[mpge]

TL;DR: Fix invalid core-reference expressions in CI, validate workflows before building, and publish the exact release ZIP that passed the database tests and installer checks.

The CI matrix no longer defines core_ref, but two checkout steps still referenced it. Both now use the selected Inventoros ref directly. A checksum-pinned actionlint job catches workflow and shell errors before UI builds; this also corrects two unquoted GitHub output paths. Jobs use Ubuntu 24.04 with explicit timeouts, read-only permissions and seven-day CI artifact retention.

Release tags call the same CI workflow, including the three-database test matrix and real ZIP lifecycle verification. Publishing downloads that verified artifact and checks its SHA-256 instead of rebuilding a second archive. Only the publishing job has write permission. Tag/changelog validation, exact version-specific release notes and existing-tag verification precede publishing.

Validation:

• Linux actionlint 1.7.12 and ShellCheck pass for both workflows. The pinned Linux archive checksum was independently verified.
• Clean UI dependency installation and runtime bundle build pass; npm reports no dependency vulnerabilities.
• Plugin suite against current Inventoros main: 162 tests, 865 assertions, with 8 expected skips for the imported-payment core API that is not merged yet (154 passing tests).
• Core plugin-system suite with Shopify present: 321 tests, 2,645 assertions pass.
• Fresh ZIP: install, activate, deactivate, reactivate and delete all pass; no plugin folder, record, migrations or tables remain.
• Exact release shell steps pass checks for matching/mismatched tags, missing changelog entries, intact/altered ZIPs and release-note/publish arguments. Publishing was stubbed; no release or tag was created.

The repository is now public. Hosted CI on main passes every job: workflow validation, UI bundle, SQLite/PostgreSQL/MySQL tests and ZIP installation verification.