fix(ci): align release checks with generated artifacts

.github/workflows/browser-smoke.yml

@@ -1,8 +1,6 @@
 name: Browser Smoke
 
 on:
-  push:
-  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -16,10 +14,22 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.1.2
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
+          cache: pnpm
+
+      - name: Install project
+        run: pnpm install --frozen-lockfile
+
+      - name: Build Chrome artifact
+        run: pnpm build:chrome
 
       - name: Install Playwright
         run: npm install --no-save --no-package-lock playwright@1.55.0
@@ -31,7 +41,10 @@ jobs:
         run: node --check tests/browser-smoke.cjs
 
       - name: Run extension smoke
-        run: xvfb-run --auto-servernum node tests/browser-smoke.cjs
+        env:
+          AI_PARALLEL_EXTENSION_ROOT: dist/chrome-mv3
+          AI_PARALLEL_BROWSER_HEADLESS: "true"
+        run: node tests/browser-smoke.cjs
 
       - name: Upload browser diagnostics
         if: ${{ failure() }}

.github/workflows/release-matrix.yml

@@ -79,7 +79,8 @@ jobs:
         run: |
           archive="$(find dist -maxdepth 1 -type f -name '*browser-extension-v*.zip' -print -quit)"
           test -n "$archive"
-          sha256sum -c "$archive.sha256"
+          archive_name="$(basename "$archive")"
+          (cd dist && sha256sum -c "$archive_name.sha256")
           unzip -t "$archive"
 
       - name: Upload ${{ matrix.browser }} artifact

tests/release-matrix.test.js

@@ -44,3 +44,13 @@ test("release workflow builds only credential-free artifacts for the browser mat
   assert.match(workflow, /actions\/upload-artifact@v4/);
   assert.doesNotMatch(workflow, /AI_PARALLEL_SMOKE_|password|storageState|credentials/i);
 });
+
+test("browser smoke is an explicit final check against the generated Chrome artifact", () => {
+  const workflow = read(".github", "workflows", "browser-smoke.yml");
+  assert.match(workflow, /workflow_dispatch:/);
+  assert.doesNotMatch(workflow, /^\s+(push|pull_request):/m);
+  assert.match(workflow, /pnpm install --frozen-lockfile/);
+  assert.match(workflow, /pnpm build:chrome/);
+  assert.match(workflow, /AI_PARALLEL_EXTENSION_ROOT: dist\/chrome-mv3/);
+  assert.match(workflow, /AI_PARALLEL_BROWSER_HEADLESS: "true"/);
+});