ci(release): keep test helpers out of package dist

Keep runtime dist in the published package while moving release helper CLIs outside the TypeScript build and rejecting test-only artifacts before publication.

Author: AlbinoGeek

.github/workflows/release.yml

@@ -38,8 +38,10 @@ jobs:
       - name: Lint and format check
         run: bun run check
 
-      - name: Unit tests
-        run: bun run test
+      - name: Unit tests with coverage
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bun run test:coverage
 
       - name: Release sanity checks
         run: bun run release:check

biome.json

@@ -23,6 +23,6 @@
     }
   },
   "files": {
-    "includes": ["src/**/*", "*.json", "*.md", "!.mcp.json"]
+    "includes": ["src/**/*", "scripts/**/*", "*.json", "*.md", "!.mcp.json"]
   }
 }

package.json

@@ -31,9 +31,9 @@
     "check": "biome check .",
     "check:fix": "biome check --write .",
     "test": "bun test src/",
-    "test:coverage": "bun src/coverage-threshold.ts",
-    "release:check": "bun src/release-sanity.ts",
-    "prepublishOnly": "bun run release:check && bun run build && bun run check && bun run test",
+    "test:coverage": "bun scripts/coverage-threshold.ts",
+    "release:check": "bun scripts/release-sanity.ts",
+    "prepublishOnly": "bun run release:check && bun run build && bun run check && bun run test:coverage",
     "setup-hooks": "git config core.hooksPath .githooks"
   },
   "keywords": [

src/coverage-threshold.ts scripts/coverage-threshold.tssrc/coverage-threshold.ts renamed to scripts/coverage-threshold.ts

@@ -1,4 +1,5 @@
-import { readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 
 interface PackageJson {
   version?: unknown;
@@ -9,6 +10,7 @@ interface ReleaseSanityInput {
   packageJson: PackageJson;
   changelog: string;
   githubRef?: string;
+  distFiles?: string[];
 }
 
 export function checkReleaseSanity(input: ReleaseSanityInput): string[] {
@@ -39,9 +41,24 @@ export function checkReleaseSanity(input: ReleaseSanityInput): string[] {
     }
   }
 
+  for (const file of input.distFiles ?? []) {
+    if (isForbiddenDistArtifact(file)) {
+      errors.push(`dist must not include test-only artifact ${file}.`);
+    }
+  }
+
   return errors;
 }
 
+function isForbiddenDistArtifact(file: string): boolean {
+  return (
+    file.endsWith(".test.js") ||
+    file === "server/test-harness.js" ||
+    file === "coverage-threshold.js" ||
+    file === "release-sanity.js"
+  );
+}
+
 function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -55,6 +72,7 @@ function runReleaseSanityCli(): void {
     packageJson: readPackageJson(),
     changelog: readFileSync("CHANGELOG.md", "utf8"),
     githubRef: process.env.GITHUB_REF,
+    distFiles: listDistFiles(),
   });
 
   if (errors.length > 0) {
@@ -67,6 +85,25 @@ function runReleaseSanityCli(): void {
   console.log("Release sanity OK");
 }
 
+function listDistFiles(): string[] {
+  if (!existsSync("dist")) return [];
+
+  const files: string[] = [];
+  const walk = (dir: string, prefix = ""): void => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(join(dir, entry.name), relative);
+      } else {
+        files.push(relative);
+      }
+    }
+  };
+
+  walk("dist");
+  return files;
+}
+
 if (import.meta.main) {
   runReleaseSanityCli();
 }

src/release-sanity.ts scripts/release-sanity.tssrc/release-sanity.ts renamed to scripts/release-sanity.ts

@@ -1,6 +1,9 @@
 import { describe, expect, test } from "bun:test";
 
-import { assertCoverageThreshold, parseAllFilesLineCoverage } from "./coverage-threshold.js";
+import {
+  assertCoverageThreshold,
+  parseAllFilesLineCoverage,
+} from "../scripts/coverage-threshold.js";
 
 describe("parseAllFilesLineCoverage", () => {
   test("extracts line coverage from Bun's All files summary row", () => {

src/coverage-threshold.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
-import { checkReleaseSanity } from "./release-sanity.js";
+import { checkReleaseSanity } from "../scripts/release-sanity.js";
 
 const BASE_PACKAGE = {
   name: "@rethunk/github-mcp",
@@ -40,4 +40,14 @@ describe("checkReleaseSanity", () => {
       }),
     ).toEqual(['package.json "files" must include "dist".']);
   });
+
+  test("rejects test-only files in built dist artifacts", () => {
+    expect(
+      checkReleaseSanity({
+        packageJson: BASE_PACKAGE,
+        changelog: "## [1.2.3] — 2026-04-26\n",
+        distFiles: ["server.js", "server/test-harness.js"],
+      }),
+    ).toEqual(["dist must not include test-only artifact server/test-harness.js."]);
+  });
 });

src/release-sanity.test.ts

@@ -17,5 +17,5 @@
     "types": ["node"]
   },
   "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist", "**/*.test.ts"]
+  "exclude": ["node_modules", "dist", "**/*.test.ts", "src/server/test-harness.ts"]
 }