release: v0.3.5

.github/workflows/release-artifact.yml

@@ -89,28 +89,6 @@ jobs:
             echo "Tag v${VERSION} is free — will build and release."
           fi
 
-      # Creating a tag and a Release needs contents: write, which is declared above
-      # but only actually granted if the repository allows it (Settings -> Actions ->
-      # General -> Workflow permissions). Surface a likely problem now rather than
-      # after several minutes of building.
-      #
-      # Deliberately a warning, not a failure: this reads the authenticated actor's
-      # push permission, and if that ever reports false for a token that can in fact
-      # write, a hard gate here would block every release for no reason. The
-      # authoritative check is the release step itself, which fails loudly.
-      - name: Warn early if the token looks unable to write
-        if: steps.gate.outputs.release == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          can_push=$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.permissions.push // false' 2>/dev/null || echo unknown)
-          if [ "${can_push}" = "true" ]; then
-            echo "Token reports write access."
-          else
-            echo "::warning::Token write access reported as '${can_push}'. If the release step fails with a 403, set Settings -> Actions -> General -> Workflow permissions to 'Read and write permissions'."
-          fi
-
       - uses: actions/setup-node@v4
         if: steps.gate.outputs.release == 'true'
         with:
@@ -165,6 +143,14 @@ jobs:
             exit 1
           fi
 
+          # src/ is deliberately not shipped: it was 37% of the payload, and users run
+          # dist/, never the sources. Assert it stays out so a later edit to
+          # package.json "files" cannot quietly put ~6 MB back into every download.
+          if printf '%s\n' "${manifest}" | grep -q '^airo-wp/src/'; then
+            echo "::error::${ZIP} contains src/. Uncompiled sources must not ship - users run dist/. Remove 'src/' from package.json \"files\"."
+            exit 1
+          fi
+
           echo "Artifact OK: autoloader present, ${block_count} block.json files."
 
       - name: Create tag and GitHub Release

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.3.5
+
+- Reduced the download by 41%: uncompiled block sources are no longer shipped inside the plugin. Only the compiled output users actually run is included
+- The build is now a hard precondition of packaging, so a skipped or stale asset build fails the release instead of producing a plugin that registers nothing
+
 ## 0.3.4
 
 - Added Git Updater support: `GitHub Plugin URI`, `Primary Branch` and `Release Asset` plugin headers, so the plugin can update itself from this repository's GitHub Releases

README.md

@@ -22,7 +22,7 @@
 |---|---|
 | **Plugin name** | Airo WP AI Builder |
 | **Text domain** | `airo-wp` |
-| **Version** | 0.3.4 |
+| **Version** | 0.3.5 |
 | **Requires WordPress** | 6.9+ |
 | **Requires PHP** | 7.4+ |
 | **License** | [GPLv2 or later](https://www.gnu.org/licenses/gpl-2.0.html) |

airo-wp.php

@@ -3,7 +3,7 @@
  * Plugin Name:       Airo WP AI Builder
  * Plugin URI:        https://github.com/godaddy-wordpress/airo-wp
  * Description:       MCP server and block pattern library for AI-powered site building.
- * Version:           0.3.4
+ * Version:           0.3.5
  * Requires at least: 6.9
  * Requires PHP:      7.4
  * Author:            GoDaddy
@@ -47,7 +47,7 @@
 defined( 'ABSPATH' ) || exit;
 
 if ( ! defined( 'AIRO_WP_VERSION' ) ) {
-	define( 'AIRO_WP_VERSION', '0.3.4' );
+	define( 'AIRO_WP_VERSION', '0.3.5' );
 }
 if ( ! defined( 'AIRO_WP_PLUGIN_FILE' ) ) {
 	define( 'AIRO_WP_PLUGIN_FILE', __FILE__ );

package.json

@@ -1,6 +1,6 @@
 {
   "name": "airo-wp",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "private": true,
   "files": [
     "airo-wp.php",
@@ -12,7 +12,6 @@
     "functions/",
     "includes/",
     "patterns/",
-    "src/",
     "vendor/",
     "composer.json"
   ],

readme.txt

@@ -4,7 +4,7 @@ Tags: airo, godaddy, mcp, ai, block-patterns
 Requires at least: 6.9
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 0.3.4
+Stable tag: 0.3.5
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -71,6 +71,10 @@ Runtime Composer packages are namespace-prefixed with Strauss into `dependencies
 
 == Changelog ==
 
+= 0.3.5 =
+* Reduced the download by 41% — uncompiled block sources are no longer shipped inside the plugin
+* The asset build is now a hard precondition of packaging, so a stale build fails the release instead of shipping a plugin that registers nothing
+
 = 0.3.4 =
 * Added Git Updater support so the plugin can update itself from this repository's GitHub Releases
 * Every release now attaches a built, installable zip to its GitHub Release

tests/e2e/setup/build-zip.mjs

@@ -37,18 +37,6 @@ for ( const cmd of [
 	}
 }
 
-function removeTestDirs( dir ) {
-	for ( const entry of readdirSync( dir, { withFileTypes: true } ) ) {
-		if ( ! entry.isDirectory() ) continue;
-		const entryPath = path.join( dir, entry.name );
-		if ( entry.name === 'test' ) {
-			rmSync( entryPath, { recursive: true, force: true } );
-		} else {
-			removeTestDirs( entryPath );
-		}
-	}
-}
-
 // Strip dev artifacts from Strauss-prefixed dependencies (mirrors build-zip.sh cleanup)
 const DEV_DIR_NAMES = new Set( [ '.github', 'tests', 'docs' ] );
 function cleanDevArtifacts( dir ) {
@@ -69,9 +57,55 @@ const depsDir = path.join( ROOT, 'dependencies' );
 if ( existsSync( depsDir ) ) {
 	cleanDevArtifacts( depsDir );
 }
-const srcDir = path.join( ROOT, 'src' );
-if ( existsSync( srcDir ) ) {
-	removeTestDirs( srcDir );
+
+// The zip no longer ships src/, so dist/ is the only copy of the block code that
+// reaches users. That makes a skipped or stale build silent and fatal rather than
+// merely wasteful: the archive would contain neither compiled blocks nor the source
+// they came from, and a plugin that registers nothing can still pass a lint.
+//
+// Assert instead that every block in src/ has a compiled counterpart in dist/. This
+// catches a build that never ran AND a build that predates a newly added block.
+// npm run build:zip runs wp-scripts build first, so a failure here means the build
+// was skipped or it failed without stopping the pipeline.
+{
+	const blockNames = ( dir ) => {
+		const base = path.join( ROOT, dir, 'blocks' );
+		if ( ! existsSync( base ) ) return null;
+		return new Set(
+			readdirSync( base, { withFileTypes: true } )
+				.filter( ( e ) => e.isDirectory() && existsSync( path.join( base, e.name, 'block.json' ) ) )
+				.map( ( e ) => e.name )
+		);
+	};
+
+	const src = blockNames( 'src' );
+	const dist = blockNames( 'dist' );
+
+	if ( ! src ) {
+		console.error( 'build-zip.mjs: src/blocks/ not found — cannot verify the build.' );
+		process.exit( 1 );
+	}
+
+	if ( ! dist ) {
+		console.error(
+			'build-zip.mjs: dist/blocks/ is missing. The asset build did not run.\n' +
+				'  Run `npm run build:zip` (which builds first), not build-zip.mjs directly.'
+		);
+		process.exit( 1 );
+	}
+
+	const missing = [ ...src ].filter( ( name ) => ! dist.has( name ) ).sort();
+
+	if ( missing.length > 0 ) {
+		console.error(
+			`build-zip.mjs: ${ missing.length } block(s) in src/ have no compiled output in dist/:\n` +
+				missing.map( ( n ) => `  ${ n }` ).join( '\n' ) +
+				'\n  dist/ is stale or the build failed. Re-run `npm run build`.'
+		);
+		process.exit( 1 );
+	}
+
+	console.log( `build-zip.mjs: build verified — ${ dist.size } compiled blocks match src/.` );
 }
 
 const result = spawnSync( 'npx', [ 'wp-scripts', 'plugin-zip' ], {