Ship standalone Action bundle and validate API event artifacts

.github/workflows/hardening.yml

@@ -0,0 +1,21 @@
+name: Action build and regression tests
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - run: npm ci --ignore-scripts
+      - run: npm run build
+      - run: npm test
+      - name: Check committed bundle
+        run: git diff --exit-code -- dist
+      - name: Run packaged action
+        uses: ./
+        with:
+          upload_artifact: 'true'

.gitignore

@@ -0,0 +1,4 @@
+node_modules
+jep-event-artifact.json
+
+.build/

HARDENING.md

@@ -0,0 +1,31 @@
+# Implementation hardening — September 2026
+
+Ship the executable dependencies required by action.yml.
+
+## Changes
+
+The build emits a committed ncc bundle and third-party licenses, with a lockfile. RFC 8785 key ordering handles numeric-looking property names. Artifacts are schema checked. D/T/V require explicit what_json; event_ref is separate from the Git ref. Unknown modes and unsuccessful API validation fail the action. Informational JAC metadata is not marked critical without a handler.
+
+## Validation
+
+```sh
+npm ci --ignore-scripts
+npm run build
+npm test
+```
+
+## Compatibility and remaining limits
+
+Artifact mode remains explicitly unsigned and level 0. README examples use main because the advertised v0.6.0 tag does not exist; after merge, pin a reviewed commit or release. No release tag or package publication is performed. The schema copy is synchronized with the accompanying jep-v06 conformance repair.
+
+## Follow-up hardening
+
+The schema matches the companion conformance repair. API requests have a 30-second timeout; returned events must satisfy the structural schema and match the reported hash. The integration harness executes a copied standalone bundle outside node_modules. Action results in artifact mode remain explicitly unsigned Level 0.
+
+Shared event schema SHA-256: `5d0527c1649bd49f0de632e660eff46096522ea76a49eb7104ac83522614059f`.
+
+## Reproducible and patched Action dependencies
+
+Build from a real local node_modules directory with npm ci, rather than a symlink to a different checkout: webpack module identifiers must remain reproducible. The Action uses Node 24 and pins current patched @actions/core, @actions/github, and @actions/artifact dependencies to remove the audit-reported Octokit and undici dependency vulnerabilities. Custom runners must support JavaScript actions using node24.
+
+The pinned Actions packages now use ESM exports. The build keeps CommonJS unit-test output and feeds separately emitted ES modules to ncc for the standalone runtime bundle. CI checks a clean rebuild and exercises artifact upload with the packaged Action. npm audit --omit=dev reports zero dependency vulnerabilities for this lockfile.

README.md

@@ -80,7 +80,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: hjs-spec/jep-github-action@v0.6.0
+      - uses: hjs-spec/jep-github-action@main
         id: jep
         with:
           mode: artifact
@@ -136,3 +136,5 @@ It does not replace:
 - JAC v0.5 Repository: https://github.com/hjs-spec/jac-agent-02
 - JEP v0.6 Spec Demo: https://huggingface.co/spaces/yuqiangJEP/jep-v06-spec-demo/tree/main
 - JEP v0.6 Conformance Suite: https://huggingface.co/datasets/yuqiangJEP/jep-v06-conformance-suite
+
+The Action runtime and build require Node 24. Custom runners must support node24 JavaScript actions. Rebuild with npm ci and npm run build in the checkout itself; keep the committed bundle consistency check enabled.

action.yml

@@ -11,6 +11,14 @@ inputs:
     description: "JEP verb: J, D, T, or V"
     required: false
     default: "J"
+  what_json:
+    description: "JSON claim object or digest; required for D/T/V"
+    required: false
+    default: ""
+  event_ref:
+    description: "Referenced JEP event digest; distinct from the Git ref"
+    required: false
+    default: ""
   actor:
     description: "Actor identifier"
     required: false
@@ -47,8 +55,8 @@ outputs:
     description: "Local path to the generated artifact"
 
 runs:
-  using: "node20"
-  main: "dist/index.js"
+  using: "node24"
+  main: "dist/index.mjs"
 
 branding:
   icon: "check-circle"