[codex] docs and ci: protect main and fix GitHub Actions

.github/workflows/ci.yml

@@ -15,12 +15,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - run: corepack enable
+
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-          cache: "npm"
+          cache: "pnpm"
 
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
       - run: npm run verify:golden
 
   test:
@@ -43,15 +45,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - run: corepack enable
+
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
-          cache: "npm"
+          cache: "pnpm"
 
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
       - run: npm run check:ci
       - run: npm run demo:killer:ci
       - run: npm run build
+      - name: Detect hosted-only scripts
+        id: hosted-scripts
+        run: |
+          node - <<'NODE'
+          const scripts = require('./package.json').scripts ?? {};
+          const enabled = Boolean(scripts['db:migrate'] && scripts['service:api'] && scripts['test:rls']);
+          const fs = require('node:fs');
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `enabled=${enabled}\n`);
+          NODE
       - name: CLI autopilot flow (mock hosted)
         env:
           BIOFLOW_AUTOPILOT_FLOW_OUT: .bioflow_smoke_service/cli-autopilot-run-flow-summary.json
@@ -66,6 +79,7 @@ jobs:
           path: .bioflow_smoke_service/cli-autopilot-run-flow-summary.json
           if-no-files-found: warn
       - name: Self-serve smoke (signup -> run -> verify -> share)
+        if: ${{ steps.hosted-scripts.outputs.enabled == 'true' }}
         env:
           BIOFLOW_DATABASE_URL: postgres://postgres:postgres@localhost:5432/postgres
           BIOFLOW_SERVICE_DATA_DIR: .bioflow_smoke_service
@@ -103,4 +117,6 @@ jobs:
           name: self-serve-autopilot-summary
           path: .bioflow_smoke_service/self-serve-autopilot.json
           if-no-files-found: warn
-      - run: BIOFLOW_DATABASE_URL=postgres://postgres:postgres@localhost:5432/postgres npm run test:rls
+      - name: RLS integration
+        if: ${{ steps.hosted-scripts.outputs.enabled == 'true' }}
+        run: BIOFLOW_DATABASE_URL=postgres://postgres:postgres@localhost:5432/postgres npm run test:rls

.github/workflows/cla.yml

@@ -12,7 +12,8 @@ on:
       - edited
 
 jobs:
-  cla:
+  CLA:
+    name: CLA
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read

.github/workflows/release-cli.yml

@@ -15,11 +15,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - run: corepack enable
+
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Validate tag matches package version
         run: |
@@ -30,7 +32,7 @@ jobs:
             exit 1
           fi
 
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
       - run: npm run build
       - run: npm publish --access public --provenance
         env:

CONTRIBUTING.md

@@ -14,6 +14,7 @@ BioFlow core is Apache 2.0. We accept pull requests, but external contributions
 - First-time external contributors should contact `founders@bioflow.io` before merge.
 - Maintainers confirm CLA status and keep that record outside the codebase.
 - The required GitHub status check is `CLA`; external pull requests need the `cla-approved` label before it passes.
+- The `main` branch is protected on GitHub, so the `CLA` check must pass before merge.
 - The CLA is about inbound licensing and future relicensing flexibility. It does not change the Apache 2.0 license on this repository.
 
 ## Review Focus

docs/CLA.md

@@ -16,7 +16,7 @@ This document describes the workflow. It is not the legal agreement itself.
 - The repository runs `.github/workflows/cla.yml` on pull requests.
 - External pull requests pass only after a maintainer applies the `cla-approved` label.
 - Repository members, owners, and collaborators pass automatically.
-- Branch protection should require the `CLA` status check before merge.
+- Branch protection on `main` requires the `CLA` status check before merge.
 
 ## Policy
 

package.json

@@ -4,6 +4,7 @@
   "private": false,
   "license": "Apache-2.0",
   "type": "module",
+  "packageManager": "pnpm@10.33.0",
   "bin": {
     "bioflow": "dist/cli/main.js",
     "bioflow-mcp": "dist/mcp/main.js"