Fix audit findings: GPU pool, index integrity, worker/snapshot, API, CI

.changeset/audit-hardening.md

@@ -0,0 +1,7 @@
+---
+"webgpu-search": patch
+---
+
+Harden correctness and safety from a repo audit: shared GPU device pool no longer double-acquires or destroys a live device under concurrent creation; GPU buffers are clamped to `maxStorageBufferBindingSize` (oversized corpora now fall back to CPU instead of silently returning 0 results); batch mutations are atomic when a filter getter throws; high-cardinality string filters use bounded memory; worker INIT/RESTORE keep the previous index on failure and handle messages in order; snapshots reject duplicate/invalid doc IDs and accept typed-array buffers; custom IndexedDB store names are created on existing databases.
+
+Behaviour changes: boolean filter fields accept only `true`/`false` (or `"true"`/`"false"`); blank number filter bounds throw `InvalidFilterError`; numeric IDs sort before string IDs on score ties; field getters ignore `Object.prototype` properties.

.github/workflows/ci.yml

@@ -6,17 +6,20 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test-and-build:
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.2
 
@@ -107,9 +110,12 @@ jobs:
       - name: Run CPU Baseline Pin (support-matrix reference contract)
         run: bun run test:cpu-baseline
 
+      - name: Run Audit Regression Tests (index integrity, GPU pool, worker/snapshot)
+        run: bun run test:regressions
+
       - name: Setup Chrome (browser regression gate)
         id: setup-chrome
-        uses: browser-actions/setup-chrome@v1
+        uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1
         with:
           chrome-version: stable
 
@@ -127,7 +133,7 @@ jobs:
           # fall back to PATH lookup for self-hosted / local `act` runs.
           CHROME_BIN="${{ steps.setup-chrome.outputs.chrome-path }}"
           if [ -z "$CHROME_BIN" ] || [ ! -x "$CHROME_BIN" ]; then
-            CHROME_BIN="$(command -v google-chrome-stable || command -v google-chrome || command -v chromium || command -v chrome || echo \"${CHROME_PATH:-}\")"
+            CHROME_BIN="$(command -v google-chrome-stable || command -v google-chrome || command -v chromium || command -v chrome || echo "${CHROME_PATH:-}")"
           fi
           if [ -z "$CHROME_BIN" ] || [ ! -x "$CHROME_BIN" ]; then
             echo "Chrome/Chromium binary not found or not executable (got '${CHROME_BIN:-<empty>}'); failing browser regression gate." >&2
@@ -156,7 +162,7 @@ jobs:
 
       - name: Upload Browser Test Logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: browser-test-logs
           path: |

.github/workflows/release.yml

@@ -1,36 +1,45 @@
 name: Release
 
+# Runs only after the CI workflow succeeded for a push to main, so an
+# untested commit can never be versioned or published.
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'packages/**'
-      - '.changeset/**'
+  workflow_run:
+    workflows: [ CI ]
+    types: [ completed ]
+    branches: [ main ]
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'main'
     runs-on: ubuntu-latest
+    # No `id-token: write`: npm provenance is not configured.
     permissions:
       contents: write
       pull-requests: write
-      id-token: write
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
+          # Release exactly the commit CI validated.
+          ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.2
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           registry-url: 'https://registry.npmjs.org'
@@ -43,7 +52,7 @@ jobs:
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           publish: bun run release
           version: bun run version-packages