October release candidate (DO NOT MERGE)

.claude/commands/check-ci.md

@@ -7,5 +7,7 @@ Run all CI checks locally, in order. Stop and report if any step fails.
 5. `cd crates/trusted-server-js/lib && npx vitest run`
 6. `cd crates/trusted-server-js/lib && npm run format`
 7. `cd docs && npm run format`
+8. `cargo run --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --bin ts -- dev lint domains --changed-vs origin/main` (use the PR's base branch in place of `main` when it targets another branch)
+9. `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs`
 
 Report a summary of all results when done.

.github/actions/setup-integration-test-env/action.yml

@@ -39,6 +39,18 @@ runs:
       shell: bash
       run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
+    # Pin Node before anything compiles trusted-server-core: its dependency on
+    # trusted-server-js runs the TSJS build with the `npm` on PATH. That covers
+    # the Rust builds below and the callers' later cargo steps, and callers use
+    # this Node directly too (e.g. `npm install -g wrangler`), so keep the step
+    # unconditional.
+    - name: Use Node.js for the TSJS build
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ steps.node-version.outputs.node-version }}
+        cache: npm
+        cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
     - name: Retrieve Viceroy version
       id: viceroy-version
       if: ${{ inputs.install-viceroy == 'true' }}
@@ -95,8 +107,11 @@ runs:
     - name: Build WordPress test container
       if: ${{ inputs.build-test-images == 'true' }}
       shell: bash
+      # Docker's official ECR mirror avoids Docker Hub anonymous pull limits.
       run: |
-        docker build -t test-wordpress:latest \
+        docker build \
+          --build-arg DOCKER_LIBRARY=public.ecr.aws/docker/library \
+          -t test-wordpress:latest \
           crates/trusted-server-integration-tests/fixtures/frameworks/wordpress/
 
     - name: Build Next.js test container
@@ -105,6 +120,7 @@ runs:
       run: |
         docker build \
           --build-arg NODE_VERSION=${{ steps.node-version.outputs.node-version }} \
+          --build-arg DOCKER_LIBRARY=public.ecr.aws/docker/library \
           -t test-nextjs:latest \
           crates/trusted-server-integration-tests/fixtures/frameworks/nextjs/
 

.github/workflows/codeql.yml

@@ -19,6 +19,16 @@ on:
   schedule:
     - cron: "42 6 * * 0"
 
+# Each pull request author runs one PR at a time per workflow, so one person
+# opening many PRs cannot fill the runner queue ahead of everyone else. Their
+# other runs wait in order instead of being cancelled, and every job has a
+# timeout so a hung run cannot hold that queue for hours. Bot-authored PRs and
+# other events get their own group from the run ID and are never held back.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -28,6 +38,7 @@ jobs:
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: 45
     permissions:
       # required for all workflows
       security-events: write

.github/workflows/format.yml

@@ -8,10 +8,21 @@ on:
 permissions:
   contents: read
 
+# Each pull request author runs one PR at a time per workflow, so one person
+# opening many PRs cannot fill the runner queue ahead of everyone else. Their
+# other runs wait in order instead of being cancelled, and every job has a
+# timeout so a hung run cannot hold that queue for hours. Bot-authored PRs and
+# other events get their own group from the run ID and are never held back.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   check-claude-md-symlink:
     name: CLAUDE.md symlink guard
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
 
@@ -39,9 +50,34 @@ jobs:
             exit 1
           fi
 
+  check-ci-node-pin:
+    name: CI Node pin guard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # The guard's tests check the tree before the guard landed; fetch only
+      # that commit instead of the full history.
+      - name: Fetch the pre-guard commit
+        run: git fetch --no-tags --depth=1 origin 7a0ecb4cbfa39af3d83f7e1ed2733d7eabdc4cb1
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+
+      - name: Test the guard
+        run: node --test scripts/check-ci-node-pin.test.mjs
+
+      # Every job that compiles trusted-server-core also runs the TSJS build, so
+      # it must set up the `.tool-versions` Node first (see issue #1204).
+      - name: Verify jobs pin Node before compiling Rust
+        run: node scripts/check-ci-node-pin.mjs
+
   format-rust:
     name: cargo fmt
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4
 
@@ -64,6 +100,15 @@ jobs:
           components: "clippy, rustfmt"
           cache-key: cargo-clippy
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Run cargo fmt
         uses: actions-rust-lang/rustfmt@v1
 
@@ -103,6 +148,7 @@ jobs:
 
   format-typescript:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     defaults:
       run:
         working-directory: crates/trusted-server-js/lib
@@ -134,6 +180,7 @@ jobs:
 
   format-docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     defaults:
       run:
         working-directory: docs
@@ -175,6 +222,7 @@ jobs:
   docs-proposal-scripts:
     name: docs-proposal scripts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/integration-tests.yml

@@ -1,4 +1,4 @@
-name: "Integration Tests"
+name: 'Integration Tests'
 
 permissions:
   contents: read
@@ -10,6 +10,16 @@ on:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
+# Each pull request author runs one PR at a time per workflow, so one person
+# opening many PRs cannot fill the runner queue ahead of everyone else. Their
+# other runs wait in order instead of being cancelled, and every job has a
+# timeout so a hung run cannot hold that queue for hours. Bot-authored PRs and
+# other events get their own group from the run ID and are never held back.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 env:
   ORIGIN_PORT: 8888
   ARTIFACTS_DIR: /tmp/integration-test-artifacts
@@ -30,11 +40,14 @@ jobs:
         uses: ./.github/actions/setup-integration-test-env
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
-          install-viceroy: "false"
-          build-cloudflare: "true"
+          install-viceroy: 'false'
+          build-cloudflare: 'true'
 
       - name: Generate integration Viceroy configs
-        run: ./scripts/generate-integration-viceroy-configs.sh
+        run: |
+          ./scripts/generate-integration-viceroy-configs.sh
+          INTEGRATION_APP_CONFIG_PATH=crates/trusted-server-integration-tests/fixtures/configs/trusted-server.trace.toml INTEGRATION_BIDDER_ORIGIN_URL="http://127.0.0.1:${ORIGIN_PORT}" ARTIFACTS_DIR="$ARTIFACTS_DIR/trace" ./scripts/generate-integration-viceroy-configs.sh
+          INTEGRATION_APP_CONFIG_PATH=crates/trusted-server-integration-tests/fixtures/configs/trusted-server.trace-auth.toml ARTIFACTS_DIR="$ARTIFACTS_DIR/trace-auth" ./scripts/generate-integration-viceroy-configs.sh
         env:
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
 
@@ -68,10 +81,10 @@ jobs:
         uses: ./.github/actions/setup-integration-test-env
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
-          install-viceroy: "true"
-          build-wasm: "false"
-          build-axum: "false"
-          build-test-images: "false"
+          install-viceroy: 'true'
+          build-wasm: 'false'
+          build-axum: 'false'
+          build-test-images: 'false'
 
       - name: Download integration test artifacts
         uses: actions/download-artifact@v4
@@ -90,11 +103,6 @@ jobs:
       - name: Load integration test Docker images
         run: docker load --input "$DOCKER_ARTIFACT_PATH"
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ steps.shared-setup.outputs.node-version }}
-
       - name: Install wrangler
         run: npm install -g wrangler
 
@@ -105,6 +113,7 @@ jobs:
           --target x86_64-unknown-linux-gnu
           -- --include-ignored
           --skip test_wordpress_fastly --skip test_nextjs_fastly
+          --skip trace_browser_workflow --skip trace_runtime_boundary
           --test-threads=1
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
@@ -127,9 +136,9 @@ jobs:
         uses: ./.github/actions/setup-integration-test-env
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
-          install-viceroy: "true"
-          build-wasm: "false"
-          build-test-images: "false"
+          install-viceroy: 'true'
+          build-wasm: 'false'
+          build-test-images: 'false'
 
       - name: Download integration test artifacts
         uses: actions/download-artifact@v4
@@ -152,6 +161,84 @@ jobs:
           VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
           RUST_LOG: info
 
+  trace-runtime-tests:
+    name: trace runtime and browser acceptance
+    needs: prepare-artifacts
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up trace test runtime
+        id: shared-setup
+        uses: ./.github/actions/setup-integration-test-env
+        with:
+          origin-port: ${{ env.ORIGIN_PORT }}
+          install-viceroy: 'true'
+          build-wasm: 'false'
+          build-axum: 'false'
+          build-test-images: 'false'
+
+      - name: Download integration test artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: integration-test-artifacts
+          path: ${{ env.ARTIFACTS_DIR }}
+
+      - name: Restore runtime binaries and framework images
+        run: |
+          chmod +x "$AXUM_ARTIFACT_PATH"
+          mkdir -p crates/trusted-server-adapter-cloudflare/build
+          cp -r "$CF_BUILD_ARTIFACT_PATH/." crates/trusted-server-adapter-cloudflare/build/
+          docker load --input "$DOCKER_ARTIFACT_PATH"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.shared-setup.outputs.node-version }}
+          cache: npm
+          cache-dependency-path: |
+            crates/trusted-server-integration-tests/browser/package-lock.json
+            crates/trusted-server-js/lib/package-lock.json
+
+      - name: Install browser dependencies
+        run: |
+          npm ci --prefix crates/trusted-server-js/lib
+          npm ci --prefix crates/trusted-server-integration-tests/browser
+          cd crates/trusted-server-integration-tests/browser
+          npx playwright install --with-deps chromium
+          npm install -g wrangler@4.83.0
+
+      - name: Install the verified Spin runtime
+        run: |
+          trace_spin_dir="$RUNNER_TEMP/trace-spin"
+          mkdir -p "$trace_spin_dir"
+          curl --fail --location --silent --show-error https://github.com/spinframework/spin/releases/download/v4.0.0/spin-v4.0.0-linux-amd64.tar.gz --output "$trace_spin_dir/spin.tar.gz"
+          echo "e705c9bfd9484a9175f392a116856680862a40f31d1a85618bed331f34ffccfa  $trace_spin_dir/spin.tar.gz" | sha256sum --check --strict
+          tar -xzf "$trace_spin_dir/spin.tar.gz" -C "$trace_spin_dir" spin
+          echo "$trace_spin_dir" >> "$GITHUB_PATH"
+
+      - name: Build the production Spin component
+        run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+
+      - name: Run trace acceptance against prepared runtimes
+        run: |
+          cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --test integration trace_runtime_boundary -- --ignored --test-threads=1 --nocapture
+          cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --test integration trace_browser_workflow -- --ignored --test-threads=1 --nocapture
+        env:
+          WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
+          AXUM_BINARY_PATH: ${{ env.AXUM_ARTIFACT_PATH }}
+          CLOUDFLARE_WRANGLER_DIR: ${{ github.workspace }}/crates/trusted-server-adapter-cloudflare
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+
+      - name: Upload trace browser evidence
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: trace-runtime-browser-evidence
+          path: crates/trusted-server-integration-tests/browser/test-results/trace-runtime-*/
+          retention-days: 7
+
   browser-tests:
     name: browser integration tests
     needs: prepare-artifacts
@@ -165,9 +252,9 @@ jobs:
         uses: ./.github/actions/setup-integration-test-env
         with:
           origin-port: ${{ env.ORIGIN_PORT }}
-          install-viceroy: "true"
-          build-wasm: "false"
-          build-test-images: "false"
+          install-viceroy: 'true'
+          build-wasm: 'false'
+          build-test-images: 'false'
 
       - name: Download integration test artifacts
         uses: actions/download-artifact@v4
@@ -204,6 +291,10 @@ jobs:
         working-directory: crates/trusted-server-integration-tests/browser
         run: node --test initial-render/pages.test.cjs
 
+      - name: Test trace fixture cleanup
+        working-directory: crates/trusted-server-integration-tests/browser
+        run: node --test trace-fixture.test.cjs
+
       - name: Test initial render ownership
         working-directory: crates/trusted-server-integration-tests/browser
         # Let the runner build its Rubicon + Shared ID artifact; the bidder-only
@@ -225,6 +316,8 @@ jobs:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
           VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
+          TRACE_VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/trace/configs/viceroy.toml
+          TRACE_AUTH_VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/trace-auth/configs/viceroy.toml
           TEST_FRAMEWORK: nextjs
           PLAYWRIGHT_HTML_REPORT: playwright-report-nextjs
         run: npx playwright test
@@ -244,6 +337,8 @@ jobs:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
           VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/configs/viceroy.toml
+          TRACE_VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/trace/configs/viceroy.toml
+          TRACE_AUTH_VICEROY_CONFIG_PATH: ${{ env.ARTIFACTS_DIR }}/trace-auth/configs/viceroy.toml
           TEST_FRAMEWORK: wordpress
           PLAYWRIGHT_HTML_REPORT: playwright-report-wordpress
         run: npx playwright test