solidjs / solid / 33220050080

72%

main: 89%

push

github

ci: harden the release pipeline (invariants, artifact dry-run, smoke test)

Three guards born from the rc.4 outage post-mortem:

- check-release-invariants.mjs: fails main CI and the version step if the
  compiler platform link stubs or workspace overrides are removed, or if
  any release-versioned package is registry-resolved in the lockfile —
  the exact layout drift that deadlocked the rc.4 release commit.
  version-packages also self-validates with a frozen lockfile-only check,
  so a broken bot-generated lockfile fails at version time, before the
  version PR is even pushed (workflows never run on the bot's PR: events
  created with GITHUB_TOKEN do not trigger them).
- verify-release-artifacts.mjs: release.mjs now dry-run-publishes every
  fixed-group package and asserts the tarball contains the manifest's
  entry points before anything real publishes.
- smoke-release.mjs: new post-publish job installs the released packages
  from the real registry into a temp project and exercises dist-tags,
  the native compiler binary, and the runtime.

Co-authored-by: Cursor <cursoragent@cursor.com>

517 of 789 branches covered (65.53%)

Branch coverage included in aggregate %.

767 of 1003 relevant lines covered (76.47%)

14.52 hits per line