(magpie-site) 13/16: ci(preview): assert the production build carries no preview annotation

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie-site.git

commit e89299c032998ee09d0d4a72fd072f443a16d1b3
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Thu Sep 17 13:55:48 2026 +0200

    ci(preview): assert the production build carries no preview annotation
    
    The design's Constraints and Vendoring sections both claim a build check
    asserts this, but no such step existed — data-magpie-src could leak into
    a production build with nothing catching it. Add the assertion between
    the production Build step and the annotated preview rebuild.
    
    Generated-by: Claude Opus 5
---
 .github/workflows/build.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 41f509f..97dc245 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -76,6 +76,15 @@ jobs:
       - name: Build
         run: npm run build
 
+      - name: Assert the production build carries no preview annotation
+        run: |
+          if grep -rq "data-magpie-src" dist/; then
+            echo "::error::data-magpie-src found in a production build — it must never ship to magpie.apache.org"
+            grep -rl "data-magpie-src" dist/ | head -20
+            exit 1
+          fi
+          echo "production build is clean of preview annotation"
+
       - name: Build the preview site with source annotation
         if: github.event_name == 'pull_request'
         env: