chore: mark action bundles as generated and cover extract-version in check_dist - #81
Open
marc0olo wants to merge 1 commit into
Open
chore: mark action bundles as generated and cover extract-version in check_dist#81marc0olo wants to merge 1 commit into
marc0olo wants to merge 1 commit into
Conversation
marc0olo
force-pushed
the
chore/mark-dist-generated
branch
2 times, most recently
from
August 3, 2026 17:11
dba8737 to
52c4a56
Compare
marc0olo
changed the title
marc0olo
force-pushed
the
chore/mark-dist-generated
branch
from
August 4, 2026 07:30
52c4a56 to
6b648ab
Compare
The four JavaScript actions run from a committed dist/index.js, so every runtime dependency is bundled into it. That puts large generated artifacts in the middle of every review: #79 changed 28 lines of package.json and pnpm-lock.yaml plus 3,176 lines of rebuilt bundle, so 99% of that review was generated output. Marks them as generated in .gitattributes so they collapse in pull request diffs. Reviewers see the source changes, and check_dist:required continues to guarantee that the collapsed output is exactly what that source compiles to, which is what makes collapsing it safe rather than reckless. Adds extract-version to the check_dist matrix. It is a node24 action with an 856K bundle that was not covered, so a stale bundle there went unverified, and it is the action release workflows use to read the version being published. Its committed bundle is currently in sync, so this adds coverage without requiring a rebuild. Documents both in CONTRIBUTING.md, including the part that is easy to miss: a dependency fix without rebuilt bundles does not change what runs, because the lockfile is not consulted when GitHub executes an action. Adds a matching convention to the README, since this repo documents conventions for other repositories too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
marc0olo
force-pushed
the
chore/mark-dist-generated
branch
from
August 4, 2026 07:38
6b648ab to
81762e4
Compare
There was a problem hiding this comment.
Pull request overview
Reduces review noise from committed JavaScript action bundles by marking them as generated in GitHub diffs, while strengthening safety by ensuring the dist-check workflow also verifies the extract-version bundle.
Changes:
- Add
.gitattributesrule to markactions/*/dist/**aslinguist-generated=trueso bundled output collapses in PR diffs. - Expand
self-check-distworkflow matrix to includeextract-version, ensuring its committeddist/is verified for drift. - Document the rationale and workflow expectations in
README.mdand.github/CONTRIBUTING.md.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
README.md |
Documents collapsing generated action bundles in PR diffs and emphasizes pairing it with a dist drift check. |
.github/workflows/self-check-dist.yaml |
Adds extract-version to the dist verification matrix so its bundle is also checked. |
.github/CONTRIBUTING.md |
Explains why bundles are committed and clarifies that dependency-only updates don’t affect runtime until bundles are rebuilt. |
.gitattributes |
Marks actions/*/dist/** as generated so GitHub collapses bundle diffs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The four JavaScript actions run from a committed
dist/index.js, so every dependency is bundled into it and the bundles land in every review as large generated diffs.#79 is the clearest case. It changed 28 lines of
package.jsonandpnpm-lock.yaml, plus 3,176 lines of rebuilt bundle — 99% of that review was generated output that nobody can meaningfully read.Changes
1. Mark the bundles as generated —
.gitattributeswithactions/*/dist/** linguist-generated=true, so GitHub collapses them in diffs.check_dist:requiredis what makes this safe rather than reckless: it rebuilds and fails on any difference, so the collapsed output is provably what the reviewed source compiles to.2. Add
extract-versionto thecheck_distmatrix. It is anode24action with an 856K bundle that was not covered, and it is what release workflows use to read the version being published, so a stale bundle there went unverified. Its committed bundle is currently in sync, so this adds coverage without requiring a rebuild.3. Document both in
CONTRIBUTING.md, plus a matching convention in theREADME. The part worth writing down: a dependency fix without rebuilt bundles does not change what runs, because the lockfile is not consulted when GitHub executes an action.Only the file contents fold — the diff stat still lists the changed bundles.
Verification
git check-attrconfirms the attribute applies;pnpm buildproduces no drift;prettier --check .clean.check_dist:requiredpasses for all four actions, including the newly addedextract-version.An earlier revision of this PR also added a dispatched
Rebuild distworkflow. It was removed: for anyone with a clonepnpm buildis just as fast, and it was not worth a workflow plus a privileged-token path. Local rebuild stays the documented route.🤖 Generated with Claude Code