Make the PR workflow a real gate

- continue-on-error is removed; lint, test and build each have to pass,
  and fail-fast is off so each reports on its own
- after each step the tree must be unchanged (eslint --fix,
  packageInfo.ts written by the build)
- after build, scripts/check-built-manifests.py checks the package.json
  npm receives from each build/ directory
- push-main installs with --immutable and checks the manifests too
- the auto-approve and auto-merge bots are removed

.github/workflows/auto-approve.yml

@@ -1,16 +0,0 @@
-name: bot
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  approve:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jacogr/action-approve@795afd1dd096a2071d7ec98740661af4e853b7da
-        with:
-          authors: jacogr, TarikGul
-          labels: -auto
-          token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/auto-merge.yml

@@ -1,16 +0,0 @@
-name: bot
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  merge:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jacogr/action-merge@d2d64b4545acd93b0a9575177d3d215ae3f92029
-        with:
-          checks: pr (build),pr (lint),pr (test)
-          labels: -auto
-          strategy: squash
-          token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/pr-any.yml

@@ -3,8 +3,9 @@ on: [pull_request]
 
 jobs:
   pr:
-    continue-on-error: true
     strategy:
+      # Each step reports on its own; one red step must not cancel the others.
+      fail-fast: false
       matrix:
         step: ['lint', 'test', 'build']
     runs-on: ubuntu-latest
@@ -17,5 +18,16 @@ jobs:
         node-version: 'lts/*'
     - name: ${{ matrix.step }}
       run: |
+        corepack enable
         yarn install --immutable
         yarn ${{ matrix.step }}
+    # `yarn lint` runs eslint --fix and `yarn build` rewrites packageInfo.ts,
+    # so both pass on a tree they changed. The committed tree must already be
+    # what they produce.
+    - name: tree unchanged
+      run: git diff --exit-code --stat
+    # The package.json each build/ directory holds is what npm receives: entry
+    # points must exist, no ./build/ or ./cjs/cjs/ paths, no workspace: ranges.
+    - name: check built manifests
+      if: matrix.step == 'build'
+      run: python3 scripts/check-built-manifests.py .

.github/workflows/push-main.yml

@@ -5,19 +5,21 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]')"
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
     - uses: actions/setup-node@v4
       with:
         node-version: 'lts/*'
     - name: Build
       run: |
         corepack enable
-        yarn install
+        yarn install --immutable
         yarn build
+    - name: Check built manifests
+      run: python3 scripts/check-built-manifests.py .