Skip to content

Commit 772f27d

Browse files
potiuksylvestre
potiuk
authored and
sylvestre
committed
ci: verify committed dist/ matches a clean rebuild
Apache Infrastructure's verify-action-build tool (used to auto-review Dependabot bumps of this action) flagged a drift in v0.0.10: the committed dist/ matches only when rebuilt against the v0.0.9 lockfile, not the v0.0.10 lockfile shipped alongside it. In practice this means the release commit bumped package.json/package-lock.json version strings but the dist/ was built earlier with the previous toolchain. This is one of several ways to address that class of problem. The other path is to simply rebuild dist/ and recommit for the current release; that leaves the door open for it to happen again on the next release. Adding this CI job is the preventive fix: it runs 'npm ci && npm run build' on Node 24 (matching action.yml 'using: node24') and fails if the committed dist/ differs from the rebuilt output. A release with a stale dist/ will then be caught in CI rather than by downstream consumers. The existing build job keeps Node 18.x for format/lint/test; the new job pins 24.x so the rebuild matches what the action actually runs on.
1 parent d270be5 commit 772f27d

1 file changed

Lines changed: 24 additions & 0 deletions

File tree

‎.github/workflows/CI.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,30 @@ jobs:
3737
- name: Build & Test
3838
run: npm run test
3939

40+
verify-dist:
41+
name: Verify dist/ is up to date
42+
runs-on: ubuntu-latest
43+
steps:
44+
- name: Checkout
45+
uses: actions/checkout@v6
46+
- name: Setup Node.js
47+
uses: actions/setup-node@v6
48+
with:
49+
node-version: 24.x
50+
cache: npm
51+
52+
- name: npm ci
53+
run: npm ci
54+
- name: Rebuild dist/
55+
run: npm run build
56+
- name: Check dist/ matches committed output
57+
run: |
58+
if ! git diff --exit-code -- dist/; then
59+
echo "::error::Committed dist/ does not match a clean rebuild from source."
60+
echo "::error::Run 'npm ci && npm run build' locally and commit the updated dist/ before releasing."
61+
exit 1
62+
fi
63+
4064
test:
4165
name: Test version
4266
runs-on: ${{ matrix.os }}

0 commit comments

Comments
 (0)