mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-25 07:03:03 -04:00
124f2a50f0
Release jobs could package and publish generated native or executable payloads without a release-time signal if a packlist regression omitted a required file. Add read-only verification jobs before each trusted-publishing job. They pack every generated package, verify its declared literal payload files against the source artifacts, and smoke-test the v11 plain-JS CLI, the v11 executable wrapper with its native package, and the pnpr wrapper with its Linux native package. Keeping the smoke tests outside OIDC-enabled publishing jobs prevents an artifact executed during verification from obtaining a trusted-publishing token. The verification tarballs live outside package directories so they cannot become part of subsequently published archives.