Post-PR full remediation: stabilization and campaign safety

.github/workflows/ci.yml

@@ -8,8 +8,10 @@ on:
 # Pin tool versions in one place for reproducibility.
 env:
   GO_VERSION: "1.24.x"
-  NODE_VERSION: "20"
+  NODE_VERSION: "22.23.1"
   WAILS_VERSION: "v2.11.0"
+  GOLANGCI_LINT_VERSION: "v2.11.4"
+  CYCLONEDX_GOMOD_VERSION: "v1.10.0"
 
 permissions:
   contents: read
@@ -28,20 +30,45 @@ jobs:
         run: |
           unformatted=$(gofmt -l $(git ls-files '*.go'))
           if [ -n "$unformatted" ]; then
-            echo "These files are not gofmt-clean:"; echo "$unformatted"; exit 1
+            echo "These files are not gofmt-clean:"
+            echo "$unformatted"
+            exit 1
           fi
       - name: go vet
         run: go vet ./backend/...
-      - name: go test (race)
-        run: go test -race ./backend/...
+      - name: go test (race + coverage)
+        run: go test -race -covermode=atomic -coverprofile=backend-coverage.out ./backend/...
+      - name: Upload backend coverage
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: backend-coverage
+          path: backend-coverage.out
+          if-no-files-found: ignore
+          retention-days: 14
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        id: golangci
+        continue-on-error: true
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          args: --output.text.path=golangci-lint.txt ./backend/...
+      - name: Upload golangci-lint diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          version: v1.61.0
-          args: ./backend/...
+          name: golangci-lint-diagnostics
+          path: golangci-lint.txt
+          if-no-files-found: ignore
+          retention-days: 7
+      - name: Enforce golangci-lint gate
+        if: steps.golangci.outcome == 'failure'
+        run: |
+          cat golangci-lint.txt 2>/dev/null || true
+          exit 1
 
   frontend:
-    name: Frontend (lint, test, build)
+    name: Frontend (test, coverage, build)
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -55,8 +82,29 @@ jobs:
           cache-dependency-path: frontend/package-lock.json
       - run: npm ci
       - run: npm run lint --if-present
-      - run: npm run test --if-present
-      - run: npm run build
+      - name: Frontend tests with coverage
+        run: npm run test -- --coverage
+      - name: Upload frontend coverage
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-coverage
+          path: frontend/coverage
+          if-no-files-found: ignore
+          retention-days: 14
+      - name: Frontend production build
+        shell: bash
+        run: |
+          set -o pipefail
+          npm run build 2>&1 | tee ../frontend-build.log
+      - name: Upload frontend build diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-build-diagnostics
+          path: frontend-build.log
+          if-no-files-found: ignore
+          retention-days: 7
 
   windows-build:
     name: Wails Windows build
@@ -78,13 +126,38 @@ jobs:
         working-directory: frontend
         run: npm ci
       - name: Build (unsigned)
-        run: wails build -platform windows/amd64 -skipbindings -ldflags "-X main.Version=ci-${{ github.sha }} -X main.Commit=${{ github.sha }}"
+        shell: pwsh
+        run: |
+          wails build -platform windows/amd64 -skipbindings -ldflags "-X main.Version=ci-${{ github.sha }} -X main.Commit=${{ github.sha }}" 2>&1 | Tee-Object -FilePath wails-build.log
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Upload Wails build diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: wails-windows-build-diagnostics
+          path: wails-build.log
+          if-no-files-found: ignore
+          retention-days: 7
+      - name: Root package tests
+        shell: pwsh
+        run: |
+          go test . 2>&1 | Tee-Object -FilePath root-package-tests.log
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Upload root package test diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: root-package-test-diagnostics
+          path: root-package-tests.log
+          if-no-files-found: ignore
+          retention-days: 7
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
           name: MailMergeApp-windows-unsigned
           path: build/bin/*.exe
           if-no-files-found: error
+          retention-days: 14
 
   security:
     name: Dependency scan
@@ -95,12 +168,63 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
       - name: govulncheck
+        shell: bash
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck ./backend/... || true
-      - name: npm audit
+          set +e
+          govulncheck -json ./backend/... > govulncheck.json
+          status=$?
+          cat govulncheck.json
+          exit $status
+      - name: Upload govulncheck report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: govulncheck-report
+          path: govulncheck.json
+          if-no-files-found: ignore
+          retention-days: 14
+      - name: npm production audit
         working-directory: frontend
         run: |
           npm ci
-          npm audit --omit=dev || true
+          npm audit --omit=dev --audit-level=high
+
+  sbom:
+    name: Generate SBOMs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Generate Go CycloneDX SBOM
+        run: |
+          go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@${{ env.CYCLONEDX_GOMOD_VERSION }}
+          cyclonedx-gomod mod -json -output backend.cdx.json
+      - name: Generate frontend CycloneDX SBOM
+        working-directory: frontend
+        run: |
+          npm ci
+          npm sbom --omit=dev --sbom-format=cyclonedx > ../frontend.cdx.json
+      - name: Upload SBOMs
+        uses: actions/upload-artifact@v4
+        with:
+          name: cyclonedx-sboms
+          path: |
+            backend.cdx.json
+            frontend.cdx.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/release-candidate.yml

@@ -0,0 +1,123 @@
+name: Release Candidate
+
+on:
+  workflow_dispatch:
+    inputs:
+      label:
+        description: Optional release-candidate label, for example 1.2.0-rc.1
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: "1.24.x"
+  NODE_VERSION: "22.23.1"
+  WAILS_VERSION: "v2.11.0"
+  GOLANGCI_LINT_VERSION: "v2.11.4"
+  CYCLONEDX_GOMOD_VERSION: "v1.10.0"
+
+jobs:
+  validate:
+    name: Validate release candidate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Go formatting
+        shell: bash
+        run: |
+          unformatted=$(gofmt -l $(git ls-files '*.go'))
+          test -z "$unformatted" || { echo "$unformatted"; exit 1; }
+      - name: Go vet
+        run: go vet ./backend/...
+      - name: Go race tests and coverage
+        run: go test -race -covermode=atomic -coverprofile=backend-coverage.out ./backend/...
+      - name: Go lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          args: ./backend/...
+      - name: Go vulnerability scan
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./backend/...
+      - name: Frontend install, test, and build
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run lint --if-present
+          npm run test -- --coverage
+          npm run build
+          npm audit --omit=dev --audit-level=high
+      - name: Generate CycloneDX SBOMs
+        run: |
+          go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@${{ env.CYCLONEDX_GOMOD_VERSION }}
+          cyclonedx-gomod mod -json -output backend.cdx.json
+          cd frontend
+          npm sbom --omit=dev --sbom-format=cyclonedx > ../frontend.cdx.json
+      - name: Upload validation evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-candidate-validation
+          path: |
+            backend-coverage.out
+            frontend/coverage
+            backend.cdx.json
+            frontend.cdx.json
+          if-no-files-found: error
+          retention-days: 30
+
+  windows-package:
+    name: Build Windows release candidate
+    needs: validate
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install Wails CLI
+        run: go install github.com/wailsapp/wails/v2/cmd/wails@${{ env.WAILS_VERSION }}
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci
+      - name: Build release candidate
+        shell: pwsh
+        run: |
+          $label = "${{ inputs.label }}"
+          if ([string]::IsNullOrWhiteSpace($label)) { $label = "rc-${{ github.run_number }}" }
+          $date = (Get-Date -Format "yyyy-MM-dd")
+          wails build -platform windows/amd64 -ldflags "-X main.Version=$label -X main.Commit=${{ github.sha }} -X main.BuildDate=$date"
+      - name: Root package tests
+        run: go test .
+      - name: Create checksums
+        shell: pwsh
+        run: |
+          Get-ChildItem build/bin/*.exe | Sort-Object Name | ForEach-Object {
+            (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLowerInvariant() + "  " + $_.Name
+          } | Out-File build/bin/SHA256SUMS.txt -Encoding ascii
+      - name: Upload release candidate
+        uses: actions/upload-artifact@v4
+        with:
+          name: MailMergeApp-release-candidate
+          path: |
+            build/bin/*.exe
+            build/bin/SHA256SUMS.txt
+          if-no-files-found: error
+          retention-days: 30