advisory check for published tarball drift [agent-managed]

.github/workflows/changeset.yaml

@@ -38,20 +38,79 @@ jobs:
           published_packages: ${{ steps.changesets.outputs.publishedPackages }}
           buildkite_webhook_url: ${{ secrets.ENCHIRIDION_BUILDKITE_WEBHOOK_URL }}
 
-  notify-slack:
+  notify-slack-success:
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs:
-      version
-      # We only trigger this flow if the publish is happening, inferred by not having a changeset.
-    if: needs.version.outputs.hasChangesets == 'false'
-    env:
-      PUBLISHED: ${{ needs.version.outputs.hasPublished }}
+    needs: version
+    if: needs.version.outputs.hasPublished == 'true'
+    steps:
+      - name: Notify successful publish
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          channel-id: 'C02NUQ27G56'
+          slack-message: 'Packages have been published'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  notify-slack-failure:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: version
+    if: ${{ always() && needs.version.result == 'failure' }}
     steps:
-      - name: Send
+      - uses: actions/checkout@v4
+
+      - name: Get failure context
+        id: context
+        run: |
+          SHA="${{ github.sha }}"
+          SHORT_SHA="${SHA:0:7}"
+          SUBJECT=$(git log -1 --format='%s' "$SHA")
+          echo "short_sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"
+          echo "subject=$SUBJECT" >> "$GITHUB_OUTPUT"
+          echo "run_url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" >> "$GITHUB_OUTPUT"
+
+      - name: Notify publish failure
         uses: slackapi/slack-github-action@v1.24.0
         with:
           channel-id: 'C02NUQ27G56'
-          slack-message: ${{ env.PUBLISHED == 'true' && 'Packages have been published' || 'Publishing failed' }}
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": ":x: *Publishing failed*"
+                  }
+                },
+                {
+                  "type": "section",
+                  "fields": [
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Commit:* <${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}|`${{ steps.context.outputs.short_sha }}`> ${{ steps.context.outputs.subject }}"
+                    },
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Pushed by:* ${{ github.actor }}"
+                    }
+                  ]
+                },
+                {
+                  "type": "actions",
+                  "elements": [
+                    {
+                      "type": "button",
+                      "text": {
+                        "type": "plain_text",
+                        "text": "View failed run"
+                      },
+                      "url": "${{ steps.context.outputs.run_url }}"
+                    }
+                  ]
+                }
+              ]
+            }
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

.github/workflows/check-package-output.yml

@@ -0,0 +1,26 @@
+name: Check package output
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+      - 'release/**'
+
+jobs:
+  check-package-output:
+    # Skip on changeset release branches (automated version bumps)
+    if: github.head_ref != 'changeset-release/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: ./.github/actions/setup
+
+      - name: Build workspace
+        run: pnpm turbo build
+
+      - name: Check package output drift
+        run: npx tsx scripts/check-package-output.ts

.prettierignore

@@ -17,6 +17,7 @@
 !*.scss
 
 # Explicitly ignore...
+.devbox/
 devbox.lock
 pnpm-lock.yaml
 **/CHANGELOG.md

eslint.config.js

@@ -14,6 +14,7 @@ import prettierRules from './.prettierrc.js'
 export default tseslint.config(
   {
     ignores: [
+      '.devbox/**',
       '**/CHANGELOG.md',
       '**/tmp/**',
       '**/*.d.ts',

package.json

@@ -25,6 +25,8 @@
     "reset": "pnpm clean && pnpm install --force",
     "chromatic": "chromatic",
     "changeset": "changeset",
+    "check:changeset": "changeset status --since=origin/main",
+    "check:package-output": "npx tsx scripts/check-package-output.ts",
     "plop": "plop",
     "pkg:aio": "pnpm -F @kaizen/components",
     "pkg:tokens": "pnpm -F @kaizen/design-tokens",