[afonsojramos]

Summary

Adds build-module, a reusable workflow that builds, packs and attests a Spicetify module from the commit that called it. The attestation names this workflow as its signer, so the registry can verify a submitted zip was produced by these steps, on a GitHub-hosted runner, from one commit of the author's repository. An AI reviewer can then read the source at that commit instead of the bundled output.

• Build job (read-only token, no id-token): installs from the committed lockfile (npm, pnpm, or bun) with install scripts and pnpm's .pnpmfile.cjs hooks skipped, runs spicetify-kit build from the npm registry at the version the lockfile resolved (from an empty directory, so a project .npmrc cannot swap the kit or set script-shell), and packs the zip.
• Attest job: never checks out the project. Downloads the zip, re-checks its checksum, attests it, and optionally uploads it to the release without --clobber.
• publish gains a zip input so the attested bytes are submitted byte for byte instead of being re-packed.
• test-build-module runs the workflow on a fixture module and verifies the result with gh attestation verify --signer-workflow spicetify/actions/.github/workflows/build-module.yml --deny-self-hosted-runners, checking the subject digest and source commit.

The registry side is spicetify/modules#58: validate-submission.ts verifies these attestations, and Pullfrog reviews the source at the attested commit.

Validation

• actionlint passes on every workflow; zizmor reports nothing above low on the new files.
• The publish pack script was run locally against a real fixture build: with zip the checksum is preserved, dist still packs, and neither input fails with an error.
• The build commands were run locally against the fixture (kit from the registry in an empty directory).
• Not yet run on GitHub: this PR's test-build-module run is the first real build, attestation, and verification.

Release

Authors reference @v1, so the workflow becomes usable after a v1.x.y tag moves v1. The kit's project template should only point at it after that release.