Every open Dependabot PR targeting `main` fails the `NPM build` check's "Check build changes" step (e.g. #94, bumping axios). Dependabot only touches `package.json`/`package-lock.json` — it never runs `npm run build`, so the committed `js/`/`css/` bundle goes stale relative to the new dependency tree, and the workflow's post-build `git status --porcelain` diff check fails.
This is specific to `office` being a shipped, non-appstore app: compiled assets have to live in git (see #9, "for shipping the app we need to have compiled assets in the repo"), unlike a typical App Store app where the store's own pipeline builds at packaging time and contributors keep `js/`/`css/` out of the repo entirely.
Fix per PR: comment `/compile` (the `command-compile.yml` bot) before merging, so it recompiles and commits fresh assets. This needs to happen on every dependency-bump PR against `main` (and `stable34`), not just source PRs.
Worth considering as a follow-up: have Dependabot (or a scheduled job) auto-comment `/compile` on its own PRs so this isn't a manual step every time.
Every open Dependabot PR targeting `main` fails the `NPM build` check's "Check build changes" step (e.g. #94, bumping axios). Dependabot only touches `package.json`/`package-lock.json` — it never runs `npm run build`, so the committed `js/`/`css/` bundle goes stale relative to the new dependency tree, and the workflow's post-build `git status --porcelain` diff check fails.
This is specific to `office` being a shipped, non-appstore app: compiled assets have to live in git (see #9, "for shipping the app we need to have compiled assets in the repo"), unlike a typical App Store app where the store's own pipeline builds at packaging time and contributors keep `js/`/`css/` out of the repo entirely.
Fix per PR: comment `/compile` (the `command-compile.yml` bot) before merging, so it recompiles and commits fresh assets. This needs to happen on every dependency-bump PR against `main` (and `stable34`), not just source PRs.
Worth considering as a follow-up: have Dependabot (or a scheduled job) auto-comment `/compile` on its own PRs so this isn't a manual step every time.