fix: verify committed lib/ matches source in CI

[EndBug]

Summary

• Add a CI step that rebuilds the action and fails if committed lib/ differs from the fresh build (closes the build-integrity gap where only a bypassable Husky hook kept the bundle in sync).
• Pin Node 24 in the Test workflow and upload the expected lib/ as an artifact when the check fails.
• Document the rebuild + CI expectation in CONTRIBUTING.md (Husky unchanged as local DX).

Test plan

• Confirm the Build job passes on this PR with current lib/.
• Optionally verify failure mode: temporarily edit lib/index.js only and confirm Build fails and uploads the lib artifact.
• Confirm Test and Lint jobs still pass with Node 24.

Made with Cursor

Summary by CodeRabbit

• Chores

  • Updated automated build, test, and lint checks to use Node.js 24.
  • Added verification that generated build files remain synchronized, with diagnostic artifacts provided when checks fail.

• Documentation

  • Clarified contribution steps for building, committing generated files, and validating changes before testing.

[coderabbitai]

Warning

Review limit reached

@EndBug, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 36 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f4c79ac1-8a5a-403b-acae-923a88e7d1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 9ed5abc and b92c3c7.

📒 Files selected for processing (3)

• .github/workflows/test.yml
• CONTRIBUTING.md
• lib/index.js

📝 Walkthrough

Walkthrough

The workflow now uses Node.js 24 across build, test, and lint jobs. The build job checks committed lib/ output and uploads it when verification fails. Contribution instructions now describe the build and generated-output requirements.

Changes

CI consistency

Layer / File(s)	Summary
Workflow verification and contributor guidance .github/workflows/test.yml, CONTRIBUTING.md	The workflow uses Node.js 24. The build job compares committed lib/ with build output and uploads failed verification artifacts. The contribution instructions describe the build, generated output, Husky behavior, and test-repository testing.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main CI change: verifying that committed lib/ matches the build output.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/ci-lib-integrity-check

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

CONTRIBUTING.md (1)

8-8: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Document the Node.js version used for the integrity build.

The workflow rebuilds and checks lib/ with Node.js 24, but this instruction does not state that requirement. If another Node.js version changes the build output, contributors can create a bundle that fails only in CI. State Node.js 24 here, or enforce the same version with repository toolchain metadata.

📝 Proposed wording

-4. Build the action (`npm ci && npm run build`) and include any `lib/` changes in your commit.
+4. Use Node.js 24, build the action (`npm ci && npm run build`), and include any `lib/` changes in your commit.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CONTRIBUTING.md` at line 8, Update the build instruction in CONTRIBUTING.md
to explicitly require Node.js 24 for running npm ci and npm run build, matching
the CI integrity-build environment.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yml:
- Around line 22-26: Update the verify-lib check in the workflow to detect
untracked files under lib/ in addition to tracked diffs, using git ls-files
--others -- lib/ or an equivalent git status parser. Ensure any untracked
generated artifact causes the existing out-of-sync failure and prevents the
upload from being skipped.
- Around line 17-18: Update the workflow permissions to grant only contents:
read at workflow or job scope, and set persist-credentials: false on every
actions/checkout step unless a later step explicitly requires authenticated Git
commands.

---

Nitpick comments:
In `@CONTRIBUTING.md`:
- Line 8: Update the build instruction in CONTRIBUTING.md to explicitly require
Node.js 24 for running npm ci and npm run build, matching the CI integrity-build
environment.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dd73e30d-dda5-4231-8491-d9a6dac29079

📥 Commits

Reviewing files that changed from the base of the PR and between 86ab5dc and 9ed5abc.

📒 Files selected for processing (2)

• .github/workflows/test.yml
• CONTRIBUTING.md