Automate dist regeneration for Rolldown updates

[amyu]

Summary

• rebuild checked-in dist/ files automatically for Rolldown Renovate updates
• validate the generated commit with the existing dist, lint, and Android test workflows
• keep Rolldown updates subject to manual review and merge

Why

Rolldown updates can change bundled output even when application source files do not change. Renovate updates package.json and pnpm-lock.yaml, but it does not regenerate dist/, so check-dist fails and requires a manual build commit.

A commit pushed with the repository GITHUB_TOKEN does not trigger the normal pull request workflows. Without an explicit follow-up, checks remain associated with the pre-generation commit and the production bundle is not tested.

Flow

1. A base-controlled pull_request_target workflow accepts only same-repository pull requests created by the Renovate GitHub App account on a renovate/rolldown-* branch.
2. A read-only job verifies the changed-path allowlist and confirms that Rolldown is the only package.json change, then rebuilds dist/ without persisted Git credentials.
3. If the bundle changes, a separate write job verifies that the pull request head has not moved, commits only dist/, and pushes it with the repository GITHUB_TOKEN.
4. The write job dispatches check-dist.yml, lint.yml, and test.yml for the updated branch. Those runs test the dispatch event SHA, and shared per-PR concurrency cancels checks for the pre-generation commit.

No personal access token or additional repository secret is required.

Security

• The privileged workflow definition comes from the base branch, not the pull request branch.
• Unexpected changed paths are rejected; only package.json, pnpm-lock.yaml, and generated dist/ files are accepted.
• The manifest guard rejects changes to scripts or dependencies other than Rolldown.
• Dependency and generated code runs only in the job with contents: read; the write job never executes it.
• Dispatched validation workflows use contents: read, do not persist checkout credentials, and always test their own github.sha instead of accepting a caller-selected commit SHA.
• GitHub Actions are pinned to full commit SHAs.
• The Renovate account is checked by both login and immutable account ID.
• Pull request values reach shell scripts through quoted environment variables.
• Rolldown updates are excluded from patch automerge and require a manual merge decision.

The remaining trust boundary is the Rolldown package and its resolved lockfile. The generated bundle therefore remains visible for human review before merge.

Validation

• actionlint 1.7.12
• zizmor 1.29.0 with online audits: no unsuppressed low-or-higher findings in the affected workflows
• pnpm run all with Node.js 24.19.0 and pnpm 11.20.0
• path and manifest guards exercised against Rolldown PR Update dependency rolldown to v1.2.3 #824
• git diff --check

The live dispatch path can only be exercised after these workflow definitions are present on the default branch, as required by workflow_dispatch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4e8338ac7a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Trigger CI after committing the generated bundle

Whenever Rolldown changes dist/, this push uses the persisted repository GITHUB_TOKEN; GitHub documents that events caused by that token do not create new workflow runs (Triggering a workflow from a workflow). Consequently, the runs from check-dist.yml, lint.yml, and especially the Android matrix in test.yml remain associated with the pre-generation SHA, so the newly committed production bundle is never tested and required latest-head checks may remain missing. Push with credentials that trigger workflows, or run the complete downstream validation against the generated commit before updating the branch.

Useful? React with 👍 / 👎.