changelog.d/43.md

@@ -0,0 +1 @@
+- Keep package-lock metadata aligned with the package version and guard against future drift. (#43).

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "stoke",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "stoke",
-      "version": "1.3.0",
+      "version": "1.4.0",
       "license": "ISC",
       "dependencies": {
         "commander": "^15.0.0"

test/governance.test.js

@@ -11,6 +11,8 @@ const REPOSITORY_CONFIG = path.join(__dirname, '..', '.github', 'labels.conf');
 const REPOSITORY_LABELER = path.join(__dirname, '..', '.github', 'labeler.yml');
 const REPOSITORY_MIRROR = path.join(__dirname, '..', '.ceremony');
 const ROOT_AGENTS = path.join(__dirname, '..', 'AGENTS.md');
+const PACKAGE_MANIFEST = path.join(__dirname, '..', 'package.json');
+const PACKAGE_LOCK = path.join(__dirname, '..', 'package-lock.json');
 const CEREMONY_REPOSITORY = 'https://forgejo.heavyduty.builders/heavy-duty/ceremony';
 const CEREMONY_VERSION = '0.6.3';
 const CEREMONY_WORKFLOWS = ['labels.yml', 'labels-sweep.yml'];
@@ -134,6 +136,14 @@ test('repository scope mapping covers every configured scope with the ruled path
   }
 });
 
+test('package lock versions match the package manifest', () => {
+  const manifest = JSON.parse(fs.readFileSync(PACKAGE_MANIFEST, 'utf8'));
+  const lock = JSON.parse(fs.readFileSync(PACKAGE_LOCK, 'utf8'));
+
+  assert.equal(lock.version, manifest.version, 'package-lock.json version is stale');
+  assert.equal(lock.packages[''].version, manifest.version, 'package-lock.json root package version is stale');
+});
+
 test('repository carries the complete Forgejo 0.6.3 doctrine mirror and root router', () => {
   const vendored = ['AGENTS.md', 'TRIAGE.md', 'BUILDER.md', 'REVIEWER.md', 'LABELS.md', 'RELEASES.md'];
   for (const filename of vendored) {