Theme Proof 1.0.0

Theme Proof 1.0.0

Theme Proof creates automatic pull request previews for Shopify Liquid themes. It builds PR code without store credentials, deploys only validated theme files as a Shopify development preview, maintains one GitHub comment with storefront and Theme Editor links, and removes the preview when the PR closes.

Setup

Use the reusable workflow rather than a single build-and-deploy job:

BillyNoyes/Proof/.github/workflows/preview.yml@v1.0.0

Create a GitHub environment named theme-preview with:

• Secret SHOPIFY_CLI_THEME_TOKEN: a dedicated Theme Access password.
• Variable SHOPIFY_FLAG_STORE: the full myshopify.com store domain.

No project config is required for a complete no-build theme at the repository root. Optional setup, install, build, nested working-directory, and output-directory settings are available through theme-proof.config.json.

Read the setup guide and README.

Stable v1 scope

• Separate read-only build and credentialed deployment/cleanup jobs.
• Same-repository pull requests only; forks are skipped.
• Per-PR Shopify development contexts only; live and existing themes are never valid targets.
• Strict Theme Check and Shopify upload-result validation.
• Theme-only artifact allowlist with path, symlink, type, file-count, and size checks.
• Current PR state/SHA checks and serialized remote mutations.
• Safe cleanup with remote role/context verification, repeated-cleanup support, stale-run protection, and recovery for preview uploads whose comment state was not recorded.
• SHA-pinned internal and third-party Actions, Node.js 24, and Shopify CLI 4.8.0.

Validation

The exact release commit passed:

• 73 Action/core tests and 24 site interaction/animation tests.
• Linux, macOS, and Windows CI on Node.js 22.12/24.
• Workflow linting and a real build-Action smoke test.
• Reproducible self-contained Action bundles and dependency license notices.
• Root and project-path site builds plus light/dark, desktop/mobile, reduced-motion, keyboard, no-JavaScript, and link checks.
• Public npm registry audit with no known vulnerabilities at release time.

Private development-store testing covered creation, updates, context reuse, comments, manual deletion/recreation, repeated cleanup, close/reopen and stale-run behavior, cancellation, invalid credentials, and actual partial-upload errors. All test themes were removed and the original theme inventory was unchanged. See the sanitized integration report.

Operational limits

• GitHub.com and the documented GitHub-hosted Ubuntu deployment workflow are supported.
• Existing-theme and unpublished-theme target modes are not implemented.
• Protected storefronts still require their storefront password; Theme Editor links require an authorized Shopify admin session.
• Natural seven-day development-theme expiration and authenticated UI interactions were not exercised.
• A failed or manually canceled cleanup may need to be rerun; scheduled stale-preview reconciliation is not implemented.

Proof is independently developed and has no Shopify sponsorship or endorsement.

Theme Proof v0.1.0-alpha.0

Theme Proof v0.1.0-alpha.0

Pull request previews for Shopify Liquid themes using GitHub Actions and Shopify Theme Access.

This is an experimental pre-release, not a stable v1. The supported deployment workflow runs on GitHub-hosted Ubuntu with Node.js 24 and Shopify CLI 4.8.0.

Features

• Optional setup, install, and build commands, including nested projects and output directories.
• No-build themes such as Dawn.
• Separate read-only build and privileged deployment/cleanup jobs.
• Per-PR development contexts, storefront/Theme Editor links, and one updated bot comment.
• Artifact validation, guarded cleanup, current-PR checks, and serialized mutations.
• SHA-pinned internal Actions and committed runtime bundles/license notices.

Only development-context targeting is supported. Existing-theme and unpublished-theme modes are not implemented.

Validation

Private development-store testing passed creation, updates, context reuse, named-secret access, no-build and nested-build deployments, artifact transfer, comment updates, deletion/recreation, repeated cleanup, close-during-build behavior, reopened-PR protection, stale-deployment retries, and controlled build cancellation.

The original theme inventory was unchanged after cleanup, and all test-created themes were removed. Store details, credentials, theme IDs, preview URLs, private run links, and raw logs are excluded from this release.

See INTEGRATION.md for the sanitized results and REVIEW.md for repository-review findings and fixes.

Automated validation includes 72 Action/core tests, 15 site interaction tests, browser checks, workflow linting, cross-platform checks, actual build-Action execution, and reproducible bundles. The public npm registry audit reported no known vulnerabilities at validation time.

Setup

Create a GitHub environment named theme-preview with secret SHOPIFY_CLI_THEME_TOKEN and variable SHOPIFY_FLAG_STORE. Keep the password environment-scoped. Use the caller workflow from the README, including its explicit named-secret mapping rather than broad secret inheritance.

SHA-pinned reusable workflow reference:

BillyNoyes/Proof/.github/workflows/preview.yml@af5b6ceb193b4ef55b3c6a77c9ec23d54638f3b8

Internal build/deploy/cleanup Actions use reviewed bundle commit d842aabe99a40352073065ea538a360c533f3f71. The privately tested workflow revision was c0d00a4268dc4690762c5e326d0c9b20dce5a927; the release target adds documentation-only changes.

Limits

• Protected storefronts require their storefront password; Theme Editor access requires an authorized admin login. Routing to those gates was checked, but authenticated UI content/interactions were not exercised.
• Manual deletion and already-missing themes were tested; natural seven-day expiration was not observed.
• Fork and pull_request_target rejection was tested through the actual bundled Action with synthetic events, not a cross-account fork.
• Failed or manually canceled runs can require cleanup to be rerun. Scheduled reconciliation is not implemented.
• GitHub Enterprise Server is not supported.