Add CI check to detect stale dist/ build #108

Background

This action runs dist/index.js (see action.yml), which is a bundle of src/ and all runtime dependencies produced by ncc.
However, nothing in CI verifies that the committed dist/ is in sync with src/, package.json, and package-lock.json.

As a result, dependency updates can be merged without the bundle being rebuilt, and the changes never reach users.

For example:

• chore(deps): bump the other-dependencies group with 2 updates #105 bumped undici 7.29.1 → 7.30.0 without rebuilding dist/, so the shipped bundle still contains 7.29.1 (last rebuilt in fix(deps): bump @actions/core to 2.0.3 and @actions/github to 8.0.1, rebuild dist #104).
• chore(deps): bump the other-dependencies group across 1 directory with 2 updates #107 bumps undici to 7.30.1, which includes several security fixes, but again only touches package.json / package-lock.json.

The existing pr-test.yml workflow does not catch this, because it runs npm run build before uses: ./, so it tests a fresh build rather than the committed dist/.

Proposal

Add a CI job that rebuilds dist/ and fails if the result differs from the committed one.

name: Check dist

on:
  pull_request:
    branches: [ main ]
  push:
    branches: [ main ]

jobs:
  check-dist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'npm'

      - run: npm ci

      - run: npm run build

      - name: Compare dist/
        run: |
          if [ -n "$(git status --porcelain dist/)" ]; then
            echo "dist/ is out of date. Please run 'npm ci && npm run build' and commit the result."
            # we need to detect new files, so use `git status --porcelain` instead of `git diff --exit-code` 
            git status --porcelain dist/ 
            git diff --stat dist/
            exit 1
          fi

Tasks

• Confirm a clean rebuild of main (after the follow-up rebuild PR) yields no diff
• Add check-dist workflow
• Add check-dist as a required status check
• Decide and document how Dependabot PRs get dist/ rebuilt