Files
claude-hud/.github/workflows/build-dist.yml
Jarrod Watts de083ae9c6 security: add CI workflow to build dist/ after merge (#12)
* security: add CI workflow to build dist/ after merge

Phase 1 of removing dist/ from PRs to close security attack vector.

Changes:
- Add build-dist.yml workflow that builds and commits dist/ on push to main
- Update CONTRIBUTING.md with build process documentation
- Reset CHANGELOG.md to 0.0.1 (initial release)

After this is verified working, Phase 2 will remove dist/ from git tracking.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: prevent CI re-trigger on dist/ changes

Add paths-ignore for dist/** to ci.yml so CI doesn't re-run when
build-dist workflow commits compiled output. Addresses race condition.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: add concurrency, permissions, and build verification

Address review feedback:
- Add concurrency group to queue builds (prevents race conditions)
- Add explicit contents: write permission
- Add build verification step (test -f dist/index.js)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: run tests before building dist/

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-04 22:41:00 +11:00

43 lines
919 B
YAML

name: Build dist
on:
push:
branches: [main]
concurrency:
group: build-dist
cancel-in-progress: false
permissions:
contents: write
jobs:
build:
runs-on: ubuntu-latest
if: "!contains(github.event.head_commit.message, '[auto]')"
steps:
- uses: actions/checkout@v4
with:
token: ${{ secrets.GITHUB_TOKEN }}
- uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- run: npm ci
- run: npm test
- run: npm run build
- name: Verify build output
run: test -f dist/index.js || exit 1
- name: Commit dist/
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add dist/ --force
git diff --staged --quiet || git commit -m "build: compile dist/ [auto]"
git push