From b513675a8d8d3eb4c5155240eca288d743246f22 Mon Sep 17 00:00:00 2001 From: 1bcMax Date: Fri, 7 Aug 2026 16:32:17 -0500 Subject: [PATCH] ci: fail when committed dist is stale MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Consumers install this package from a commit tarball, which runs no build step — they execute the dist/ committed here. npm run check rebuilds dist but never asserts the result matches what is checked in, so a change that edits source without rebuilding stays green and silently ships a stale artifact to every pinned consumer. The check runs after npm run check so the rebuild has already happened; one matrix leg is enough because the build output does not vary by Node major. --- .github/workflows/ci.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 91ed945..2a38a1c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,3 +22,12 @@ jobs: cache: npm - run: npm ci - run: npm run check + # Consumers install this package straight from a commit tarball, which + # runs no build step — they execute the dist/ committed here. `npm run + # check` rebuilds it but never asserts the result matches what is + # checked in, so a change that edits source without rebuilding stays + # green and silently ships a stale artifact to every pinned consumer. + # One matrix leg is enough: the build output does not vary by Node major. + - name: Verify committed dist matches source + if: matrix.node == 20 + run: git diff --exit-code -- dist