fix(webcomponents): publish SRI manifest [ENG-13134]

[lihuelg]

Summary

• generate a release SRI manifest for the published webcomponents entry artifact
• wire manifest generation into the webcomponents build and clean stale output
• add focused generator tests

Jira

ENG-13134

Validation

• node syntax checks passed
• direct SRI generator success and missing-artifact smoke tests passed
• Jest was not available in the standalone package environment

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 324a09f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[nx-cloud]

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

---

View your CI Pipeline Execution ↗ for commit 324a09f

Command	Status	Duration	Result
nx test @snippet/react	❌ Failed	6m 2s	View ↗
nx test @e2e/nextjs-sdk-next-app	✅ Succeeded	9m	View ↗
nx test @snippet/angular-17-ssr	✅ Succeeded	11m 56s	View ↗
nx test @snippet/gen1-next14-pages	✅ Succeeded	11m 25s	View ↗
nx test @e2e/qwik-city	✅ Succeeded	10m 4s	View ↗
nx test @e2e/solid-start	✅ Succeeded	7m 49s	View ↗
nx test @e2e/sveltekit	✅ Succeeded	10m 44s	View ↗
nx test @e2e/hydrogen	✅ Succeeded	9m 57s	View ↗
Additional runs (24)	✅ Succeeded	...	View ↗

💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗.

---

☁️ Nx Cloud last updated this comment at 2026-08-19 20:52:06 UTC

[builder-io-integration]

Builder reviewed your changes — looks good ✅

Review Details

Code Review Summary

This PR adds a small Node-based release helper that reads the webcomponents package version, hashes the published dist/system/builder-webcomponents-async.js artifact with SHA-384, and writes a newline-terminated sri-manifest.json. The build script cleans stale manifest output before rebuilding and invokes manifest generation after the unpkg distribution step, while focused tests cover both successful output and a missing artifact.

The approach is sound for the intended release artifact: the generator uses the exact bytes from disk, preserves the package version, fails naturally when required inputs are missing, and is safely executable both as a CLI and an imported helper. Both parallel reviewers found the same low-severity process concern: the repository's ci:test --if-present convention does not run these new Jest tests because this package has no ci:test script. This is not included as an actionable inline finding at the selected standard-risk threshold, but adding a non-watch CI test script would improve regression protection.

Risk assessment: Standard (release/build behavior and published artifact integrity).

✅ No confirmed bugs were found in build sequencing, artifact path selection, hashing, or manifest packaging.

🧪 Browser testing: Skipped — PR only modifies backend/config/docs, no UI impact