feat(ci): fail hard if a publishable package lacks a build-linked prepublishOnly - #52
Draft
MaximusHaximus wants to merge 1 commit into
Draft
feat(ci): fail hard if a publishable package lacks a build-linked prepublishOnly#52MaximusHaximus wants to merge 1 commit into
MaximusHaximus wants to merge 1 commit into
Conversation
…publishOnly Add a fail-fast presence check to the shared `ci` composite action: for every package where `private !== true` and a `build` script exists, `prepublishOnly` must run `pnpm run build`. Runs before install; zero-dependency Node script in the action dir (no ncc bundle needed). This is deliberately a *presence* check, not a build-in-CI step. `prepublishOnly` is the only hook that runs on every publish path — CI `changeset publish`, a maintainer's local `pnpm publish`, `npm publish`. Building in CI would fix CI while leaving local publishes free to ship stale `dist/` (a new release that is silently a byte-for-byte copy of an old build), which is worse because nothing surfaces it. Requiring the hook protects every path; building in CI hides the gap. A missing hook shipped @polygonlabs/spol-api-client@1.0.0 to npm with no dist/ (empty, unimportable). This gate makes that class of failure impossible to merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a fail-fast presence check to the shared
cicomposite action: if any package whereprivate !== truedeclares abuildscript but itsprepublishOnlydoesn't runpnpm run build, CI fails before install.Why a presence check, not a CI build step
prepublishOnlyis the only hook that runs on every publish path — CIchangeset publish, a maintainer's localpnpm publish,npm publish. Building in CI before publish would make CI publishes correct while leaving local publishes free to ship whatever staledist/is on disk — a new point/major release that's silently a byte-for-byte copy of an old build, with no error anywhere. That's worse than an empty publish, because nothing surfaces it. So this gate requires the hook (protecting all paths) rather than doing the hook's job in CI (which only fixes CI and hides the gap).Concretely: a missing
prepublishOnlyshipped@polygonlabs/spol-api-client@1.0.0andspol-api-schemas@1.0.0to npm with nodist/— empty, unimportable packages. This makes that class of failure impossible to merge.Implementation
verify-prepublish-hooks.mjs— zero-dependency (Node built-ins only) script in the action dir, run via${{ github.action_path }}(nonccbundle needed). Recursively scanspackage.json, skippingnode_modules/dist/out-tsc/dotdirs.private !== trueand has abuildscript →prepublishOnlymust exist and runpnpm run build(flags absence,build:cleanmisuse, or aprepublishOnlythat doesn't build). Private packages and no-compile packages are correctly skipped.!changeset-release/*like the other steps.Verification
main(post-fix — every publishable package has the hook).{build, no prepublishOnly}package (exit 1); correctly skippedprivate: trueand no-buildpackages.Companion: the
assess-reposkill now flags the same gap for manual audits (apps-team-workspace#103); this is the automated, every-PR enforcement.