ci: make every sub-project buildable from its lockfile

.github/workflows/ci.yml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  node:
+    name: Build ${{ matrix.project }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        project: [pg-manual, pg-node, pg-sveltekit]
+    defaults:
+      run:
+        working-directory: ${{ matrix.project }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: ${{ matrix.project }}/package-lock.json
+
+      - name: Install from lockfile
+        run: npm ci
+
+      - name: Build
+        run: npm run build --if-present
+
+      - name: Check
+        run: npm run check --if-present
+
+      - name: Lint
+        run: npm run lint --if-present
+
+  dotnet:
+    name: Build pg-dotnet
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: pg-dotnet
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: |
+            8.0.x
+            10.0.x
+
+      - name: Restore from lockfile
+        run: dotnet restore --locked-mode
+
+      - name: Build
+        run: dotnet build --no-restore

.github/workflows/sdk-canary.yml

@@ -0,0 +1,111 @@
+name: SDK canary
+
+# Builds every example against the LATEST published PostGuard SDKs instead of
+# the pinned lockfile versions, so we hear about a breaking SDK release before
+# a reader of docs.postguard.eu does.
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  node:
+    name: Canary ${{ matrix.project }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - project: pg-manual
+            package: '@e4a/pg-wasm'
+          - project: pg-node
+            package: '@e4a/pg-js'
+          - project: pg-sveltekit
+            package: '@e4a/pg-js'
+    defaults:
+      run:
+        working-directory: ${{ matrix.project }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+
+      - name: Install latest ${{ matrix.package }}
+        run: npm install "${{ matrix.package }}@latest"
+
+      - name: Report resolved version
+        run: node -p "require('./node_modules/${{ matrix.package }}/package.json').version"
+
+      - name: Build
+        run: npm run build --if-present
+
+      - name: Check
+        run: npm run check --if-present
+
+      - name: Lint
+        run: npm run lint --if-present
+
+  dotnet:
+    name: Canary pg-dotnet
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: pg-dotnet
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: |
+            8.0.x
+            10.0.x
+
+      - name: Install latest E4A.PostGuard
+        run: dotnet add package E4A.PostGuard
+
+      - name: Build
+        run: dotnet build
+
+  report:
+    name: Report failure
+    runs-on: ubuntu-latest
+    needs: [node, dotnet]
+    if: failure()
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Open or update the canary issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+
+          gh label create sdk-canary \
+            --description 'Opened by the weekly SDK canary' \
+            --color D93F0B --force
+
+          title='SDK canary failed against the latest published SDKs'
+          body=$(cat <<EOF
+          The weekly canary built every example against the latest published \`@e4a/pg-js\`, \`@e4a/pg-wasm\` and \`E4A.PostGuard\`, and at least one build failed. Per-project results are in the run log:
+
+          $RUN_URL
+
+          This does not affect the pinned lockfile builds on \`main\`. It means an SDK release has moved ahead of what the examples use. Update the affected example, or pin it deliberately and record why.
+          EOF
+          )
+
+          existing=$(gh issue list --state open --label sdk-canary --json number --jq '.[0].number // empty')
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --body "$body"
+          else
+            gh issue create --title "$title" --body "$body" --label sdk-canary
+          fi

CLAUDE.md

@@ -12,7 +12,25 @@ Example applications demonstrating PostGuard integration. No release automation;
 - `pg-manual/`: Webpack 5 + plain JS using `@e4a/pg-wasm` directly (low-level).
 
 ## CI / tests
-Only a Conventional Commit PR-title check runs in CI; there's no build/test CI and no test suite (example/reference code only). Code snippets in docs.postguard.eu are sourced from this repo, see postguard-docs' CLAUDE.md for the source-link conventions and the consolidation-commit gotcha.
+There is no test suite (example/reference code only). Code snippets in docs.postguard.eu are sourced from this repo, see postguard-docs' CLAUDE.md for the source-link conventions and the consolidation-commit gotcha.
+
+`.github/workflows/pr-title.yml` lints the PR title against Conventional Commits.
+
+The `dobby-coder` GitHub App has no `workflows` permission, so any push touching `.github/workflows/` is rejected by the remote with "refusing to allow a GitHub App to create or update workflow". Agents must deliver workflow changes here as a patch for a human to apply.
+
+Every sub-project builds reproducibly from a committed lockfile:
+
+| Sub-project | Install from lockfile | Then |
+| --- | --- | --- |
+| `pg-manual` | `npm ci` | `npm run build && npm run check` |
+| `pg-node` | `npm ci` | `npm run check` |
+| `pg-sveltekit` | `npm ci` | `npm run build && npm run check && npm run lint` |
+| `pg-dotnet` | `dotnet restore --locked-mode` | `dotnet build --no-restore` |
+
+- `pg-node` has no bundler, so `npm run check` is its build equivalent: a `node --check` syntax pass over `index.mjs`, plus an ESM import of `src/encryption.mjs`. The import is the part that matters: it resolves `src/`'s named imports against the installed `@e4a/pg-js`, so a renamed or removed SDK export fails the check. Two things it does not cover. `index.mjs`'s own imports are never linked, because importing `index.mjs` would run the CLI, so renaming an export in `src/config.mjs` still passes the check and only fails at `node index.mjs`. And it says nothing about signature changes behind an unchanged export name.
+- `pg-manual`'s `build` script carries `--fail-on-warnings`. Webpack reports a missing *named* export on a static import as a warning and still exits 0, which is how the `web-streams-polyfill` rename recorded under "pg-manual build notes" below could have shipped green; the flag turns that class into a failed build. It does not catch the yivi breakage recorded there: `import * as Foo` is valid ESM whatever the module exports, so webpack compiles it with zero warnings and the failure is a runtime `TypeError: ... is not a constructor` at `new YiviCore(...)` in `examples/utils.js`. No build gate covers that class, and `check/sdk-exports.js` can't close it either, because the mistake is in this repo's own import form rather than in the SDK's export list; only running the example would catch it. The tree compiles with zero warnings today, so keep the flag rather than dropping it.
+- `pg-manual`'s `npm run check` is a second, tiny webpack build (`check/webpack.config.js`), also run with `--fail-on-warnings`. It covers the half the flag on `build` cannot reach: the examples get `@e4a/pg-wasm` through a *dynamic* `import()` and destructure at runtime, and webpack analyses no exports across that boundary, so dropping `seal` from the SDK leaves `npm run build` at exit 0 with zero warnings. `check/sdk-exports.js` imports the same names statically, which puts them back under the analysis. Adding a name means editing both the import and the object literal under it, because an unreferenced import is elided and probes nothing.
+- `pg-dotnet` restores with a lockfile (`packages.lock.json`, enabled by `RestorePackagesWithLockFile`). After changing any `PackageReference`, run `dotnet restore` and commit the regenerated `packages.lock.json` in the same commit, otherwise `--locked-mode` fails with `NU1004: the package reference ... has changed`.
 
 ## Known issues / intentional non-fixes
 - `pg-manual/webpack.config.js` hardcodes `mode: 'development'` intentionally. This is an example app and does not need a production build; don't refile or propose a fix for the dev-only webpack mode.
@@ -31,4 +49,4 @@ Only a Conventional Commit PR-title check runs in CI; there's no build/test CI a
 - `@privacybydesign/yivi-{core,client,popup}` 0.2 to 1.x changed module shape: v0.2 was CJS (`module.exports = class Foo`) and worked under `import * as Foo from '...'` via webpack's CJS interop; v1.0 ships proper ESM with named exports, so `import * as` no longer gives a callable constructor. Switch to `import { YiviCore } from '@privacybydesign/yivi-core'` (same for `YiviClient`/`YiviPopup`); `yivi-css` stays a bare side-effect import. The `yivi.use(...)` plugin contract is unchanged, expect the named-import migration to be the only code change on future yivi majors.
 - Bumping `webpack-dev-server` does NOT auto-refresh its already-locked transitive `ws` / `http-proxy-middleware` / `launch-editor` versions, even when the new wds's declared ranges already permit the CVE-fixed versions. After bumping `webpack-dev-server`, run `npm update ws http-proxy-middleware launch-editor` in `pg-manual` to pull the fixed versions in-range, then re-check `npm audit`. No `overrides` entry is needed for these three.
 - Dependency override: `overrides.uuid: ^11.1.1`. The chain is `uuid <- sockjs <- webpack-dev-server`; sockjs's latest still pins `uuid ^8.3.2` (GHSA-w5hq-g745-h8pq), so no in-range fix exists. Use 11.1.1, not 12+: uuid 12+ ships ESM-only (`type: module`), while sockjs `require()`s it; 11.1.1 is the newest patched line with a CJS `main`. Remove the override if sockjs ever bumps its uuid pin, or if webpack-dev-server drops sockjs. Scoped to `pg-manual/` only, the other example dirs don't pull uuid.
-- Build verification: `npm install && npm run build` must be a clean compile with zero "export ... was not found" warnings.
+- Build verification: `npm install && npm run build && npm run check` must be a clean compile with zero "export ... was not found" warnings.

pg-dotnet/PostGuard.Example.csproj

@@ -6,6 +6,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <UserSecretsId>a6cc2768-9070-459f-8eed-ea999be6e096</UserSecretsId>
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
   </PropertyGroup>
 
   <ItemGroup>