Add G5 repository-only pnpm distribution

.github/workflows/ci.yml

@@ -254,6 +254,8 @@ jobs:
         run: pnpm check:benchmark-authority
       - name: Check browser/output certification authority
         run: pnpm check:browser-output-authority
+      - name: Check repository-only pnpm distribution contract
+        run: pnpm check:repository-distribution
       - name: Smoke Benchmark Authority v2 runner
         run: pnpm check:benchmark-smoke
       - name: Build and validate the PliegoRS-authored website

.github/workflows/distribution.yml

@@ -0,0 +1,254 @@
+name: Repository distribution
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      attest:
+        description: Generate GitHub/Sigstore attestations for this exact source
+        required: true
+        type: boolean
+        default: false
+
+concurrency:
+  group: repository-distribution-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref_type != 'tag' }}
+
+permissions:
+  contents: read
+
+jobs:
+  native:
+    name: Native ${{ matrix.target }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-pc-windows-msvc
+            runner: windows-latest
+            extension: .exe
+          - target: x86_64-unknown-linux-gnu
+            runner: ubuntu-24.04
+            extension: ""
+          - target: aarch64-apple-darwin
+            runner: macos-15
+            extension: ""
+    env:
+      CARGO_TARGET_DIR: target/distribution-build/${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.13.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 11.7.0
+          run_install: false
+      - name: Install pinned Rust and SBOM tooling
+        run: |
+          rustup toolchain install 1.96.0 --profile minimal --target ${{ matrix.target }}
+          cargo +1.96.0 install cargo-cyclonedx --version '=0.5.9' --locked
+      - name: Build native CLI and LSP
+        run: cargo +1.96.0 build --release --locked --target ${{ matrix.target }} -p pliego-cssc -p pliego-css-lsp
+      - name: Generate target-specific CycloneDX SBOMs
+        run: cargo cyclonedx --format json --target ${{ matrix.target }} --all-features --spec-version 1.5
+      - name: Stage exact-source native payload
+        id: stage
+        shell: bash
+        run: |
+          set -euo pipefail
+          tree="$(git show -s --format=%T HEAD)"
+          args=(
+            "--target=${{ matrix.target }}"
+            "--binary-dir=target/distribution-build/${{ matrix.target }}/${{ matrix.target }}/release"
+            "--cli-sbom=crates/pliego-cssc/pliego-cssc.cdx.json"
+            "--lsp-sbom=crates/pliego-css-lsp/pliego-css-lsp.cdx.json"
+            "--output=target/distribution-native/${{ matrix.target }}"
+            "--source-commit=${GITHUB_SHA}"
+            "--git-tree=${tree}"
+          )
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            args+=("--tag=${GITHUB_REF_NAME}")
+          fi
+          node scripts/prepare-native-distribution.mjs "${args[@]}"
+          "target/distribution-native/${{ matrix.target }}/pliego-cssc${{ matrix.extension }}" --version
+          "target/distribution-native/${{ matrix.target }}/pliego-css-lsp${{ matrix.extension }}" --version
+      - name: Attest CLI binary and SBOM
+        if: ${{ github.ref_type == 'tag' || (github.event_name == 'workflow_dispatch' && inputs.attest) }}
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        with:
+          subject-path: target/distribution-native/${{ matrix.target }}/pliego-cssc${{ matrix.extension }}
+          sbom-path: target/distribution-native/${{ matrix.target }}/pliego-cssc.cdx.json
+      - name: Attest LSP binary and SBOM
+        if: ${{ github.ref_type == 'tag' || (github.event_name == 'workflow_dispatch' && inputs.attest) }}
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        with:
+          subject-path: target/distribution-native/${{ matrix.target }}/pliego-css-lsp${{ matrix.extension }}
+          sbom-path: target/distribution-native/${{ matrix.target }}/pliego-css-lsp.cdx.json
+      - name: Upload native payload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-${{ matrix.target }}
+          path: target/distribution-native/${{ matrix.target }}
+          if-no-files-found: error
+          retention-days: 30
+
+  assemble:
+    name: Assemble repository assets
+    needs: native
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.13.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 11.7.0
+          run_install: false
+      - name: Verify pinned pnpm
+        run: test "$(pnpm --version)" = "11.7.0"
+      - name: Install locked repository dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Validate repository distribution source contract
+        run: pnpm check:repository-distribution
+      - name: Download all native payloads
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: native-*
+          path: target/distribution-incoming
+          merge-multiple: false
+      - name: Assemble and validate release assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          tree="$(git show -s --format=%T HEAD)"
+          args=(
+            "--input=target/distribution-incoming"
+            "--output=target/distribution"
+            "--source-commit=${GITHUB_SHA}"
+            "--git-tree=${tree}"
+          )
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            args+=("--tag=${GITHUB_REF_NAME}")
+          fi
+          node scripts/build-repository-distribution.mjs "${args[@]}"
+          pnpm check:distribution-bundle -- --root=target/distribution/release-assets
+      - name: Upload complete repository distribution
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: repository-distribution-${{ github.sha }}
+          path: target/distribution/release-assets
+          if-no-files-found: error
+          retention-days: 30
+
+  install:
+    name: pnpm install ${{ matrix.host }}
+    needs: assemble
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - host: windows-x64
+            runner: windows-latest
+          - host: linux-x64
+            runner: ubuntu-24.04
+          - host: macos-arm64
+            runner: macos-15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.13.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 11.7.0
+          run_install: false
+      - name: Verify pinned pnpm
+        shell: bash
+        run: test "$(pnpm --version)" = "11.7.0"
+      - name: Download complete repository distribution
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: repository-distribution-${{ github.sha }}
+          path: target/distribution/release-assets
+      - name: Install verified local asset with pnpm and execute both binaries
+        shell: bash
+        run: |
+          version="$(node -p "require('./packages/cli/package.json').version")"
+          node scripts/check-installed-repository-package.mjs \
+            "--tarball=target/distribution/release-assets/pliegocss-pnpm-${version}.tgz"
+
+  attest-release-assets:
+    name: Attest release assets
+    if: ${{ github.ref_type == 'tag' || (github.event_name == 'workflow_dispatch' && inputs.attest) }}
+    needs: install
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: repository-distribution-${{ github.sha }}
+          path: target/distribution/release-assets
+      - name: Generate GitHub/Sigstore provenance for every release asset
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        with:
+          subject-path: target/distribution/release-assets/*
+
+  draft-release:
+    name: Create draft GitHub Release
+    if: ${{ github.ref_type == 'tag' }}
+    needs: attest-release-assets
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Require immutable releases before creating a draft
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api "repos/${GITHUB_REPOSITORY}/immutable-releases" \
+            -H "X-GitHub-Api-Version: 2026-03-10" \
+            --jq 'select(.enabled == true) | .enabled' | grep -qx true
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: repository-distribution-${{ github.sha }}
+          path: target/distribution/release-assets
+      - name: Create draft release with complete assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          args=(
+            "${GITHUB_REF_NAME}"
+            target/distribution/release-assets/*
+            --repo "${GITHUB_REPOSITORY}"
+            --draft
+            --verify-tag
+            --title "PliegoCSS ${GITHUB_REF_NAME}"
+            --generate-notes
+          )
+          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
+            args+=(--prerelease)
+          fi
+          gh release create "${args[@]}"

CHANGELOG.md

@@ -8,6 +8,13 @@ pre-1.0 compatibility policy.
 
 ## [Unreleased]
 
+### Added
+
+- Add the G5 repository-only native distribution pipeline: Windows x64, Linux
+  x64 GNU, and macOS arm64 CLI/LSP archives; CycloneDX SBOMs; SHA-256
+  manifests; GitHub/Sigstore attestations; and a universal no-lifecycle pnpm
+  package that is never published to npmjs.
+
 ### Changed
 
 - Separate stable breakpoint identity from narrow-to-wide cascade rank. ThemeId

README.md

@@ -84,14 +84,20 @@ the [Tailwind CSS v4.3.2 matrix](./docs/benchmarks/tailwind-v4-competitive-matri
 
 - Rust **1.85 or newer**
 - Git
-- Node.js and pnpm are required only for repository development and full verification
+- Node.js and pnpm are required for repository development/full verification and for the optional
+  repository-hosted pnpm launcher; they are not Rust crate dependencies
 
 Install the public-preview CLI from crates.io:
 
 ```console
 cargo install pliego-cssc --version '=0.1.0-rc.2' --locked
 ```
 
+Later candidates may also attach a repository-only universal pnpm package to their immutable GitHub
+Release. It is never published to npmjs, contains no dependencies or lifecycle scripts, and must be
+downloaded, verified, and installed as a local `.tgz` with pnpm. RC.2 predates that G5 artifact; see
+the [installation guide](./docs/getting-started/installation.md#repository-hosted-pnpm-package).
+
 Or clone the repository and build locally:
 
 ```console

THIRD_PARTY_NOTICES.md

@@ -74,7 +74,7 @@ bundled software dependencies.
 - Locked evidence: `tailwindcss@4.3.3`, `@tailwindcss/cli@4.3.3`,
   `tailwindcss@3.4.19`, `tailwindcss@4.3.2`, `@tailwindcss/cli@4.3.2`, their registry SRI values,
   and the complete transitive `pnpm-lock.yaml` graph at SHA-256
-  `39f1ccd3f3b3262805d773e92bf8b2d0efc9ac755ba77460a0cb801d5ccea394`.
+  `b841e850a294c98603dd98fa8ba847ecd67d4fa490439726ac07939635ac2a51`.
 
 ## Browser-certification software
 

distribution/repository-distribution-v1.json

@@ -0,0 +1,56 @@
+{
+  "schemaVersion": 1,
+  "kind": "pliegocss-repository-distribution-policy",
+  "repository": "https://github.com/celiumsai/pliegocss",
+  "releaseAssetBase": "https://github.com/celiumsai/pliegocss/releases/download",
+  "package": {
+    "name": "@pliegocss/cli",
+    "format": "npm-tarball",
+    "registryPublication": "forbidden",
+    "distributionChannel": "github-release-asset",
+    "packageManager": "pnpm",
+    "packageManagerVersion": "11.7.0",
+    "lifecycleScripts": "forbidden",
+    "dependencies": "forbidden"
+  },
+  "release": {
+    "draftFirst": true,
+    "immutableRequiredBeforePublication": true,
+    "checksums": "sha256",
+    "sbom": "cyclonedx-json-1.5",
+    "sbomTool": "cargo-cyclonedx",
+    "sbomToolVersion": "0.5.9",
+    "provenance": "github-sigstore-attestation"
+  },
+  "binaries": [
+    "pliego-cssc",
+    "pliego-css-lsp"
+  ],
+  "targets": [
+    {
+      "id": "x86_64-pc-windows-msvc",
+      "os": "win32",
+      "arch": "x64",
+      "runner": "windows-latest",
+      "extension": ".exe",
+      "format": "pe"
+    },
+    {
+      "id": "x86_64-unknown-linux-gnu",
+      "os": "linux",
+      "arch": "x64",
+      "runner": "ubuntu-24.04",
+      "extension": "",
+      "format": "elf"
+    },
+    {
+      "id": "aarch64-apple-darwin",
+      "os": "darwin",
+      "arch": "arm64",
+      "runner": "macos-15",
+      "extension": "",
+      "format": "mach-o"
+    }
+  ],
+  "claimBoundary": "Repository artifacts provide exact-source native CLI and LSP binaries, a no-lifecycle universal pnpm package, SHA-256 checksums, CycloneDX SBOMs, and GitHub/Sigstore provenance. They do not claim npmjs publication, Authenticode signing, Apple notarization, or support for undeclared hosts."
+}