Fail the build when published content stops being valid

• 01Snippets stored as data with a declared format, not embedded in prose.
• 02The checkers available on the runner. bash, node and python3 ship on GitHub-hosted Ubuntu.

1. 01

   Store the declared format alongside every snippet

   Without it there is nothing to check against, and a checker has to guess.

2. 02

   Parse each snippet with the real tool for its format node

   bash -n for shell, node --check for JavaScript, a YAML and XML parse, a field count for cron. Write to a temp file whose extension the tool expects.

3. 03

   Check the content rules you claim to hold, in the same pass

   Slug shape, field lengths, ordering, references that must resolve. A rule nothing enforces is a preference.

4. 04

   Exit non-zero and name every failure github-actions

   One report listing every problem beats failing on the first one.

name: CI

on:
  push:
    branches: ["**"]
  pull_request:

# The operator's machine cannot build this project: Turbopack fails to bind a
# worker port there, so local builds run --webpack while Vercel builds with
# Turbopack. That makes CI the only place a trustworthy build signal exists.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest
    env:
      # Public by construction: this is the NEXT_PUBLIC_ Convex URL the browser
      # already receives. Static generation reads published records at build.
      NEXT_PUBLIC_CONVEX_URL: https://exciting-deer-586.convex.cloud
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - name: Types
        run: npx tsc --noEmit

      - name: Lint
        run: npm run lint

      - name: Corpus conformance
        run: node scripts/check-payloads.mjs

      - name: Build
        run: npx next build

      - name: Audit production dependencies
        run: npm audit --omit=dev --audit-level=high

• !Node picks a module format from the file extension, so a snippet written to a .javascript file fails to parse for a reason that has nothing to do with the snippet.
• !A parse check proves syntax and nothing else. A script that parses cleanly and deletes the wrong directory passes.
• !Checking only the source file misses drift in what is actually published, if the two can differ.