Setup support and ci/cd handling updating and integrating verified production released widgets

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# Security and automation boundaries require GoodDollar maintainer review.
+/.github/workflows/ @GoodDollar/goodbuilders-maintainers
+/.github/agents/ @GoodDollar/goodbuilders-maintainers
+/scripts/widget-release/ @GoodDollar/goodbuilders-maintainers
+/src/widgets/ @GoodDollar/goodbuilders-maintainers
+/src/login/ @GoodDollar/goodbuilders-maintainers
+/config.ts @GoodDollar/goodbuilders-maintainers
+/configServerless.ts @GoodDollar/goodbuilders-maintainers
+/next.config.mjs @GoodDollar/goodbuilders-maintainers

.github/agents/widget-integrator.agent.md

@@ -0,0 +1,44 @@
+---
+name: widget-integrator
+description: Integrates a verified stable GoodWidget release into GoodWallet as a human-reviewed draft PR.
+tools: ["read", "edit", "search", "shell"]
+---
+
+Integrate only the package and version in the validated task prompt.
+
+The widget package executes on the GoodWallet origin, so the generated pull
+request is an implementation proposal—not an authorization or merge decision.
+
+The release descriptor supplies only immutable widget identity and supported
+package entry points. It does not authorize provider methods, choose Wallet
+presentation, or describe widget-specific UI states.
+
+For a new widget, add the exact dependency, lockfile entry, reviewed
+Wallet-owned registry metadata, static loaders for both declared entries,
+authenticated route, existing restricted EIP-1193 provider boundary,
+translations, and host-level tests. Omit `integrationMode` to use the
+Web Component default unless a maintainer explicitly requests React.
+
+For an existing widget, update the exact dependency, lockfile, and registry
+`packageVersion`. Preserve its reviewed integration mode, route, icon,
+presentation, and `providerPolicy`; change host integration/tests only when the
+release requires it. Select an existing GoodWallet icon or add one local SVG
+and identify the choice as a human-review item.
+
+Do not copy widget loading, success, error, selector, fixture, callback, or
+event contracts into GoodWallet. Those behaviors remain inside the package.
+
+You must not:
+
+- modify authentication/session internals;
+- modify deployment configuration or any file under `.github/workflows`;
+- modify `src/widgets/provider/policy.ts` or broaden provider permissions;
+- treat descriptor fields or package behavior as permission to broaden a
+  widget's Wallet-owned `providerPolicy`;
+- expose a signer, private key, master seed, or unrestricted RPC provider;
+- use a dependency range, approve a PR, or merge.
+
+Run dependency validation, build, unit tests, and relevant Playwright tests.
+Record deterministic desktop/mobile evidence. Open a draft pull request, label
+it `automated-widget-integration`, include the package/version idempotency key
+in its title/body, and request CODEOWNERS review.

.github/workflows/goodwallet-pr.yml

@@ -19,20 +19,24 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
 
       - name: Run install
-        uses: borales/actions-yarn@v5
+        uses: borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5
         with:
-          cmd: install
+          cmd: install --immutable
+
+      - name: Validate exact GoodWidget dependencies
+        # Widgets execute in-process, so PRs must pin the bytes reviewers audit.
+        run: yarn widget-deps:check
 
       - name: Run Biome Check
-        uses: borales/actions-yarn@v5
+        uses: borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5
         with:
           cmd: biome:verify:all
 
@@ -42,23 +46,34 @@ jobs:
         run: yarn build
 
       - name: Run Tests
-        uses: borales/actions-yarn@v5
+        uses: borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5
         with:
           cmd: test
 
       - name: Install Playwright Chromium
         run: yarn playwright install --with-deps chromium
 
       - name: Run Playwright screenshots
-        uses: borales/actions-yarn@v5
+        uses: borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5
         with:
           cmd: test:e2e
+
       - name: Upload Playwright screenshots and failure artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-artifacts
           path: |
             tests-playwright/screenshots/
             tests-playwright/artifacts/
           if-no-files-found: warn
+  dependency-review:
+    name: Dependency review
+    # Surface transitive dependency changes separately from application tests.
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/goodwidget-released.yml

@@ -0,0 +1,86 @@
+name: Intake GoodWidget release
+
+on:
+  repository_dispatch:
+    types: [goodwidget-released]
+  workflow_dispatch:
+    inputs:
+      payload:
+        description: Validated GoodWidget release envelope JSON
+        required: true
+        type: string
+      action:
+        description: Replay action
+        required: true
+        type: choice
+        default: validate
+        options:
+          - validate
+          - issue
+          - agent-task
+      confirm_agent_task:
+        description: I confirm this may create a Copilot task and draft PR
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+# Serialize the validation/task handoff so two deliveries cannot race past the
+# idempotency search before its durable tracking issue exists.
+concurrency:
+  group: goodwidget-integration
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate sender, descriptor, and npm release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: yarn
+      - run: corepack enable && yarn install --immutable
+      - name: Validate exact GoodWidget dependencies
+        run: yarn widget-deps:check
+      - name: Validate release envelope and npm integrity
+        env:
+          GOODWIDGET_DISPATCH_ACTOR: ${{ vars.GOODWIDGET_DISPATCH_ACTOR }}
+        run: yarn node scripts/widget-release/process-event.mjs validate
+
+  integrate:
+    name: Create reviewed integration task
+    needs: validate
+    # Repository dispatch is inert until maintainers explicitly enable the
+    # feature flag; manual agent-task replay also requires confirmation.
+    if: >-
+      (github.event_name == 'repository_dispatch' &&
+       vars.ENABLE_GOODWIDGET_AGENT_TASKS == 'true') ||
+      (github.event_name == 'workflow_dispatch' &&
+       (inputs.action == 'issue' ||
+        (inputs.action == 'agent-task' && inputs.confirm_agent_task)))
+    runs-on: ubuntu-latest
+    # This protected environment gates the PAT used by the preview Agent Tasks
+    # API and keeps it out of pull-request workflows.
+    environment: widget-integration
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: yarn
+      - run: corepack enable && yarn install --immutable
+      - name: Process release
+        env:
+          ACTION_MODE: ${{ github.event_name == 'repository_dispatch' && 'agent-task' || inputs.action }}
+          GOODWIDGET_DISPATCH_ACTOR: ${{ vars.GOODWIDGET_DISPATCH_ACTOR }}
+          GITHUB_TOKEN: ${{ github.token }}
+          COPILOT_AGENT_TASK_PAT: ${{ secrets.COPILOT_AGENT_TASK_PAT }}
+        run: yarn node scripts/widget-release/process-event.mjs "$ACTION_MODE"