merge: integrate remote learning module safely

.github/workflows/package-win-manual.yml

@@ -2,11 +2,6 @@ name: Package Windows (Manual)
 
 on:
   workflow_dispatch:
-    inputs:
-      ref:
-        description: 'Git ref to build (branch, tag, or SHA). Leave empty for current default ref.'
-        required: false
-        default: ''
 
 permissions:
   contents: read
@@ -16,10 +11,18 @@ jobs:
     runs-on: windows-latest
 
     steps:
+      - name: Require the default branch
+        shell: pwsh
+        run: |
+          $expectedRef = "refs/heads/${{ github.event.repository.default_branch }}"
+          if ("${{ github.ref }}" -ne $expectedRef) {
+            throw "Manual packaging may only run from the default branch ($expectedRef)."
+          }
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.ref || github.ref }}
+          ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 0
 
       - name: Setup Node.js
@@ -44,7 +47,13 @@ jobs:
             ${{ runner.os }}-pnpm-store-
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
+
+      - name: Download verified OpenMAIC player artifact
+        env:
+          LEARNING_PLAYER_ARTIFACT_URL: ${{ secrets.LEARNING_PLAYER_ARTIFACT_URL }}
+          LEARNING_PLAYER_ARTIFACT_SHA256: ${{ secrets.LEARNING_PLAYER_ARTIFACT_SHA256 }}
+        run: node scripts/download-learning-player-artifact.mjs
 
       - name: Download uv binaries for Windows
         run: pnpm run uv:download:win

.github/workflows/release.yml

@@ -58,7 +58,13 @@ jobs:
           cache: 'pnpm'
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
+
+      - name: Download verified OpenMAIC player artifact
+        env:
+          LEARNING_PLAYER_ARTIFACT_URL: ${{ secrets.LEARNING_PLAYER_ARTIFACT_URL }}
+          LEARNING_PLAYER_ARTIFACT_SHA256: ${{ secrets.LEARNING_PLAYER_ARTIFACT_SHA256 }}
+        run: node scripts/download-learning-player-artifact.mjs
 
       - name: Download uv binaries for macOS
         if: matrix.platform == 'mac'

.github/workflows/win-build-test.yml

@@ -32,7 +32,13 @@ jobs:
           cache: "pnpm"
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
+
+      - name: Download verified OpenMAIC player artifact
+        env:
+          LEARNING_PLAYER_ARTIFACT_URL: ${{ secrets.LEARNING_PLAYER_ARTIFACT_URL }}
+          LEARNING_PLAYER_ARTIFACT_SHA256: ${{ secrets.LEARNING_PLAYER_ARTIFACT_SHA256 }}
+        run: node scripts/download-learning-player-artifact.mjs
 
       - name: Download uv binaries for Windows
         run: pnpm run uv:download:win