Jarek Potiuk 772f27d055 ci: verify committed dist/ matches a clean rebuild ...

Apache Infrastructure's verify-action-build tool (used to auto-review
Dependabot bumps of this action) flagged a drift in v0.0.10: the
committed dist/ matches only when rebuilt against the v0.0.9 lockfile,
not the v0.0.10 lockfile shipped alongside it. In practice this means
the release commit bumped package.json/package-lock.json version strings
but the dist/ was built earlier with the previous toolchain.

This is one of several ways to address that class of problem. The other
path is to simply rebuild dist/ and recommit for the current release;
that leaves the door open for it to happen again on the next release.

Adding this CI job is the preventive fix: it runs 'npm ci && npm run
build' on Node 24 (matching action.yml 'using: node24') and fails if
the committed dist/ differs from the rebuilt output. A release with a
stale dist/ will then be caught in CI rather than by downstream
consumers.

The existing build job keeps Node 18.x for format/lint/test; the new
job pins 24.x so the rebuild matches what the action actually runs on.

2026-07-29 12:54:27 +02:00

..

CI.yml

ci: verify committed dist/ matches a clean rebuild

2026-07-29 12:54:27 +02:00