Automate dist regeneration for Rolldown updates

[amyu]

Summary

• detect Renovate pull requests that update Rolldown
• rebuild and validate the checked-in dist/ files at the pull request head
• commit regenerated files back to the Renovate branch when the bundle changes
• leave Rolldown updates for manual review and merge

Why

Rolldown updates can change bundled output even when application source files do not change. Renovate updates package.json and pnpm-lock.yaml, but it does not regenerate dist/, so check-dist fails and requires a manual build commit.

Design

The workflow only handles pull requests created by the Renovate GitHub App account, from the same repository, on a renovate/rolldown-* branch, with package manifest changes.

The build job has read-only repository access, does not persist Git credentials, and runs pnpm run all, covering postinstall patches, lint, formatting, type checking, and bundling. If dist/ changes, it uploads the generated files as an artifact.

A separate job verifies that the pull request head has not moved, downloads the artifact from the same workflow run, and commits only dist/. This job receives contents: write and does not execute dependency or generated code. The built-in repository-scoped GITHUB_TOKEN is used, so no additional secret is required.

Security

• GitHub Actions are pinned to full commit SHAs.
• The Renovate account is checked by both login and immutable account ID.
• Pull request branch names are passed through an environment variable instead of being interpolated into shell code.
• The unpinned pnpm dlx rimraf build step is replaced with the Node.js filesystem API.
• Rolldown updates are excluded from patch automerge and require a manual merge decision.

Validation

• zizmor 1.29.0 with online audits
• actionlint 1.7.12
• pnpm run all with Node.js 24.19.0 and pnpm 11.20.0
• git diff --check