Files
add-and-commit/.github/workflows/test.yml
c38a33b50a fix: verify committed lib/ matches source in CI (#756)
* fix: verify committed lib/ matches source in CI

Add a post-build diff check so the shipped action bundle cannot drift from src without failing CI, even when local hooks are bypassed.

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: rebuild lib/ against lockfile for CI integrity check

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci: tighten lib integrity check and workflow permissions

Detect untracked lib/ artifacts, drop checkout credentials, and document Node 24 for local builds.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-08 20:44:15 +00:00

68 lines
1.6 KiB
YAML

name: Test
on:
push:
pull_request:
workflow_dispatch:
permissions:
contents: read
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: actions/setup-node@v7
with:
node-version: 24
cache: npm
- run: npm ci
- run: npm run build
- name: Verify lib/ matches source
id: verify-lib
run: |
if [ "$(git diff --ignore-space-at-eol --text -- lib/ | wc -l)" -gt "0" ] \
|| [ -n "$(git ls-files --others --exclude-standard -- lib/)" ]; then
echo "Committed lib/ is out of sync with src/. Run npm ci && npm run build and commit lib/."
git diff --ignore-space-at-eol --text -- lib/
git ls-files --others --exclude-standard -- lib/
exit 1
fi
- if: ${{ failure() && steps.verify-lib.outcome == 'failure' }}
name: Upload expected lib/
uses: actions/upload-artifact@v7
with:
name: lib
path: lib/
test:
name: Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: actions/setup-node@v7
with:
node-version: 24
cache: npm
- run: npm ci
- run: npm run test
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: actions/setup-node@v7
with:
node-version: 24
cache: npm
- run: npm ci
- run: npm run lint