feat(ci): add package contents verification to CI and publish workflows

[scrollDynasty]

Summary

DrumPicker.podspec was never published to npm. It exists in the repo but was missing from the files array in package.json, which is an allow-list — npm stripped it at pack time.

Because react-native.config.js declares ios: {} without an explicit podspecPath, the React Native CLI resolves the podspec by globbing *.podspec over the package root. It found nothing, so the pod never entered the Podfile, the Fabric component was never compiled, and iOS rendered Unimplemented component: <DrumPickerView>. Android was unaffected because Gradle autolinking only needs android/, which was published correctly.

Verified against the real tarballs — the podspec is absent from both 0.2.4 and 0.3.0, so every iOS consumer on the current latest is broken.

Why CI did not catch it

ios-build builds the example app straight from the workspace, where the podspec is always reachable through the yarn symlink, and ios-unit-tests lints ../../DrumPicker.podspec by explicit path. Both stay green with a completely broken tarball, because nothing ever inspected the artifact npm actually publishes. This PR closes that gap so the same class of bug cannot ship again.

Changes

• add DrumPicker.podspec to the files array
• add scripts/check-package-contents.mjs — validates the real npm pack --dry-run output: podspec present at the tarball root (a nested copy would not be autolinked), react-native.config.js, android/build.gradle, the manifest and Kotlin sources, the JS entry points read back from package.json itself, and that the podspec's source_files glob resolves non-empty
• new required package-contents CI job, plus the same check in publish.yml before npm publish and in prepublishOnly for local publishes

No dependencies added; the script is dependency-free ESM.

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / chore (CI guard against regression)
• Native change (Android Kotlin / iOS Swift)
• Tests only

Checklist

• I read CONTRIBUTING.md
• I tested on Android and/or iOS (platforms I changed) — see Verification below; no native source changed, and the packaging fix was verified at the tarball level, not on a device
• I ran yarn lint, yarn build, yarn typecheck, and yarn test from the repo root
• I added or updated tests in the correct folder — n/a: CONTRIBUTING maps tests to TS logic / Android native / iOS native, and this is a packaging change. The regression guard is the new package-contents CI job instead
• I updated docs if the public API changed — n/a, public API unchanged
• I committed yarn.lock if package.json dependencies changed — n/a, no dependency changes
• I did not add unnecessary dependencies
• I removed debug logs from library code
• I did not hardcode demo values in src/, android/, or ios/ (example app only)
• For native changes: I considered memory leaks and scroll performance — n/a, no native source touched

Verification

Check	Result
yarn check:package after yarn build	83 files, all required native and JS artifacts present
Negative test — podspec entry removed from files	exits 1, reports the missing path
Run without a prior build	exits 1, points at the missing entry points
yarn test	16 suites, 133 tests passing
yarn typecheck	clean
yarn lint	clean
npm pack react-native-drum-picker@0.2.4 / @0.3.0	confirmed the podspec is absent from both published tarballs

Final confirmation on a device is a pod install in a consumer app against the packed tarball, which needs macOS. The ios-build and ios-unit-tests jobs in this PR still exercise the podspec itself, and package-contents proves it now ships at the tarball root.

CI

PRs to main run the full CI workflow automatically. This PR adds one required job, package-contents, wired into all-checks-passed.

Screenshots / recordings (UI changes)

n/a — no UI change.

Related issues

Fixes #21

Summary by CodeRabbit

• New Features

  • Added automated verification that published packages include required entry points and native platform files.
  • Included the iOS podspec in the published npm package.

• Bug Fixes

  • Publishing now stops when required package contents are missing or invalid.

• Chores

  • Integrated package-content checks into continuous integration and publishing workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f85cf79b-84f4-4298-bb83-8599ba949e4d

📥 Commits

Reviewing files that changed from the base of the PR and between e17f315 and 6ca9c18.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/publish.yml
• package.json
• scripts/check-package-contents.mjs

---

📝 Walkthrough

Walkthrough

The package now publishes DrumPicker.podspec and validates npm tarball contents, including JavaScript entry points and native Android/iOS files. CI and publishing workflows run this validation after builds and require it to pass.

Changes

Package contents verification

Layer / File(s)	Summary
Package contents contract and checker package.json, scripts/check-package-contents.mjs	The package manifest includes DrumPicker.podspec, and the new checker validates packed entry points, required native files, and native source patterns.
CI and publish enforcement .github/workflows/ci.yml, .github/workflows/publish.yml	CI adds package-content validation to its required checks, while publishing verifies package contents after building.

Estimated code review effort: 2 (Simple) | ~15 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding package contents verification to CI and publish workflows.
Linked Issues check	✅ Passed	The PR includes DrumPicker.podspec in the package files and updates publish flow, which addresses issue #21.
Out of Scope Changes check	✅ Passed	The added CI and verification script are directly related to validating the packaged fix and preventing regressions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/publish-podspec

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

scripts/check-package-contents.mjs

Parsing error: Cannot use keyword 'await' outside an async function

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}