fingerprint-ci-gate

# Fail the build, not the ban rate A fingerprint regression is invisible until something starts rejecting the traffic weeks later. `liarjs` turns it into a diff in a pull request: scan, save the JSON, compare the next run against the saved baseline. Node 22 or newer, a Chromium in the image, zero runtime dependencies. Runner note: give the container enough shared memory (`--shm-size=1g` on Docker, or a `/dev/shm` mount) and the capabilities Chrome's own sandbox needs. Leave the browser sandbox enabled; a scan that will not start is an image problem to fix in the image. ## The two mechanisms **Absolute floor.** Exits 1 when the score is below the number given, so the job fails: ```bash npx liarjs@0.3 --headless --min-score 60 ``` **Baseline diff.** Prints only the checks whose status moved between two saved scans: ```bash npx liarjs@0.3 --json scan.json # write the current result npx liarjs@0.3 diff baseline.json scan.json # what changed since the known-good run ``` Prefer the diff in any environment where some checks can never pass. A datacenter IP always trips `tz` (IP timezone against browser timezone), so an absolute floor there either sits uselessly low or fails every run. The diff only speaks up when something actually moved. Exit codes: 0 clean, 1 below `--min-score`, 2 an error such as no browser found. ## GitHub Actions ```yaml - uses: actions/setup-node@v4 with: node-version: 22 - name: Fingerprint scan run: npx liarjs@0.3 --hea...