From 9e2cee71fc9a17bfc8a41d5d7a881cedca1d9af4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Kuna?=
 <1282324+codecalm@users.noreply.github.com>
Date: Mon, 21 Sep 2026 18:52:37 +0200
Subject: [PATCH] Run `check:compat --strict` in the Release workflow (#3123)

---
 .agents/skills/backward-compat/SKILL.md | 2 +-
 .github/workflows/build.yml             | 6 +++---
 .github/workflows/release.yml           | 9 +++++++++
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.agents/skills/backward-compat/SKILL.md b/.agents/skills/backward-compat/SKILL.md
index fab49c8d3..a3fc7ba39 100644
--- a/.agents/skills/backward-compat/SKILL.md
+++ b/.agents/skills/backward-compat/SKILL.md
@@ -125,7 +125,7 @@ It reports what the release has and the build lost, one key per line:
 | `js:tabler.esm.js:tabler` | a top-level export is gone |
 | `file:dist/libs/litepicker/dist/litepicker.js` | a file is gone from the package |
 
-Fix each one with the patterns from section 3, then run it again. Known breaks are listed in `.build/compat-baseline.txt`; when you fix one, delete its line, or the check fails on the stale entry. Never add a line to the baseline to make a PR green. A line gets ` # accepted: <why>` only after the maintainers decided to ship that break. CI runs the check after the build, and with `--strict` on the versions pull request, so a release cannot be merged while an unaccepted line is left.
+Fix each one with the patterns from section 3, then run it again. Known breaks are listed in `.build/compat-baseline.txt`; when you fix one, delete its line, or the check fails on the stale entry. Never add a line to the baseline to make a PR green. A line gets ` # accepted: <why>` only after the maintainers decided to ship that break. CI runs the check after the build. The Release workflow runs it with `--strict` on every push to `dev`, before it opens the versions pull request or publishes, so nothing reaches npm while an unaccepted line is left.
 
 `check:compat` compares names. `check:compat-fixture` covers behaviour: `.build/compat-fixture/` is a small project written the way a user of the last release would write it (`@use … with` on old variables, old functions, `rgba(var(--tblr-primary-rgb), .5)`, an empty `.legend`, the libraries in `dist/libs`, `tabler.tabler.getColor()`), and the check runs it against the release and against the working tree. Every assertion has to give the same answer on both.
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5f3d19598..0791b8716 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,9 +23,9 @@ jobs:
       - name: Build
         run: pnpm exec turbo build
 
-      # Nothing the last release shipped may disappear in a minor release. The
-      # versions pull request runs it with --strict, so a release cannot be
-      # merged while compat-baseline.txt still lists a break nobody accepted.
+      # Nothing the last release shipped may disappear in a minor release. On the
+      # versions pull request it runs with --strict, but workflows there wait for
+      # a manual approval, so the Release workflow runs --strict too.
       - name: Check backward compatibility
         env:
           STRICT: ${{ github.head_ref == 'changeset-release/dev' && '--strict' || '' }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 445b897e4..b67345436 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,15 @@ jobs:
       - name: Build
         run: pnpm run build
 
+      # The last gate before npm: nothing the previous release shipped may be
+      # missing, unless compat-baseline.txt marks it as accepted. It runs here and
+      # not only on the versions pull request, because workflows on a pull request
+      # opened by the bot wait for a manual approval and may never run. On the
+      # push that publishes, the local version is not on npm yet, so the check
+      # compares with `latest`, which is the release users update from.
+      - name: Check backward compatibility
+        run: pnpm run check:compat --strict
+
       - name: Create release Pull Request or publish to NPM
         id: changesets
         uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2