release: website e27f3c3 to production

.github/workflows/ci.yml

@@ -20,6 +20,9 @@ on:
         branches: [main, dev, 'fix/**', 'feat/**']
         types: [opened, synchronize, reopened, ready_for_review]
 
+permissions:
+    contents: read
+
 jobs:
     ci:
         if: github.event.pull_request.draft != true
@@ -43,7 +46,11 @@ jobs:
                     --health-retries=10
 
         steps:
+            # Full history: the client provenance check reads the subject of the
+            # last commit that touched the vendored tarball.
             - uses: actions/checkout@v6
+              with:
+                  fetch-depth: 0
 
             - uses: pnpm/action-setup@v4
 
@@ -55,6 +62,14 @@ jobs:
             - name: Install
               run: pnpm install --frozen-lockfile
 
+            # vendor/developmentfinance-client.provenance.json names the sdk
+            # commit and the spec-kit revision the vendored client was built
+            # from; the commit that vendored the tarball must name the same sdk
+            # commit in its subject. See "API client package" in
+            # docs/development.md.
+            - name: Check client provenance
+              run: pnpm check:client-provenance
+
             - name: Lint
               run: pnpm lint
 

.github/workflows/deploy.yml

@@ -16,6 +16,9 @@ concurrency:
   group: deploy-${{ github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-latest

db/migrations/0024_drop_share_card_result.sql

@@ -0,0 +1 @@
+DROP TABLE "share_card_result" CASCADE;