From b2e7b4f1506ff0a03be60693730f6108134b2ecc Mon Sep 17 00:00:00 2001
From: MGrin <mr6r1n@gmail.com>
Date: Tue, 11 Aug 2026 21:52:16 +0800
Subject: [PATCH] ci: prove the plugin is installable from git: on every PR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A runtime import parked in devDependencies builds fine in a clone and
fails for every real user, because bb's managed git install resolves
runtime dependencies only (`npm install --omit=dev --omit=optional
--ignore-scripts`) before running `bb plugin build`. That asymmetry made
bb-plugin-system uninstallable (MGrin/bb-plugin-system#2) with nothing in
the repo to catch it.

This workflow reproduces the managed install exactly — prod-only npm
install, then `npx bb-app@<pinned> bb plugin build .` — and fails the PR
if the dist/ artifacts a git: install needs are missing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/managed-install.yml | 52 +++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/workflows/managed-install.yml

diff --git a/.github/workflows/managed-install.yml b/.github/workflows/managed-install.yml
new file mode 100644
index 0000000..f9d5f95
--- /dev/null
+++ b/.github/workflows/managed-install.yml
@@ -0,0 +1,52 @@
+# Proves this plugin is installable with `bb plugin install git:…`.
+#
+# bb's managed git install resolves runtime dependencies ONLY
+# (`npm install --omit=dev --omit=optional --ignore-scripts`) and then runs
+# `bb plugin build`, which inlines every import except @bb/plugin-sdk,
+# better-sqlite3 and node builtins. A runtime import parked in
+# devDependencies therefore builds fine in a clone and fails for every real
+# user. This job reproduces that exact sequence so the asymmetry cannot come
+# back silently.
+name: Managed install
+
+on:
+  pull_request:
+  push:
+    branches: [main, main-public]
+  workflow_dispatch:
+
+jobs:
+  managed-install:
+    name: git install builds with runtime deps only
+    runs-on: ubuntu-latest
+    env:
+      BB_VERSION: "0.36.0"
+      BB_DATA_DIR: ${{ github.workspace }}/.bb-data
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Cache the bb plugin build toolchain
+        uses: actions/cache@v4
+        with:
+          path: ${{ github.workspace }}/.bb-data/plugins
+          key: bb-toolchain-${{ runner.os }}-${{ env.BB_VERSION }}
+
+      - name: Install runtime dependencies only (as bb's managed install does)
+        run: npm install --omit=dev --omit=optional --ignore-scripts --no-audit --no-fund
+
+      - name: Build the plugin bundles
+        run: npx --yes --package "bb-app@${BB_VERSION}" bb plugin build .
+
+      - name: Assert the install artifacts exist
+        run: |
+          for artifact in dist/server.js dist/server.meta.json dist/app.js dist/app.css dist/app.meta.json; do
+            if [ ! -s "$artifact" ]; then
+              echo "::error::$artifact was not produced — the plugin is not installable from git:"
+              exit 1
+            fi
+            echo "ok  $artifact"
+          done