From 00fb1dc1bdfc11a3b42ce8cbf9fa272c954cf625 Mon Sep 17 00:00:00 2001
From: Affaan Mustafa <affaan@dcube.ai>
Date: Sun, 12 Apr 2026 03:08:56 -0700
Subject: [PATCH] fix: verify final npm payload in release script

---
 scripts/release.sh            | 10 +++-------
 tests/scripts/release.test.js | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/scripts/release.sh b/scripts/release.sh
index 27377222..9518d514 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -70,13 +70,6 @@ if [[ -z "$OLD_VERSION" ]]; then
 fi
 echo "Bumping version: $OLD_VERSION -> $VERSION"
 
-# Build and verify the packaged OpenCode payload before mutating any manifest
-# versions or creating a tag. This keeps a broken npm artifact from being
-# released via the manual script path.
-echo "Verifying OpenCode build and npm pack payload..."
-node scripts/build-opencode.js
-node tests/scripts/build-opencode.test.js
-
 update_version() {
   local file="$1"
   local pattern="$2"
@@ -228,6 +221,9 @@ update_selective_install_repo_version "$SELECTIVE_INSTALL_ARCHITECTURE_DOC"
 
 # Verify the bumped release surface is still internally consistent before
 # writing a release commit, tag, or push.
+echo "Verifying OpenCode build and npm pack payload..."
+node scripts/build-opencode.js
+node tests/scripts/build-opencode.test.js
 node tests/plugin-manifest.test.js
 
 # Stage, commit, tag, and push
diff --git a/tests/scripts/release.test.js b/tests/scripts/release.test.js
index 8cda7eb2..3a0511c6 100644
--- a/tests/scripts/release.test.js
+++ b/tests/scripts/release.test.js
@@ -46,6 +46,24 @@ function runTests() {
     );
   })) passed++; else failed++;
 
+  if (test('release script verifies npm pack payload after version updates and before commit/tag', () => {
+    const updateIndex = source.indexOf('update_version "$ROOT_PACKAGE_JSON"');
+    const packCheckIndex = source.indexOf('node tests/scripts/build-opencode.test.js');
+    const commitIndex = source.indexOf('git commit -m "chore: bump plugin version to $VERSION"');
+
+    assert.ok(updateIndex >= 0, 'release.sh should update package version fields');
+    assert.ok(packCheckIndex >= 0, 'release.sh should run build-opencode.test.js');
+    assert.ok(commitIndex >= 0, 'release.sh should create the release commit');
+    assert.ok(
+      updateIndex < packCheckIndex,
+      'build-opencode.test.js should run after versioned files are updated'
+    );
+    assert.ok(
+      packCheckIndex < commitIndex,
+      'build-opencode.test.js should run before the release commit is created'
+    );
+  })) passed++; else failed++;
+
   console.log(`\nResults: Passed: ${passed}, Failed: ${failed}`);
   process.exit(failed > 0 ? 1 : 0);
 }