ci: build before npm publish reads the manifest

[cardmagic]

Why

Every release logs this twice:

npm warn package-json solid-objects@0.16.0 No bin file found at dist/executable.js

The package was never broken

I checked before changing anything, because the warning reads like a shipped defect:

Check	Result
package/dist/executable.js in the published 0.16.0 tarball	present
node_modules/.bin/solid-objects after npm install solid-objects@0.16.0	links to ../solid-objects/dist/executable.js
npx solid-objects --help from a clean consumer install	prints usage

So this is a warning defect, not a packaging defect. It still deserves fixing: a message that says the binary is missing, printed while publishing that binary, will send the next person chasing nothing.

Cause

npm validates bin against the working tree when it reads the manifest. The publish job left the build to prepack, which npm runs afterwards:

22:38:11  npm warn ... No bin file found at dist/executable.js
22:38:22  npm notice 📦  solid-objects@0.16.0

Eleven seconds apart. dist/ did not exist yet at validation time.

Reproduced locally: rm -rf dist && npm publish --dry-run warns twice; after pnpm run build it warns zero times.

Fix

The publish job builds before it invokes npm, and publishes with --ignore-scripts so the build runs once rather than twice. A dry run produces the same 377 files the published 0.16.0 contains.

Regression guard

check-package.mjs asserted dist/executable.js by name, so pointing bin at a path the build does not produce still passed. Demonstrated by renaming the target: the old check exited 0. It reads the manifest now:

Error: bin solid-objects points at dist/renamed-cli.js, which the build does not produce

Validation

pnpm run pack:check, pnpm test (528 passed), pnpm run check, prettier --check — all clean.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with the explicit build fully replacing the only lifecycle action skipped during publishing.

Summary

This PR prevents npm’s misleading missing-bin warning by building before manifest validation and avoiding the redundant prepack build. It also makes package validation follow the manifest-declared binary targets.

• Builds distribution artifacts before invoking npm publish.
• Uses --ignore-scripts after explicitly performing the sole prepack action.
• Validates every manifest-declared binary for existence and executable permissions.
• Documents the release-process correction in the changelog.

_{Reviews (1) · Last reviewed commit: "ci: build before npm publish reads the m..."}