fix: harden npm publish packaging
Merged
KH
7mo ago+779-15
Summary
- publish the exact npm tarball that was packed and validated instead of publishing the mutable working directory
- add a tarball validator that rejects hard links, nested workspace node_modules, and non-bundled workspace package leaks
- narrow root package files from broad packages/ inclusion to runtime package artifacts
- run the tarball validation gate in package-validation CI
- include the relay workflow used to coordinate this hardening
Verification
- node --check scripts/validate-npm-tarball.mjs
- node --check workflows/ci/harden-npm-publish.ts
- npm_config_cache=/tmp/relay-npm-cache npm run pack:validate
pack:validate result: 10047 entries, 17.2 MB package, 66.6 MB unpacked, 0 violations.
