From 66223c6cd5db7269c04ed2e87b28626d17744822 Mon Sep 17 00:00:00 2001
From: Slate Rehm <yehumbleaccounts@pm.me>
Date: Wed, 26 Aug 2026 13:47:48 -0500
Subject: [PATCH] ci: verify published package

---
 .github/workflows/publish.yml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index deab71a..2300a1f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,12 @@ name: publish
 on:
   release:
     types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Published package version to verify
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -24,6 +30,22 @@ jobs:
           scope: "@bearfire-dev"
       - run: pnpm install --frozen-lockfile
       - run: pnpm check
-      - run: pnpm publish --no-git-checks
+      - if: github.event_name == 'release'
+        run: pnpm publish --no-git-checks
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify published package
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PACKAGE_VERSION: ${{ inputs.version || github.event.release.tag_name }}
+        working-directory: ${{ runner.temp }}
+        run: |
+          mkdir package-consumer
+          cd package-consumer
+          pnpm init
+          pnpm add --lockfile-only "@bearfire-dev/env@${PACKAGE_VERSION#v}"
+      - name: Upload consumer lockfile
+        uses: actions/upload-artifact@v6
+        with:
+          name: consumer-lockfile
+          path: ${{ runner.temp }}/package-consumer/pnpm-lock.yaml