fix(release): validate npm-only evidence versions

This commit is contained in:
Dallin Romney
2026-07-14 03:44:00 -07:00
parent 7da3e6a55b
commit 452d217984
4 changed files with 105 additions and 24 deletions
@@ -161,9 +161,9 @@ if ! jq -e \
no_reuse "workflow SHA is not on trusted main lineage"
fi
# Exact-target reuse still requires internally consistent version stamps
# (for example package.json must agree with the macOS plist).
if ! (cd "$REPO_DIR" && node "$PREFLIGHT" --macos-versions-only >&2); then
# Exact-target reuse still requires internally consistent npm version stamps.
# Native version metadata is outside the npm-only extended-stable contract.
if ! (cd "$REPO_DIR" && node "$PREFLIGHT" --npm-versions-only >&2); then
no_reuse "target version metadata is inconsistent"
fi