From 864724085cb3c01c8e0d7676c3dc6936c4b9d88b Mon Sep 17 00:00:00 2001
From: jwinterm <johnwmurphy@gmail.com>
Date: Sat, 18 Jul 2026 20:06:04 -0400
Subject: [PATCH] ci: gate on operator console dist freshness

New console-drift job rebuilds admin-ui from the lockfile (npm ci) and
fails if the committed admin-ui/dist drifts. rust-embed bakes dist into
the binary, so a stale dist ships an old console; this mirrors the
openapi-drift gate. Pinned to Node 22 (the version that built the
committed bundle) so the byte-diff is deterministic.
---
 .github/workflows/ci.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 29b8a57..5cadc26 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,6 +36,26 @@ jobs:
           cargo run --quiet --bin gen_openapi > /tmp/openapi.json
           diff openapi.json /tmp/openapi.json
 
+  console-drift:
+    name: operator console drift gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      # Rebuild the admin-ui bundle from source (npm ci = reproducible from the
+      # lockfile) and fail if the committed admin-ui/dist drifts. rust-embed bakes
+      # dist into the server binary, so a stale dist would silently ship an old
+      # console. Same guarantee the openapi-drift job gives the API client.
+      - name: Rebuild admin-ui; fail if dist drifts from committed
+        working-directory: admin-ui
+        run: |
+          npm ci
+          npm run build
+      - name: git diff (dist must be committed and current)
+        run: git diff --exit-code -- admin-ui/dist
+
   rust:
     name: fmt / clippy / build / test / doc-test
     runs-on: ubuntu-latest