release: v1.0.18 and reproducible widget build

.github/workflows/widget-build.yml

@@ -0,0 +1,25 @@
+name: Widget build
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  widget-build:
+    name: Verify widget artifacts
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+      - name: Rebuild and compare committed assets
+        run: pnpm check-widget

.node-version

@@ -0,0 +1 @@
+24.15.0

DEVELOPER_NOTES.md

@@ -1,7 +1,10 @@
 # Developer Notes
 
-To develop, `pnpm i && pnpm dev`
-To build, `pnpm build-widget`
+Use the Node version in `.node-version` and the pnpm version in `package.json#packageManager`.
+
+To develop, `pnpm install --frozen-lockfile && pnpm dev`.
+To build release assets and update `plugin-v1.js`, run `pnpm build-widget`.
+To check that the widget assets match the current sources and lockfile, run `pnpm check-widget`.
 
 There's a few point of entry for Plugin, and each has specific reasons:
 

PUBLISH.md

@@ -1,10 +1,17 @@
 ## Publishing/Tagging new version
-- Bump version
-- pnpm i
-- pnpm build-widget
-- BUNDLE_NAME=plugin-$(node -e "console.log(require('./package.json').version);") && cp ./public/$BUNDLE_NAME.js ./public/plugin-v1.js
-- Publish by merging
-- Reminder to clear cloudflare cache
+
+1. Use the exact Node version in `.node-version` and pnpm version in `package.json#packageManager`.
+2. Bump the package version when releasing changed widget code or dependencies.
+3. Run `pnpm build-widget`. It validates the toolchain, runs `pnpm install --frozen-lockfile --prod=false`, builds without Webpack's cache, and updates the versioned assets plus `public/plugin-v1.js`.
+4. Run `pnpm check-widget`. It rebuilds into a temporary directory and fails if any generated asset is missing or differs from `public/`, including the `plugin-v1.js` alias. It does not overwrite public assets.
+5. Commit generated assets alongside the source, config, and lockfile changes that produced them. CI runs the same check on every PR and push to `main`.
+6. Publish by merging, then clear the Cloudflare cache.
+
+For intentional dependency changes, update and commit `pnpm-lock.yaml` before building. Release builds never regenerate the lockfile. Changes to build inputs require rebuilding the widget, even if the version is unchanged.
+
+`verifyDepsBeforeRun: false` disables pnpm's automatic install before scripts, so it cannot update the lockfile before the release command performs its frozen install.
+
+The GitHub check is named `Verify widget artifacts`. Configure it as a required status check in the `main` branch rules to prevent merging stale bundles.
 
 ## Publishing to NPM
 - pnpm tsup