From f75ea08ab4dbea023c6b0ae1821b62521b33a1dc Mon Sep 17 00:00:00 2001
From: n0ctal <4c866w5fn9@privaterelay.appleid.com>
Date: Tue, 18 Aug 2026 16:44:55 +0500
Subject: [PATCH] fix(frontend): keep the MSW worker in step with the lockfile
 (#6222)

The tracked frontend/public/mockServiceWorker.js is generated by msw and pinned
at 2.14.7, while package-lock.json installs 2.15.0. msw rewrites the worker on
postinstall, so npm ci leaves the tree dirty on a clean checkout and every
contributor either commits an unrelated 30-line diff or discards it.

Regenerate the worker for the locked version and add a check that compares it
against the installed runtime, wired into make verify and CI so the pair cannot
drift again.
---
 .github/workflows/ci.yml | 3 +++
 Makefile                 | 6 +++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1323531ba..38659bc5b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -182,6 +182,9 @@ jobs:
       - name: Install
         run: npm ci
         working-directory: frontend
+      - name: Verify generated MSW worker is current
+        run: git diff --exit-code -- public/mockServiceWorker.js package-lock.json
+        working-directory: frontend
       - name: Lint
         run: npm run lint
         working-directory: frontend
diff --git a/Makefile b/Makefile
index 352b7e240..07b5d97a1 100644
--- a/Makefile
+++ b/Makefile
@@ -41,6 +41,10 @@ lint: lint-go lint-fe ## All linters
 typecheck: ## tsc --noEmit
 	cd $(FRONTEND) && npm run typecheck
 
+.PHONY: msw-worker-check
+msw-worker-check: ## Verify the tracked worker matches the installed MSW runtime
+	cmp $(FRONTEND)/public/mockServiceWorker.js $(FRONTEND)/node_modules/msw/lib/mockServiceWorker.js
+
 .PHONY: test-go
 test-go: dist-stub ## Go tests (shuffle, no cache)
 	go test -shuffle=on -count=1 $(GO_PKGS)
@@ -75,5 +79,5 @@ build-storybook: ## Build the static Storybook (compile-checks all stories)
 # The PR gate. Matches ci.yml: codegen freshness, both linters, typecheck,
 # both test suites, a full build, and the Storybook compile-check.
 .PHONY: verify
-verify: gen-check lint typecheck test build build-storybook ## Full local gate (mirrors CI)
+verify: gen-check lint typecheck msw-worker-check test build build-storybook ## Full local gate (mirrors CI)
 	@echo "verify: OK"