fix(release): harden installers and workflow per review

- install.ps1: fail closed if the .sha256 cannot be fetched; pure ASCII (no BOM)
- npm install.js: fail (exit 1 / throw) when the platform payload or a binary is
  missing instead of reporting a successful but broken install
- workflow: top-level permissions {} + persist-credentials: false on read-only
  checkouts
- docs: PowerShell-only Windows note; text language tag on npm/README fenced block

Author: kevincodex1

.github/workflows/release.yml

@@ -9,6 +9,9 @@ concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
 
+# Least privilege by default; every job opts in to exactly what it needs.
+permissions: {}
+
 jobs:
   release-please:
     if: ${{ github.repository == 'Gitlawb/node' }}
@@ -41,6 +44,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}
+          persist-credentials: false
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
@@ -122,6 +126,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}
+          persist-credentials: false
 
       - name: Set up Rust toolchain
         uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
@@ -250,6 +255,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}
+          persist-credentials: false
 
       - name: Lay in release binaries
         env:
@@ -448,6 +454,7 @@ jobs:
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}
           path: node
+          persist-credentials: false
 
       - name: Checkout web
         if: ${{ steps.guard.outputs.enabled == 'true' }}

install.ps1

@@ -1,6 +1,6 @@
 <#
 .SYNOPSIS
-  gitlawb installer for Windows — downloads pre-built binaries from GitHub Releases.
+  gitlawb installer for Windows - downloads pre-built binaries from GitHub Releases.
 .EXAMPLE
   irm https://gitlawb.com/install.ps1 | iex
 .EXAMPLE
@@ -47,19 +47,16 @@ try {
   Write-Host "Downloading..."
   Invoke-WebRequest -Uri $url -OutFile $zipPath -Headers @{ "User-Agent" = "gitlawb-installer" }
 
-  # Verify checksum if available.
-  try {
-    $sumPath = "$zipPath.sha256"
-    Invoke-WebRequest -Uri "$url.sha256" -OutFile $sumPath -Headers @{ "User-Agent" = "gitlawb-installer" }
-    $expected = ((Get-Content $sumPath -Raw).Trim() -split '\s+')[0].ToLower()
-    $actual = (Get-FileHash $zipPath -Algorithm SHA256).Hash.ToLower()
-    if ($expected -ne $actual) {
-      throw "checksum mismatch! expected $expected got $actual"
-    }
-    Write-Host "  checksum OK"
-  } catch [System.Net.WebException] {
-    Write-Host "  (no checksum published, skipping verification)"
+  # Verify checksum. Every published asset has a matching .sha256, so fail closed
+  # if it cannot be fetched rather than installing an unverified binary.
+  $sumPath = "$zipPath.sha256"
+  Invoke-WebRequest -Uri "$url.sha256" -OutFile $sumPath -Headers @{ "User-Agent" = "gitlawb-installer" }
+  $expected = ((Get-Content $sumPath -Raw).Trim() -split '\s+')[0].ToLower()
+  $actual = (Get-FileHash $zipPath -Algorithm SHA256).Hash.ToLower()
+  if ($expected -ne $actual) {
+    throw "checksum mismatch! expected $expected got $actual"
   }
+  Write-Host "  checksum OK"
 
   Write-Host "Extracting..."
   $extract = Join-Path $tmp "extract"

npm/README.md

@@ -9,7 +9,7 @@ packages as `optionalDependencies`, each gated by `os`/`cpu`. npm installs only
 the one matching the host, and the wrapper's `postinstall` (`install.js`) copies
 the binary out of it into `bin/`. No binaries are downloaded at install time.
 
-```
+```text
 packages/
   gl/                  @gitlawb/gl            wrapper (postinstall, bin shims)
   gl-darwin-arm64/     @gitlawb/gl-darwin-arm64   aarch64-apple-darwin

npm/packages/gl/README.md

@@ -54,7 +54,7 @@ git push gitlawb main
 | Linux | arm64 | `@gitlawb/gl-linux-arm64` |
 | Linux | x64 | `@gitlawb/gl-linux-x64` |
 
-Windows is supported via the curl/PowerShell installer or WSL.
+Windows is supported via the PowerShell installer or WSL.
 
 ## Links
 

npm/packages/gl/install.js

@@ -53,14 +53,14 @@ function install() {
   const packageDir = findPlatformPackage(packageName);
 
   if (!packageDir) {
-    // Platform package not installed — this can happen if optional deps are skipped.
-    // Fall back to curl install suggestion.
-    console.warn(
+    // On a supported platform the matching optional dependency must be present;
+    // fail loudly rather than leave @gitlawb/gl installed without its binaries.
+    console.error(
       `@gitlawb/gl: Platform package ${packageName} not found.\n` +
         `This can happen if optional dependencies were skipped.\n` +
         `Install manually: curl -sSf https://gitlawb.com/install.sh | sh`
     );
-    process.exit(0);
+    process.exit(1);
   }
 
   const binDir = join(__dirname, "bin");
@@ -71,8 +71,7 @@ function install() {
     const dest = join(binDir, binary);
 
     if (!existsSync(src)) {
-      console.warn(`@gitlawb/gl: Binary ${binary} not found in ${packageName}, skipping`);
-      continue;
+      throw new Error(`Binary ${binary} not found in ${packageName}`);
     }
 
     copyFileSync(src, dest);