v0.8.66: Run web facts drift check before regenerating tracked facts

[Hmbown]

Why this matters

The web facts drift gate is supposed to fail CI when the tracked web/lib/facts.generated.ts file is stale. The current workflow regenerates that tracked file before running the drift check, so CI can self-heal the working tree and then compare fresh facts against freshly generated facts. That lets stale committed facts pass.

Current behavior

web/lib/facts.generated.ts is tracked:

git ls-files web/lib/facts.generated.ts
# web/lib/facts.generated.ts

The web CI workflow regenerates it before checking drift:

• .github/workflows/web.yml:35-44

- name: Generate derived facts
  run: npm run prebuild
- name: Check facts drift
  run: npm run check:facts

npm run prebuild is node scripts/derive-facts.mjs:

• web/package.json:8

check-facts.mjs then reads web/lib/facts.generated.ts as the committed source of truth, but at that point the workflow may already have rewritten it:

• web/scripts/check-facts.mjs:36-50
• web/scripts/check-facts.mjs:105-122

Local evidence from the current candidate shows the file is tracked and drifted in the working tree:

web/lib/facts.generated.ts
-  "generatedAt": "2026-06-24T09:06:20.600Z",
-  "version": "0.8.65",
+  "generatedAt": "2026-06-29T01:20:23.492Z",
+  "version": "0.8.66",

Desired behavior

1. CI should check committed facts drift before regenerating web/lib/facts.generated.ts, or verify that regeneration produces no tracked diff.
2. A stale committed facts file should fail CI.
3. The workflow comments should accurately describe whether facts.generated.ts is tracked or ignored.

Repro or evidence

Inspect the workflow order and tracked file state:

git ls-files web/lib/facts.generated.ts
git diff -- web/lib/facts.generated.ts | sed -n '1,80p'
nl -ba .github/workflows/web.yml | sed -n '35,44p'
nl -ba web/package.json | rg -n '"prebuild"|"check:facts"' -C 2

The workflow runs prebuild before check:facts, while facts.generated.ts is tracked.

Acceptance criteria

• Web CI fails when web/lib/facts.generated.ts is stale in the committed tree.
• Either npm run check:facts runs before npm run prebuild, or CI runs git diff --exit-code web/lib/facts.generated.ts after generation.
• The workflow no longer claims facts.generated.ts is gitignored if it remains tracked.
• cd web && npm run check:facts still passes when committed facts match the workspace.
• Add or document a focused verification step for stale committed facts.

Related

• Related: v0.8.69: Add a website fact-drift gate for version, providers, and tool inventory #3415, the original website fact-drift gate issue.
• Related: feat(web): add fact-drift CI gate #3481, the merged fact-drift CI gate implementation.