hoainho · hoainho · May 21, 2026 · May 19, 2026 · May 20, 2026 · May 20, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -18,14 +18,12 @@ jobs:
       matrix:
         os:
           - macos-15
-          - macos-13
+          - macos-14
           - ubuntu-24.04
           - ubuntu-22.04
           - windows-2022
         node: ["22.x", "24.x"]
         exclude:
-          - os: macos-13
-            node: "24.x"
           - os: ubuntu-22.04
             node: "24.x"
     steps:
@@ -94,6 +92,16 @@ jobs:
       - run: pnpm --filter @ohmyperf/core build
       - run: pnpm --filter @ohmyperf/core api:check
 
+  actionlint:
+    name: actionlint (GitHub Actions workflow files)
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download actionlint
+        run: bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.12
+      - name: Lint all workflow files
+        run: ./actionlint -no-color -oneline
+
   parity:
     name: Lighthouse parity (main push only)
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
@@ -0,0 +1,73 @@
+name: deploy-pages
+
+# Zero-credential GitHub Pages deploy of apps/website to
+# https://hoainho.github.io/ohmyperf/ . Parallel to deploy-website.yml
+# (Cloudflare Pages, needs secrets). Keep build steps in lockstep.
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches: [main]
+    paths:
+      - 'apps/website/**'
+      - 'packages/viewer/**'
+      - 'packages/design-tokens/**'
+      - 'pnpm-lock.yaml'
+      - '.github/workflows/deploy-pages.yml'
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build website (static export with basePath=/ohmyperf)
+        env:
+          OHMYPERF_BASE_PATH: /ohmyperf
+        run: pnpm --filter '@ohmyperf/website...' build
+
+      - name: Verify out/ exists
+        run: |
+          test -d apps/website/out || (echo "Missing apps/website/out — Next.js static export failed" && exit 1)
+          test -f apps/website/out/index.html || (echo "Missing apps/website/out/index.html" && exit 1)
+          echo "Static export OK ($(find apps/website/out -type f | wc -l) files)"
+
+      - name: Disable Jekyll on Pages
+        run: touch apps/website/out/.nojekyll
+
+      - uses: actions/configure-pages@v5
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: apps/website/out
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4
diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
@@ -0,0 +1,64 @@
+name: deploy-website
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Cloudflare Pages branch (production = main, anything else = preview)'
+        required: false
+        default: 'main'
+  push:
+    branches: [main]
+    paths:
+      - 'apps/website/**'
+      - 'packages/viewer/**'
+      - 'packages/design-tokens/**'
+      - 'pnpm-lock.yaml'
+      - '.github/workflows/deploy-website.yml'
+
+concurrency:
+  group: deploy-website-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      deployments: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build website (static export)
+        run: pnpm --filter '@ohmyperf/website...' build
+
+      - name: Verify out/ exists
+        run: |
+          test -d apps/website/out || (echo "Missing apps/website/out — Next.js static export failed" && exit 1)
+          test -f apps/website/out/index.html || (echo "Missing apps/website/out/index.html" && exit 1)
+          echo "Static export OK ($(find apps/website/out -type f | wc -l) files)"
+
+      - name: Deploy to Cloudflare Pages
+        id: deploy
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
+          command: pages deploy apps/website/out --project-name=ohmyperf --branch=${{ github.event.inputs.branch || github.ref_name }}
+
+      - name: Print deployment URL
+        run: |
+          echo "Deployed to: ${{ steps.deploy.outputs.deployment-url }}"
+          echo "Alias URL:   ${{ steps.deploy.outputs.pages-deployment-alias-url }}"
diff --git a/.github/workflows/publish-beta.yml b/.github/workflows/publish-beta.yml
@@ -15,6 +15,7 @@ jobs:
     timeout-minutes: 20
     permissions:
       contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -26,10 +27,43 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: pnpm
 
+      - name: Preflight — verify NPM_TOKEN authenticates (skipped in OIDC-only mode)
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set +e
+          if [ -z "${NODE_AUTH_TOKEN}" ]; then
+            echo "::notice::NPM_TOKEN secret is empty — preflight skipped. Workflow will publish via OIDC trusted publishing only (see docs/PUBLISH-NPM-OIDC.md). If OIDC is not yet configured for these packages on npmjs.com, the publish step will fail with E404 — that is the signal to either (a) configure trusted publishers per the OIDC doc, or (b) set the NPM_TOKEN secret for token-based publishing."
+            exit 0
+          fi
+          echo "NPM_TOKEN is set — running token-mode preflight."
+          WHOAMI_OUT=$(npm whoami 2>&1)
+          WHOAMI_RC=$?
+          if [ $WHOAMI_RC -ne 0 ]; then
+            {
+              echo "::error::NPM_TOKEN is set but does not authenticate. npm whoami output: $WHOAMI_OUT"
+              echo "::error::This is an E401-class failure (invalid or expired token)."
+              echo "::error::Fix: regenerate the token per docs/PUBLISH-NPM-TOKEN.md, OR remove the secret to use OIDC per docs/PUBLISH-NPM-OIDC.md."
+            }
+            exit 1
+          fi
+          echo "npm whoami: $WHOAMI_OUT"
+          ACCESS_OUT=$(npm access list packages @ohmyperf 2>&1)
+          ACCESS_RC=$?
+          echo "$ACCESS_OUT" | head -20
+          if [ $ACCESS_RC -ne 0 ]; then
+            {
+              echo "::warning::npm access list failed for @ohmyperf (exit=$ACCESS_RC)."
+              echo "::warning::Token may be a Granular Access Token without 'Read and write' on @ohmyperf scope."
+              echo "::warning::If the actual publish step below fails with E404 PUT, that is the symptom — see docs/PUBLISH-NPM-TOKEN.md."
+            }
+          fi
+          echo "Preflight passed: token authenticates."
+
       - name: Install
         run: pnpm install --frozen-lockfile
 

diff --git a/.github/workflows/publish-now.yml b/.github/workflows/publish-now.yml