Fixes #7202: Verify integrity of bundled assets in CI

Author: thatmattlove

Diff for: .github/workflows/ci.yml

@@ -58,6 +58,9 @@ jobs:
 
     - name: Check UI ESLint, TypeScript, and Prettier Compliance
       run: yarn --cwd netbox/project-static validate
+    
+    - name: Validate Static Asset Integrity
+      run: scripts/verify-bundles.sh
 
     - name: Run tests
       run: coverage run --source="netbox/" netbox/manage.py test netbox/

Diff for: docs/release-notes/version-3.0.md

@@ -9,6 +9,7 @@
 * [#7169](https://github.com/netbox-community/netbox/issues/7169) - Fix CSV import file upload
 * [#7176](https://github.com/netbox-community/netbox/issues/7176) - Fix issue where query parameters were duplicated across different forms of the same type
 * [#7193](https://github.com/netbox-community/netbox/issues/7193) - Fix prefix (flat) template issue when viewing child prefixes with prefixes available
+* [#7202](https://github.com/netbox-community/netbox/issues/7202) - Verify integrity of static assets in CI
 
 ---
 

Diff for: scripts/verify-bundles.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+# This script verifies the integrity of *bundled* static assets by re-running the bundling process
+# and checking for changed files. Because bundle output should not change given the same source
+# input, the bundle process shouldn't produce any changes. If they do, it's an indication that
+# the dist files have been altered, or that dist files were not committed. In either case, tests
+# should fail.
+
+PROJECT_STATIC="$PWD/netbox/project-static"
+DIST="$PROJECT_STATIC/dist/"
+
+# Bundle static assets.
+bundle() {
+    echo "Bundling static assets..."
+    yarn --cwd $PROJECT_STATIC bundle >/dev/null 2>&1
+    if [[ $? != 0 ]]; then
+        echo "Error bundling static assets"
+        exit 1
+    fi
+}
+
+# See if any files have changed.
+check_dist() {
+    local diff=$(git --no-pager diff $DIST)
+    if [[ $diff != "" ]]; then
+        local SHA=$(git rev-parse HEAD)
+        echo "Commit '$SHA' produced different static assets than were committed"
+        exit 1
+    fi
+}
+
+bundle
+check_dist
+
+if [[ $? = 0 ]]; then
+    echo "Static asset check passed"
+    exit 0
+else
+    echo "Error checking static asset integrity"
+    exit 1
+fi