socratiq-bundle-drift.yml

name: '🔒 SocratiQ Bundle Drift'

# =============================================================================
# SocratiQ source-to-bundle drift guard
# =============================================================================
#
# The book ships a pre-built bundle at
#   book/quarto/tools/scripts/socratiQ/bundle.js
# which is regenerated by `npm run build:vite` in socratiq/. Because the
# bundle is version-controlled, source edits that skip the rebuild step
# cause the rendered book to silently serve a stale widget.
#
# This workflow rebuilds the bundle on any PR that touches the widget's
# source or build inputs and fails if the committed bundle has drifted
# from what the sources produce.
#
# Triggers:
#   - pull_request on changes to socratiq sources / config / lockfile
#   - workflow_dispatch for manual runs
# =============================================================================

on:
  workflow_dispatch:
  pull_request:
    paths:
      - 'socratiq/src_shadow/**'
      - 'socratiq/vite.config.prod.mjs'
      - 'socratiq/vite.config.dev.mjs'
      - 'socratiq/package.json'
      - 'socratiq/package-lock.json'

permissions:
  contents: read

jobs:
  verify-bundle-matches-source:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: ${{ vars.NODE_VERSION || '20' }}
          cache: npm
          cache-dependency-path: socratiq/package-lock.json

      - name: Install socratiq dependencies
        run: npm ci
        working-directory: socratiq

      - name: Rebuild production bundle
        run: npm run build:vite
        working-directory: socratiq

      - name: Fail if committed bundle drifted from source
        run: |
          if ! git diff --exit-code book/quarto/tools/scripts/socratiQ/bundle.js; then
            echo "::error::socratiq sources changed but the committed bundle.js was not regenerated."
            echo "::error::Run 'npm run build:vite' in socratiq/ and commit the regenerated book/quarto/tools/scripts/socratiQ/bundle.js."
            exit 1
          fi