Prepare open-source self-hosted release

.github/workflows/ci.yml

@@ -99,5 +99,29 @@ jobs:
         working-directory: packages/wp
         run: vendor/bin/phpunit Tests
 
+  e2e-wordpress:
+    name: WordPress E2E
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.11
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.0"
+          tools: composer
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build and test the WordPress release ZIP
+        run: bun run e2e:wp
+
       - name: Lint PHP syntax
         run: find packages/wp -path packages/wp/vendor -prune -o -name '*.php' -print0 | xargs -0 -n1 php -l

.github/workflows/release.yml

@@ -34,8 +34,11 @@ jobs:
       - name: Install JavaScript dependencies
         run: bun install --frozen-lockfile
 
-      - name: Audit critical JavaScript dependencies
-        run: bun audit --audit-level=critical
+      - name: Audit JavaScript dependencies
+        # extract-zip has no patched release and is only reachable through the
+        # @wordpress/scripts Puppeteer browser downloader, which this workflow
+        # does not invoke or ship. SECURITY.md documents the temporary exception.
+        run: bun run audit:security
 
       - name: Install PHP development dependencies
         working-directory: packages/wp
@@ -62,6 +65,12 @@ jobs:
       - name: Build Figma plugin
         run: bun run build:figma
 
+      - name: Build WordPress plugin
+        run: bun run build:wp
+
+      - name: Verify open-source boundaries
+        run: bun run check:open-source
+
   package:
     name: Build Release Artifacts
     runs-on: ubuntu-latest
@@ -97,6 +106,9 @@ jobs:
       - name: Build Figma release
         run: bun run release:figma -- "${{ steps.version.outputs.version }}"
 
+      - name: Test WordPress release in a live site
+        run: bash scripts/test-wp-e2e.sh ".tmp/release/core-framework-${{ steps.version.outputs.version }}.zip"
+
       - name: Upload release artifacts
         uses: actions/upload-artifact@v4
         with:

README.md

@@ -207,6 +207,16 @@ bun run test:www
 bun run build:www
 ```
 
+The production site is written to `packages/www/dist`. It is a static application: serve that directory from any static web server or hosting provider. Projects remain in the user's browser storage; no application server, database, Core Framework account, or license service is required.
+
+For a domain root such as `https://framework.example.com/`, use the command above. For a subpath, pass the public base path to Vite:
+
+```sh
+bun run --filter './packages/www' build -- --base=/core-framework/
+```
+
+Then publish `packages/www/dist` at the matching path, such as `https://example.com/core-framework/`.
+
 ## WordPress development
 
 Requirements: WordPress 6.0 or newer, PHP 8.0 or newer, Composer, Bun 1.3.x, and a local HTTPS certificate.
@@ -232,6 +242,8 @@ Requirements: WordPress 6.0 or newer, PHP 8.0 or newer, Composer, Bun 1.3.x, and
 
 Build the production plugin with `bun run build:wp`. Tagged releases are assembled by the automated release workflow; pushes to `main` do not publish a plugin update. Maintainers can find the full process in [RELEASING.md](RELEASING.md).
 
+Run `bun run e2e:wp` to build the distributable ZIP and install it into a disposable Docker-based WordPress site. The test uses WP-CLI to verify installation, activation, database setup, generated CSS, REST authorization, the Figma connection-key lifecycle, local editor assets, and deactivation/reactivation. Docker and curl are required; the test environment is removed automatically.
+
 ## Install the Figma plugin
 
 Each [GitHub Release](https://github.com/corebunch/core-framework/releases) includes a self-contained `core-framework-figma-X.Y.Z.zip`:
@@ -286,7 +298,13 @@ The visual application lives in `packages/core`. The web, WordPress, and Figma p
 
 Editing a local project and generating CSS do not require a Core Framework account, license server, or API key. The bundled Figma editor works locally, while optional Figma-to-WordPress synchronization connects directly to a user-selected WordPress site using a site-generated connection credential (not a license key).
 
-Google Fonts are requested through Google's public, keyless CSS endpoints only when a user chooses to browse or use Google-hosted fonts.
+The Google Fonts catalog is bundled locally. Google is contacted only when a user selects, previews, or imports a Google-hosted font; the application requests CSS from `fonts.googleapis.com` and, during import, font files from `fonts.gstatic.com`. The WordPress integration stores imported font files locally. See Google's [Terms of Service](https://policies.google.com/terms) and [Privacy Policy](https://policies.google.com/privacy).
+
+The application does not load preview images, interface fonts, telemetry, or executable code from Core Framework servers.
+
+## Third-party licensing
+
+Core Framework's original source is MIT licensed. Dependencies and adapted source retain their respective open-source licenses. Release builds include `THIRD_PARTY_NOTICES.md` (or `third-party-notices.txt`) and a generated `THIRD_PARTY_LICENSES.txt` (or `third-party-licenses.txt`) containing the production dependency inventory and available license texts.
 
 ## Marketplace
 

RELEASING.md

@@ -37,6 +37,8 @@ git push origin v2.0.0
 
 The tag version must exactly match the WordPress plugin header, package metadata (including `packages/figma/package.json`), Core Framework version constant, and WordPress.org stable tag. The release builders reject mismatches.
 
+The release builders also reject retired hosted-service URLs, remote placeholder images, the removed remote interface font, and stale Figma version copy. They generate a production dependency license inventory for each artifact.
+
 The GitHub Release contains:
 
 - `core-framework-X.Y.Z.zip` for WordPress and WordPress.org deployment.

SECURITY.md

@@ -41,4 +41,10 @@ Out of scope:
 - reports against third-party builders, WordPress, Figma, Google Fonts, or hosting providers that do not involve Core Framework code
 - denial-of-service reports that only exhaust intentionally local resources without a realistic deployment impact
 
+## Dependency Audit Exception
+
+CI rejects new high- or critical-severity JavaScript dependency advisories. It temporarily allows `GHSA-jmr9-qjv8-65gv` in `extract-zip` because upstream has not published a patched release. The package is present only through the `@wordpress/scripts` Puppeteer browser-download tooling; Core Framework's release workflow does not invoke that path, and neither the WordPress nor Figma release archive contains the package.
+
+Remove the exception as soon as a compatible patched upstream release is available. Run `bun run audit:security` to reproduce the enforced audit locally.
+
 Maintainers will acknowledge valid private reports, assess their impact, and coordinate a fix and disclosure when appropriate.

THIRD_PARTY_NOTICES.md

@@ -3,6 +3,8 @@
 Core Framework includes adapted sun and moon icons from Heroicons.
 It also includes an adapted PostCSS 8 implementation of postcss-easing-gradients.
 
+Release archives also contain a generated `THIRD_PARTY_LICENSES.txt` or `third-party-licenses.txt` with the production JavaScript and Composer dependency inventory and available license texts.
+
 ## Heroicons
 
 Source: https://github.com/tailwindlabs/heroicons