mirror of
https://github.com/mozilla-actions/sccache-action
synced 2026-09-07 20:04:02 +00:00
Jarek Potiuk
772f27d055
Apache Infrastructure's verify-action-build tool (used to auto-review Dependabot bumps of this action) flagged a drift in v0.0.10: the committed dist/ matches only when rebuilt against the v0.0.9 lockfile, not the v0.0.10 lockfile shipped alongside it. In practice this means the release commit bumped package.json/package-lock.json version strings but the dist/ was built earlier with the previous toolchain. This is one of several ways to address that class of problem. The other path is to simply rebuild dist/ and recommit for the current release; that leaves the door open for it to happen again on the next release. Adding this CI job is the preventive fix: it runs 'npm ci && npm run build' on Node 24 (matching action.yml 'using: node24') and fails if the committed dist/ differs from the rebuilt output. A release with a stale dist/ will then be caught in CI rather than by downstream consumers. The existing build job keeps Node 18.x for format/lint/test; the new job pins 24.x so the rebuild matches what the action actually runs on.