feat(DEN-1301): add secure offline release-plan HTML

.github/workflows/den-1301-finalize.yml

@@ -0,0 +1,77 @@
+name: DEN-1301 finalize release-plan HTML
+
+on:
+ push:
+ branches:
+ - feat/den-1301-release-plan-html
+ pull_request:
+ branches:
+ - main
+
+permissions:
+ contents: write
+
+concurrency:
+ group: den-1301-finalize-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ apply-test-publish:
+ runs-on: ubuntu-latest
+ timeout-minutes: 45
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+ with:
+ ref: feat/den-1301-release-plan-html
+ path: zed-cli
+ fetch-depth: 0
+
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+ with:
+ repository: zed-pkg/zed-interfaces
+ ref: dc0e0a0620b9462817950b552d3d334a184b1cb1
+ path: zed-interfaces
+ persist-credentials: false
+
+ - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+ with:
+ toolchain: stable
+ components: rustfmt, clippy
+
+ - name: Apply the reviewed source transformations
+ working-directory: zed-cli
+ shell: bash
+ run: |
+ set -euo pipefail
+ if grep -q 'pub fn render_html' src/release.rs; then
+ echo 'DEN-1301 source is already materialized'
+ else
+ python3 scripts/den-1301-apply.py
+ python3 scripts/den-1301-postprocess.py
+ fi
+
+ - name: Validate CLI, HTML security, and the complete Rust surface
+ working-directory: zed-cli
+ shell: bash
+ run: |
+ set -euo pipefail
+ cargo fmt --all
+ git diff --check
+ cargo test --locked --test release_plan_html
+ cargo test --locked --all-targets
+ cargo clippy --locked --all-targets -- -D warnings
+
+ - name: Publish only tested source changes
+ working-directory: zed-cli
+ shell: bash
+ run: |
+ set -euo pipefail
+ git config user.name 'github-actions[bot]'
+ git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+ git add .cli-flags.toml src/cli.rs src/main.rs src/release.rs tests/release_plan_html.rs
+ if git diff --cached --quiet; then
+ echo 'tested source already published'
+ exit 0
+ fi
+ git commit -m 'feat(DEN-1301): render secure offline release-plan HTML'
+ git push origin HEAD:feat/den-1301-release-plan-html

.github/workflows/release-plan-browser.yml

@@ -0,0 +1,89 @@
+name: Release-plan browser report
+
+on:
+ pull_request:
+ paths:
+ - ".cli-flags.toml"
+ - ".github/workflows/release-plan-browser.yml"
+ - "src/cli.rs"
+ - "src/main.rs"
+ - "src/release.rs"
+ - "tests/browser/release-plan/**"
+ - "tests/fixtures/release-plan-browser/**"
+ - "tests/release_plan_html.rs"
+ push:
+ paths:
+ - ".cli-flags.toml"
+ - ".github/workflows/release-plan-browser.yml"
+ - "src/cli.rs"
+ - "src/main.rs"
+ - "src/release.rs"
+ - "tests/browser/release-plan/**"
+ - "tests/fixtures/release-plan-browser/**"
+ - "tests/release_plan_html.rs"
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+concurrency:
+ group: release-plan-browser-${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ browser-report:
+ runs-on: ubuntu-latest
+ timeout-minutes: 40
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+ with:
+ path: zed-cli
+ persist-credentials: false
+
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+ with:
+ repository: zed-pkg/zed-interfaces
+ ref: dc0e0a0620b9462817950b552d3d334a184b1cb1
+ path: zed-interfaces
+ persist-credentials: false
+
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+ with:
+ node-version: "24"
+
+ - name: Build the exact zed binary under test
+ working-directory: zed-cli
+ run: cargo build --locked --bin zed
+
+ - name: Install browser-test dependencies
+ working-directory: zed-cli/tests/browser/release-plan
+ run: npm install --no-audit --no-fund
+
+ - name: Install pinned Chromium runtime
+ working-directory: zed-cli/tests/browser/release-plan
+ run: npx playwright install --with-deps chromium
+
+ - name: Exercise offline, accessible, responsive release reports
+ working-directory: zed-cli/tests/browser/release-plan
+ env:
+ ZED_BIN: ${{ github.workspace }}/zed-cli/target/debug/zed
+ run: npm test
+
+ - name: Upload generated browser-test lock for review
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+ with:
+ name: den-1301-generated
+ path: zed-cli/tests/browser/release-plan/package-lock.json
+ if-no-files-found: error
+ retention-days: 3
+
+ - name: Upload browser failure evidence
+ if: ${{ failure() }}
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+ with:
+ name: release-plan-browser-failure
+ path: |
+ zed-cli/tests/browser/release-plan/playwright-report
+ zed-cli/tests/browser/release-plan/test-results
+ if-no-files-found: warn
+ retention-days: 7

docs/release-plan-html.md

@@ -0,0 +1,50 @@
+# Offline release-plan reports
+
+`zed release plan --html <PATH>` writes a self-contained browser report from the same `ReleasePlan` model used by the human and JSON outputs.
+
+```bash
+zed release plan --html ./artifacts/release-plan.html
+```
+
+The equivalent environment fallback is:
+
+```bash
+ZED_PKG_RELEASE_HTML=./artifacts/release-plan.html zed release plan
+```
+
+`--html` and `--json` are mutually exclusive. Human output remains the default.
+
+## Review workflow
+
+Open the resulting file directly in a browser. No web server is required.
+
+The report includes:
+
+- source package, version, repository, and VCS tag;
+- coordinated Zed package artifacts;
+- native registry artifacts;
+- forge package mirrors;
+- artifact counts and a keyboard-accessible filter across every table.
+
+Press `Escape` while the filter is focused to clear it.
+
+## Security properties
+
+- The report contains no remote scripts, styles, fonts, images, analytics, or network requests.
+- A restrictive Content Security Policy defaults every resource type to `none` and permits only nonce-bound embedded CSS and JavaScript.
+- Every manifest-derived value is HTML-escaped before rendering.
+- Repository links are emitted only for credential-free HTTP or HTTPS URLs. Other repository identifiers are displayed as inert text.
+- The report is written through a same-directory temporary file and atomically persisted.
+- An existing symbolic-link output path is refused rather than followed.
+- Browser interactivity is limited to local table filtering; no credentials or environment values are embedded.
+
+## Automation
+
+The Playwright contract builds the real `zed` binary, generates a report from a coordinated npm/crates fixture, and opens it through `file://`. It verifies semantic tables and counts, filtering and Escape reset, keyboard use, responsive containment, console/page errors, the CSP, and the absence of external requests.
+
+```bash
+cd tests/browser/release-plan
+npm ci
+npx playwright install chromium
+ZED_BIN=../../../target/debug/zed npm test
+```