build.yml

name: Check npm build

on:

  pull_request:
    branches:
      - main
    paths:
      - "dist/**"
      - "src/**"
      - "package.json"
      - "package-lock.json"

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: read  # Only need read access for checking

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: true

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "20"
          check-latest: true

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Check for uncommitted changes
        run: |
          if [ -n "$(git status --porcelain dist/)" ]; then
            echo "::error::Built files in dist/ are not up to date. Please run 'npm run build' locally and commit the changes."
            echo "The following files have changes:"
            git status --porcelain dist/
            git diff dist/
            exit 1
          else
            echo "✅ Built files are up to date"
          fi