From 329fe4cd4b28f1f261cb265d580d672cc564c80f Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Thu, 16 Apr 2026 18:02:42 -0400
Subject: [PATCH] ci: gate releases on fresh fabro-spa assets

Add a verify-spa job to the release workflow that rebuilds the SPA
and fails if committed assets are stale, and add the same check to
bin/dev/release.sh so tagging fails before anything is pushed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 13 +++++++++++++
 bin/dev/release.sh            | 13 +++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 31eb5a5a3..04d43d455 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,8 +14,21 @@ env:
   SEGMENT_WRITE_KEY: ${{ secrets.SEGMENT_WRITE_KEY }}
 
 jobs:
+  verify-spa:
+    name: Verify SPA assets
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2
+      - run: bun install
+      - run: scripts/refresh-fabro-spa.sh
+      - run: git diff --exit-code -- lib/crates/fabro-spa/assets
+
   compile:
     name: Compile (${{ matrix.target }})
+    needs: verify-spa
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
diff --git a/bin/dev/release.sh b/bin/dev/release.sh
index e10c143f6..569a65d2e 100755
--- a/bin/dev/release.sh
+++ b/bin/dev/release.sh
@@ -90,9 +90,22 @@ EOF
   done
 }
 
+verify_spa_assets() {
+  local repo_root
+  repo_root="$(git rev-parse --show-toplevel)"
+
+  "${repo_root}/scripts/refresh-fabro-spa.sh"
+
+  if ! git -C "$repo_root" diff --exit-code -- lib/crates/fabro-spa/assets >/dev/null; then
+    die "fabro-spa assets are stale. Commit the refreshed assets before releasing."
+  fi
+}
+
 main() {
   parse_args "$@"
 
+  verify_spa_assets
+
   local repo_root cargo_toml current_version base_version new_version tag
   repo_root="$(git rev-parse --show-toplevel)"
   cargo_toml="${repo_root}/Cargo.toml"