own locale.
   const [cliEnglish,cliJapanese] = await Promise.all([
     get(root+"en/cli.html").then(x=>x.text()),
     get(root+"ja/cli.html").then(x=>x.text())
   ]);
-  const expectedSha="baee38b3aafdd1bbb7f61857747358dbd40ab056d989aa0f753c93b2025a7580";
   for (const [page,home,locale] of [
     [cliEnglish,html,"en"],[cliJapanese,japanese,"ja"]
   ]) {
-    assert.ok(page.includes('<html lang="'+locale+'">') &&
-      page.includes('cli-v0.3.1') &&
-      page.includes(expectedSha) &&
-      page.includes('cli-flow-steps') &&
-      page.includes('SIGSTORE VERIFIED') &&
-      page.includes('INTEGRITY_ONLY') &&
-      page.includes('download-all --pg all --fixed') &&
-      page.includes('83.83%'),
-      "Published CLI v0.3.1 incomplete ("+locale+")");
-    assert.ok(page.includes('<article lang="'+locale+'" class="cli-note-block"') &&
-              !page.includes('<article lang="'+(locale==="en"?"ja":"en")+'" class="cli-note-block"'),
-      "Published Website must show only the page's own locale release notes ("+locale+")");
-    assert.ok(home.includes('CLI v0.3.1') && home.includes('cli-home-teaser') &&
-      !home.includes('CLI v0.2.2'),"Homepage still advertises obsolete CLI ("+locale+")");
+    verifyPublishedCli(page,home,locale);
   }
 
   assert.equal((await get(root+"locale.js")).status,200);

tests/published-cli-contract.test.js

@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import {verifyPublishedCli, cliVersion, cliExeSha} from '../scripts/published-cli-contract.mjs';
+
+for (const locale of ['en', 'ja']) {
+  const page = readFileSync(new URL('../' + locale + '/cli.html', import.meta.url), 'utf8');
+  const home = readFileSync(new URL('../' + locale + '/index.html', import.meta.url), 'utf8');
+  test('Published ' + locale + ' CLI contract accepts current full served-page fixtures', () => {
+    verifyPublishedCli(page, home, locale);
+  });
+  test('Published ' + locale + ' CLI contract rejects stale tag/hash/label, missing verbose and mixed locales', () => {
+    const opposite = locale === 'en' ? 'ja' : 'en';
+    const changes = [
+      [page.replaceAll('cli-v' + cliVersion, 'cli-v0.3.1'), home],
+      [page.replaceAll(cliExeSha, '0'.repeat(64)), home],
+      [page.replaceAll('GitHub Release v' + cliVersion, 'GitHub Release v0.3.1'), home],
+      [page.replaceAll('download-all --pg all --verbose', 'download-all --pg all'), home],
+      [page.replaceAll('download-verbose.log', 'none.log'), home],
+      [page + '<article lang="' + opposite + '" class="cli-note-block">', home],
+      [page, home.replaceAll('Windows CLI · v' + cliVersion, 'Windows CLI · v0.3.1')]
+    ];
+    for (const [modified, modifiedHome] of changes) {
+      assert.throws(() => verifyPublishedCli(modified, modifiedHome, locale));
+    }
+  });
+}

tests/reusable-audit.test.js

@@ -7,8 +7,9 @@ const workflow = readFileSync(join(__dirname, "..", ".github", "workflows", "pag
 
 test("public Pages audit is available as a cross-repo reusable workflow", () => {
   assert.match(workflow, /on:\s*\n\s*workflow_call:/);
-  assert.match(workflow, /repository:\s*pgextwin\/website/);
-  assert.match(workflow, /ref:\s*main/);
+  assert.ok(workflow.includes('repository: ${{ job.workflow_repository }}'));
+  assert.ok(workflow.includes('ref: ${{ job.workflow_sha }}'));
+  assert.doesNotMatch(workflow, /ref:\s*main\b/);
   assert.match(workflow, /persist-credentials:\s*false/);
 });